When processing a request to deprovision an Azure AD user, Active Roles uses this policy to determine if the licenses assigned to the Azure AD user must be retained.
When an Azure AD User is deprovisioned, this policy ensures that the administrator-assigned Microsoft 365 licenses are retained based on the policy configuration.
You can configure the Office 365 Licenses Retention policy to specify how you want Active Roles to modify the Azure AD user’s licenses in Azure AD upon a request to deprovision the Azure AD user.
When an Azure user is deprovisioned from the Active Roles Console, Web Interface, or Management Shell, the Microsoft 365 licenses that were assigned to the user during user provisioning are retained based on the Office 365 Licenses Retention policy configuration. As per the policy set, all the licenses or only selected licenses are retained upon the user deprovision.
The changes that take effect after deprovisioning the user are reflected in the Azure portal and the Azure Properties > Licenses tab of the Azure AD user in the Web Interface.
Active Roles Console enables you to create a new Deprovisioning Policy Object or add to the existing Built-in Policy – User Default Deprovisioning policy. For instructions on how to create a Deprovisioning Policy Object, see Creating a Policy Object. The Office 365 Licenses Retention policy from the User Deprovisioning Policies must be selected to enable retention of the required Microsoft 365 licenses upon Azure AD user deprovisioning.
NOTE: The Office 365 Licenses Retention policy is enabled only if Azure AD is configured.
You can configure a new Microsoft 365 license retention policy with the Office 365 License Retention policy type in the Active Roles Console.
To configure an Microsoft 365 license retention policy
-
On the Policy to Configure page, select Office 365 License Retention, then click Next.
Figure 64: Office 365 Licenses Retention page
-
On the Office 365 Licenses Retention page, select the options you want the policy to apply when deprovisioning the Azure AD user.
-
Select the tenant from which the licenses have to be retained for the user from the drop-down list.
-
Select the check box corresponding to Retain all the licenses option to enable the deprovisioned Azure AD user to retain all the Microsoft 365 licenses after successful deprovisioning.
-
Click Next.
The Enforce Policy page is displayed, which enables you to specify objects to which this Policy Object is to be applied.
-
Click Add, and use the Select Objects dialog to locate and select the objects on which you want to enforce the policy.
-
Click Next, then click Finish.
NOTE: Consider the following when configuring an Microsoft 365 licenses retention policy:
-
After performing an Undo Provisioning operation on the deprovisioned Azure AD user, the original licenses assignment made to the user at the time of user provisioning is restored to the user.
-
In Active Roles with Office365 Licenses Rention policy applied, when a deprovisioned Azure AD user tries to set licenses, a policy violation error is displayed.
-
For more information on deprovisioning Policy Objects and creating new deprovisioning policies see Deprovisioning Policy Objects and Creating a Policy Object.
The Deprovisioning Results window displays the deprovision operation results pertaining to the Office 365 Licenses Retention policy. The results display a report of the success or failure of the policy.
Table 11: Office 365 License Retention policy
|
In accordance with the policy, the Azure AD user's Office 365 licenses are retained. |
Not applicable |
|
Azure User Office 365 licenses are retained. |
Not applicable |
Policies in this category are intended to automate the removal of deprovisioned user accounts from groups. A policy can be configured to remove user accounts from all groups with optional exceptions. Individual policy rules can be applied to security groups and to mail-enabled groups of both the security and distribution type.
