How-To: Prevent UCS from assigning O365 licenses to new users

Problem

By default, the Office 365 Connector automatically assigns the first available license to a new user from one of the service plans that is set in the UCR variable office365/subscriptions/service_plan_names if no specific license is configured. This can lead to unintentional license assignments. The behavior is visible in /var/log/univention/listener.log with the following message:

No SubscriptionProfiles: using all available subscriptions (defaultADconnection).

Solution

To prevent UCS from assigning licenses automatically, you can create a placeholder profile that blocks the automatic license assignment. This method ensures that no licenses are mistakenly assigned to users who shouldn’t have them.

Step 1

Create a new subscription profile that acts as a placeholder for new users. This profile will not correspond to any actual Office 365 license.

udm office365/profile create --set name=placeholder --set subscription=placeholder --position cn=profiles,cn=office365,$(ucr get ldap/base)

Step 2

Assign the placeholder profile to the appropriate user groups, such as the groups representing schools or other organizational units, to ensure that this placeholder is applied by default.

Bildschirmfoto vom 2024-10-10 10-20-10

Step 3

After assigning the placeholder profile, check /var/log/univention/listener.log to confirm that the profile is being applied to new users. You should now see a message similar to:

Subscription from profile SubscriptionProfile(placeholder: placeholder) (defaultADconnection) could not be found in the enabled subscriptions in Azure.

This topic was automatically closed after 24 hours. New replies are no longer allowed.

Mastodon