05/09/2023 20:55 IntuneDocs/intune/fundamentals/licenses-assign.

md at main · MicrosoftDocs/IntuneDocs · GitHub

MicrosoftDocs / IntuneDocs Public

Code Issues 25 Pull requests 3 Actions Projects Security Ins

IntuneDocs / intune / fundamentals / licenses-assign.md

ErikjeMS 4 years ago

119 lines (76 loc) · 6.75 KB

Preview Code Blame

title description keywords author ms.author manager ms

Assign
Assign licenses to
Microsoft users so
ErikjeMS erikje dougeby 12/1
Intune they can
licenses enroll in
Intune

Assign licenses to users so they can enroll

devices in Intune
Whether you manually add users or synchronize from your on-premises Active
Directory, you must first assign each user an Intune license before users can enroll their
devices in Intune. For a list of licenses, see Licenses that include Intune.

Note
Users assigned Intune app protection policy and not enrolling their devices into
Microsoft Intune will also require an Intune license to receive policy.

Assign an Intune license Microsoft Endpoint Manager

Admin Center
You can use the Microsoft Endpoint Manager Admin Center to manually add cloud-
based users and assign licenses to both cloud-based user accounts and accounts
synchronized from your on-premises Active Directory to Azure AD.
https://github.com/MicrosoftDocs/IntuneDocs/blob/main/intune/fundamentals/licenses-assign.md 1/5
05/09/2023 20:55 IntuneDocs/intune/fundamentals/licenses-assign.md at main · MicrosoftDocs/IntuneDocs · GitHub

1. In the Microsoft Endpoint Manager Admin Center, select Users > All Users >
choose a user > Licenses > Assignments.

2. Choose the box for Intune > Save.

3. The user account now has the permissions needed to use the service and enroll
devices into management.

Note
Users will appear in the Classic Intune portal only after they have enrolled a device
using the Intune PC client. Also, you can select a group of users to edit at once,
either selecting to add or replace a license for all selected users.

Assign an Intune license by using Azure Active Directory

You can also assign Intune licenses to users by using Azure Active Directory. For more
information, see the License users in Azure Active Directory article.

Use School Data Sync to assign licenses to users in

Intune for Education
If you are an educational organization, you can use School Data Sync (SDS) to assign
Intune for Education licenses to synced users. Just choose the Intune for Education
checkbox when you're setting up your SDS profile.

https://github.com/MicrosoftDocs/IntuneDocs/blob/main/intune/fundamentals/licenses-assign.md 2/5
05/09/2023 20:55 IntuneDocs/intune/fundamentals/licenses-assign.md at main · MicrosoftDocs/IntuneDocs · GitHub

When you assign an Intune for Education license, make sure that Intune A Direct license
is also assigned.

See this overview of School Data Sync to learn more about SDS.

How user and device licenses affect access to services

Each user that you assign a user software license to may access and use the online
services and related software (including System Center software) to manage
applications and up to 15 MDM devices. The Intune PC agent allows 5 physical and
1 virtual machine per user license.
You can purchase licenses for any devices separately from user licenses. Device
licenses do not need to be assigned to the devices. Each device that accesses and
uses the online services and related software (including System Center software)
must have a device license.
https://github.com/MicrosoftDocs/IntuneDocs/blob/main/intune/fundamentals/licenses-assign.md 3/5
05/09/2023 20:55 IntuneDocs/intune/fundamentals/licenses-assign.md at main · MicrosoftDocs/IntuneDocs · GitHub

If a device is used by more than one user, each requires a device software license
or all users require a user software license.

Understanding the type of licenses you have purchased

How you purchased Intune determines your subscription information:

If you purchased Intune through an Enterprise Agreement, you can find your
subscription information in the Volume License portal under Subscriptions.
If you purchased Intune through a Cloud Solution Provider, check with your
reseller.
If you purchased Intune with a CC# or Invoice, then your licenses will be user-
based.

Use PowerShell to selectively manage EMS user licenses

Organizations that use Microsoft Enterprise Mobility + Security (formerly Enterprise
Mobility Suite) might have users who only require Azure Active Directory Premium or
Intune services in the EMS package. You can assign one or a subset of services using
Azure Active Directory PowerShell cmdlets.

To selectively assign user licenses for EMS services, open PowerShell as an administrator
on a computer with the Azure Active Directory Module for Windows PowerShell
installed. You can install PowerShell on a local computer or on an ADFS server.

You must create a new license SKU definition that applies only to the desired service
plans. To do this, disable the plans you don’t want to apply. For example, you might
create a license SKU definition that does not assign an Intune license. To see a list of
available services, type:

(Get-MsolAccountSku | Where {$_.SkuPartNumber -eq "EMS"}).ServiceStatus

You can run the following command to exclude the Intune service plan. You can use the
same method to expand to an entire security group or you can use more granular
filters.

Example 1
Create a new user on the command line and assign an EMS license without enabling
the Intune portion of the license:

Connect-MsolService

New-MsolUser -DisplayName “Test User” -FirstName FName -LastName LName -

https://github.com/MicrosoftDocs/IntuneDocs/blob/main/intune/fundamentals/licenses-assign.md 4/5
05/09/2023 20:55 IntuneDocs/intune/fundamentals/licenses-assign.md at main · MicrosoftDocs/IntuneDocs · GitHub

UserPrincipalName user@<TenantName>.onmicrosoft.com –Department DName -

UsageLocation US

$CustomEMS = New-MsolLicenseOptions -AccountSkuId "<TenantName>:EMS" -

DisabledPlans INTUNE_A
Set-MsolUserLicense -UserPrincipalName user@<TenantName>.onmicrosoft.com
-AddLicenses <TenantName>:EMS -LicenseOptions $CustomEMS

Verify with:

(Get-MsolUser -UserPrincipalName
"user@<TenantName>.onmicrosoft.com").Licenses.ServiceStatus

Example 2
Disable the Intune portion of EMS license for a user that is already assigned with a
license:

Connect-MsolService

$CustomEMS = New-MsolLicenseOptions -AccountSkuId "<TenantName>:EMS" -

DisabledPlans INTUNE_A
Set-MsolUserLicense -UserPrincipalName user@<TenantName>.onmicrosoft.com
-LicenseOptions $CustomEMS

Verify with:

(Get-MsolUser -UserPrincipalName
"user@<TenantName>.onmicrosoft.com").Licenses.ServiceStatus

https://github.com/MicrosoftDocs/IntuneDocs/blob/main/intune/fundamentals/licenses-assign.md 5/5