Disable Specific M365 Service Plans using PowerShell

Microsoft 365 license plan includes many services that are enabled by default. When a license is assigned to a user, they immediately get access to these services. For example, assigning a Microsoft 365 E3 or E5 license provides users access to services like Exchange Online, SharePoint Online, Microsoft Teams, Defender, and more.

However, you have the flexibility to manage which services users can access. You can easily disable certain services in the user’s license plan if they aren’t needed. For example, if your organization doesn’t use Microsoft Teams, you can disable it in the assigned license plan, ensuring users don’t have access to that service.

You can manually enable or disable the services by going to Microsoft 365 admin center > Users > Active users > Click any User > License and apps.

Disabling service plans for users via Microsoft 365 admin center is manageable when dealing with a few users. However, if you’re working with a large user base and need to make changes in bulk, using PowerShell scripts is the best approach. In the next section, we’ll focus on disabling service plans for users using PowerShell.

Disable Specific Service Plan(s) using PowerShell [For One User]

We will use Microsoft Graph to change the service plan for a given license plan. To manage licenses using graph, you will need to connect using the scope User.ReadWrite.All.

To disable the service plans for users, you will require license skuId, usersUPN and service plan Id. To get the skuId of the license plan, you can execute Get-MgSubscribedSku | Select -Property Sku* command on powershell console. For more details on how to get the skuId of a license plan, refer to this link.

Get Service plan Id

• Launch Powershell console as an administrator and execute the following commands.

# Install Microsoft Graph module if not already installed

Install-Module Microsoft.Graph -Scope CurrentUser

# Import Microsoft Graph module

Import-Module Microsoft.Graph

# Connect to Microsoft graph with required scopes

Connect-Graph -Scopes User.ReadWrite.All

# Get License plan SkuPartNumber

Get-MgSubscribedSku | Select SkuPartNumber

# Get ServicePlan ID details

Get-MgSubscribedSku -All | Where SkuPartNumber -eq 'DEVELOPERPACK_E5' |  select -ExpandProperty ServicePlans

Below PowerShell script can be used to disable a specific service plan for a given license plan for a user provided in the variable $userUPN.

• $skuId – Provide the license plan skuId.
• $userUPN – Provide users UPN.
• $disabledPlans = Provide service plan Id.

Disable_M365_Service_Plan_v1.ps1

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "User.ReadWrite.All"

# Define the SKU ID, User UPN, and Service Plan IDs to disable
$skuId = "c42b9cae-ea4f-4ab7-9717-81576235ccac"
$userUPN = "[email protected]"
$disabledPlans = @("199a5c09-e0ca-4e37-8f7c-b05d533e1ea2")

# Get the user and assign the license with disabled services
$user = Get-MgUser -Filter "userPrincipalName eq '$userUPN'"
if ($user) {
    Set-MgUserLicense -UserId $user.Id -AddLicenses @(@{SkuId = $skuId; DisabledPlans = $disabledPlans}) -RemoveLicenses @()
    Write-Host "License assigned with disabled services to $userUPN"
} else {
    Write-Host "User $userUPN not found"
}

# Disconnect from Microsoft Graph
Disconnect-MgGraph | out-null

The script works well for disabling a service plans for a user. However, one drawback is that it doesn’t retain information about previously disabled service plans. This means that if you run the script to disable a different service plan for the same user, it will re-enable the previously disabled service plans. To address this issue, we can use below PowerShell script, which stores the currently disabled service plans information in a variable. That way, the old service plans which were disabled will remain disabled.

Below PowerShell script will disable specified service plans SWAY and YAMMER_ENTERPRISE in a given license plan for a given user account.

• Script will first make a connection with Microsoft graph using below command. Please ensure that Microsoft Graph PowerShell module is installed on your device before running this command.

Connect-MgGraph -Scopes User.ReadWrite.All

• $userUPN = Provide users UPN value.
• $license = Provide license plan SkuPartNumber Information (To get this info, run Get-MgSubscribedSku | Select SkuPartNumber command).
• Update $newDisabledPlans variable and provide Service plans names to disable. (In previous section of this post, we discussed on how to get service plan name and Id information).
• Execute the PowerShell script.

Disable_M365_Service_Plan_v2.ps1

<#
.DESCRIPTION
    This script will disable give licenses for a M365 Users while
    still keeping the existing licenses disabled
    Author: Jatin Makhija
    Website: Copyright - techpress.net
    Version: 1.0.0
#>

# Connect to Microsoft Graph
Connect-MgGraph -Scopes User.ReadWrite.All

#Provide user's UPN
$userUPN = "[email protected]"
$license = "DeveloperPack_E5"

# Get user's license details
$userLicense = Get-MgUserLicenseDetail -UserId $userUPN
$disabledPlans = $userLicense.ServicePlans | Where-Object { $_.ProvisioningStatus -eq "Disabled" } | Select-Object -ExpandProperty ServicePlanId

# Get the SKU for the specified license
$sku = Get-MgSubscribedSku -All | Where-Object { $_.SkuPartNumber -eq $license }
$newDisabledPlans = $sku.ServicePlans | Where-Object { $_.ServicePlanName -in ("SWAY", "YAMMER_ENTERPRISE") } | Select-Object -ExpandProperty ServicePlanId

$allDisabledPlans = @()
$allDisabledPlans += $disabledPlans
$allDisabledPlans += $newDisabledPlans

# Create the addLicenses array
$addLicenses = @(@{
    SkuId         = $sku.SkuId
    DisabledPlans = $allDisabledPlans # This will be an array of IDs
})

# Update user's license
Set-MgUserLicense -UserId $userUPN -AddLicenses $addLicenses -RemoveLicenses @()

Disable Specific Service Plan(s) using PowerShell [For Multiple Users]

In the previous section of this post, we have seen how to disable a specific service plans for a given Microsoft 365 user for a give license plan. You can also perform this change for multiple users at once. We will use a text file (e.g., users.txt) to get the user UPNs and use it to disable the service plans for all users provided in the text file.

Below PowerShell script disables a given service plan for a given license plan for all users provided in the text file. You can also download the script from my GitHub repo.

• Update $usersFile variable: Path to the text file containing users UPNs.
• Update $license variable: Provide License plan SkuPartNumber.
• Update $servicePlansToDisable variable: Provide service plan names to disable.

Disable_M365_Service_Plan_TXT.ps1

<#
.DESCRIPTION
    This script will disable specified service plans for multiple M365 Users
    while keeping the existing licenses disabled.
    Author: Jatin Makhija
    Website: Copyright - techpress.net
    Version: 1.1.0
#>

# Connect to Microsoft Graph
Connect-MgGraph -Scopes User.ReadWrite.All -NoWelcome

# Path to the text file containing user UPNs (one per line)
$usersFile = "C:\temp\users.txt"

# Specify the license SKU part number (e.g., "DeveloperPack_E5")
$license = "DeveloperPack_E5"

# Specify the service plans to disable (e.g., "SWAY", "YAMMER_ENTERPRISE")
$servicePlansToDisable = @("SWAY", "YAMMER_ENTERPRISE")

$sku = Get-MgSubscribedSku -All | Where-Object { $_.SkuPartNumber -eq $license }

# Get service plan IDs for the plans to disable
$newDisabledPlans = $sku.ServicePlans | Where-Object { $_.ServicePlanName -in $servicePlansToDisable } | Select-Object -ExpandProperty ServicePlanId

# Read users from the text file and process each one
Get-Content -Path $usersFile | ForEach-Object {
    $userUPN = $_.Trim()

    if ($userUPN -ne "") {
        $userLicense = Get-MgUserLicenseDetail -UserId $userUPN

        # Get currently disabled service plans for the user
        $disabledPlans = $userLicense.ServicePlans | Where-Object { $_.ProvisioningStatus -eq "Disabled" } | Select-Object -ExpandProperty ServicePlanId

        $allDisabledPlans = @()
        $allDisabledPlans += $disabledPlans
        $allDisabledPlans += $newDisabledPlans

        $allDisabledPlans = $allDisabledPlans | Sort-Object -Unique

        $addLicenses = @(@{
            SkuId         = $sku.SkuId
            DisabledPlans = $allDisabledPlans # This will be an array of IDs
        })

        Set-MgUserLicense -UserId $userUPN -AddLicenses $addLicenses -RemoveLicenses @()

        Write-Host "Updated licenses for $userUPN"
    } else {
        Write-Host "Skipping empty line in the file."
    }
}

Write-Host "License update process completed."

Disable Specific Service Plan(s) using PowerShell [For All Users]

Instead of disabling the service plans for specified users in the text file, you can also disable given service plans for all Microsoft 365 users at once. Below is the PowerShell script contents, you can download the script from my GitHub repo as well.

Disable_M365_Service_Plan_All.ps1

<#
.DESCRIPTION
    This script will disable specified service plans for all M365 Users
    while keeping the existing licenses disabled.
    Author: Jatin Makhija
    Website: Copyright - techpress.net
    Version: 1.2.0
#>

# Connect to Microsoft Graph
Connect-MgGraph -Scopes User.ReadWrite.All

# Specify the license SKU part number (e.g., "DeveloperPack_E5")
$license = "DeveloperPack_E5"

# Specify the service plans to disable (e.g., "SWAY", "YAMMER_ENTERPRISE")
$servicePlansToDisable = @("SWAY", "YAMMER_ENTERPRISE")

# Get the SKU for the specified license
$sku = Get-MgSubscribedSku -All | Where-Object { $_.SkuPartNumber -eq $license }

# Get service plan IDs for the plans to disable
$newDisabledPlans = $sku.ServicePlans | Where-Object { $_.ServicePlanName -in $servicePlansToDisable } | Select-Object -ExpandProperty ServicePlanId

# Get all users in the tenant
$users = Get-MgUser -All

foreach ($user in $users) {
    $userUPN = $user.UserPrincipalName

    if ($userUPN -ne "") {
        $userLicense = Get-MgUserLicenseDetail -UserId $userUPN

        # Get currently disabled service plans for the user
        $disabledPlans = $userLicense.ServicePlans | Where-Object { $_.ProvisioningStatus -eq "Disabled" } | Select-Object -ExpandProperty ServicePlanId

        $allDisabledPlans = @()
        $allDisabledPlans += $disabledPlans
        $allDisabledPlans += $newDisabledPlans

        $allDisabledPlans = $allDisabledPlans | Sort-Object -Unique

        $addLicenses = @(@{
            SkuId         = $sku.SkuId
            DisabledPlans = $allDisabledPlans # This will be an array of IDs
        })

        # Update user's license
        Set-MgUserLicense -UserId $userUPN -AddLicenses $addLicenses -RemoveLicenses @()

        Write-Host "Updated licenses for $userUPN"
    } else {
        Write-Host "Skipping user with no UPN."
    }
}

Write-Host "License update process completed."