Managing Self-Service Licenses in Entra ID

Microsoft Entra ID includes a Self-Service Purchase and Subscription feature that allows users to acquire Microsoft 365 and Power Platform licenses without IT intervention. While this can empower teams to move quickly, it can also lead to unmanaged costs and compliance issues if left unchecked.

In this post, we’ll cover how to view and manage self-service license settings in Entra ID, using both the Microsoft Entra admin center and PowerShell.

What are self-service licenses?

Self-service licenses allow end users to:

• Sign up for certain Microsoft services (e.g., Power BI Pro, Project Plan 1) without an existing subscription.

• Add payment details themselves or charge to a corporate subscription if enabled.

• Manage their own subscriptions via the Microsoft 365 portal.

Microsoft maintains a list of products eligible for self-service purchase, which you can review here:
https://learn.microsoft.com/microsoft-365/commerce/subscriptions/self-service-purchase

For many organizations, the goal is to control or block self-service to avoid uncontrolled license proliferation.

Managing self-service licenses in the Entra Admin Portal

1. Sign in to the Microsoft Entra admin center
   https://entra.microsoft.com/

2. Navigate to the Self-service purchase settings:

• Go to Billing → Self-service purchase
  (If you don’t see it, make sure you have the appropriate admin role — Global Administrator or Billing Administrator.)

3. View the current configuration:
   You’ll see a list of eligible products. For each product, you can control:

• Allow self-service purchase: On / Off

• Allow self-service sign-up: On / Off

• Allow self-service trial: On / Off

4. Make changes:

• Select a product (e.g., Power BI Pro)

• Click Edit

• Toggle the options as needed

• Save your changes

5. Verify settings:
   Changes are applied immediately across your tenant.

Managing self-service licenses using PowerShell

For bulk operations or automation, PowerShell is faster and more repeatable. You’ll use the MSCommerce PowerShell module, which allows you to manage self-service purchase capabilities.

Step 1: Install and connect

# Install the module (run as admin if first time)
Install-Module -Name MSCommerce

# Import the module
Import-Module MSCommerce

# Connect to your tenant
Connect-MSCommerce

Step 2: View current settings

# Get all self-service products and their settings
Get-MSCommerceProductPolicies

Example output:

ProductId              ProductName           PolicyId                   Enabled
---------              -----------           --------                   -------
CFQ7TTC0KXMN           Power BI Pro          AllowSelfServicePurchase   True
CFQ7TTC0KXMP           Project Plan 1        AllowSelfServicePurchase   True

Step 3: Disable self-service purchase for a product

# Example: Disable for Power BI Pro
Set-MSCommerceProductPolicy -ProductId "CFQ7TTC0KXMN" `
    -PolicyId "AllowSelfServicePurchase" -Enabled $false

Step 4: Bulk disable for all products

Get-MSCommerceProductPolicies | ForEach-Object {
    Set-MSCommerceProductPolicy -ProductId $_.ProductId `
        -PolicyId $_.PolicyId -Enabled $false
}

Step 5: Verify changes

Get-MSCommerceProductPolicies

PowerShell script — disable all self-service purchases in Entra ID

<#
.SYNOPSIS
    Disables all Microsoft self-service purchases and trials in the tenant.

.DESCRIPTION
    Uses the MSCommerce PowerShell module to:
    - Connect to the tenant
    - Retrieve all products with self-service policies
    - Disable all "AllowSelfServicePurchase" and "AllowSelfServiceTrial" policies

.NOTES
    Author: patrik@idguy.tech
    Requires: PowerShell 5.1+ or PowerShell 7+, MSCommerce module
#>

# Install the MSCommerce module if not already installed
if (-not (Get-Module -ListAvailable -Name MSCommerce)) {
    Write-Host "Installing MSCommerce module..." -ForegroundColor Yellow
    Install-Module -Name MSCommerce -Force
}

# Import the module
Import-Module MSCommerce

# Connect to Microsoft Commerce API
Write-Host "Connecting to Microsoft 365..." -ForegroundColor Yellow
Connect-MSCommerce

# Retrieve all products with their self-service policies
Write-Host "Retrieving current self-service product policies..." -ForegroundColor Yellow
$policies = Get-MSCommerceProductPolicies

if (-not $policies) {
    Write-Host "No self-service products found or insufficient permissions." -ForegroundColor Red
    return
}

# Display current settings before change
Write-Host "`nCurrent policies:" -ForegroundColor Cyan
$policies | Format-Table ProductName, PolicyId, Enabled

# Disable all policies for all products
foreach ($policy in $policies) {
    if ($policy.Enabled -eq $true) {
        Write-Host "Disabling $($policy.PolicyId) for $($policy.ProductName)..." -ForegroundColor Yellow
        Set-MSCommerceProductPolicy -ProductId $policy.ProductId -PolicyId $policy.PolicyId -Enabled $false
    }
}

# Confirm changes
Write-Host "`nUpdated policies:" -ForegroundColor Green
Get-MSCommerceProductPolicies | Format-Table ProductName, PolicyId, Enabled

How to use

1. Save the script as Disable-SelfServiceLicenses.ps1.

2. Open PowerShell as Administrator.

3. Run:

Set-ExecutionPolicy RemoteSigned -Scope Process
.\Disable-SelfServiceLicenses.ps1

4. Sign in with an account that has Billing Administrator or Global Administrator rights.

What the script does

• Checks if MSCommerce PowerShell module is installed; installs it if missing.

• Connects to Microsoft 365 Commerce.

• Retrieves all products eligible for self-service purchase/trial.

• Disables both AllowSelfServicePurchase and AllowSelfServiceTrial policies.

Outputs before-and-after status so you can verify changes.

Best practices

• Review regularly: Microsoft adds new products to self-service over time.

• Communicate with users: If you disable self-service, provide guidance on how to request licenses.

• Document changes: Keep a record of when and why changes were made for audit purposes.

• Use PowerShell for scale: Particularly if you manage multiple tenants.

Summary

Self-service licenses can be useful for quick adoption of Microsoft services, but they can also create licensing and cost challenges. With the Microsoft Entra portal and PowerShell’s MSCommerce module, you have the tools to control this feature centrally.