Assign EMS licenses to all licensed users
Azure conditional access provides amazingly flexible control over access to Office 365 resources and services based on location/user group membership/device etc. Leveraging it to block access generally requires EMS (Enterprise Mobility + Security) licenses for all users. This short script will assign EMS licenses to all users in your tenant who are licensed but do not have EMS yet.
$VerbosePreference = "Continue"
$SKU = get-msolaccountSKU | ?{$_.accountskuid -match ':EMS$'} | select -expand AccountSKUID
if ($SKU) {
$LicensingFailures = @{}
$allUsersThatNeedEMS = get-msoluser -all | ?{$_.islicensed -and !($_.licenses | ?{$_.accountskuid -eq $SKU})}
$allusersThatNeedEMS | %{
$u = $_;
try{
Set-MsolUserLicense -UserPrincipalName $u.userprincipalname -AddLicenses $SKU -ErrorAction Stop
Write-verbose "Successfully added $SKU to $($u.userprincipalname)"
} catch {
Write-Error "Failed to add $SKU to $($u.userprincipalname) because: $_"
$LicensingFailures."$($u.userprincipalname)" = $_
}
}
Write-host "The following failures occurred"
$LicensingFailures
} else {
Write-host "No EMS license SKU found"
}