Close the Revenue Leak: Block Self-Service Purchasing Across Every Tenant

For over a year, Microsoft has let end users buy their own subscriptions. From Microsoft's FAQ (opens in new tab): "Customers can make a self-service purchase online from the product websites or from in-app purchase prompts. Customers are first asked to enter an email address to ensure that they're a user in an existing Azure Active Directory (AD) tenant." The user puts their own credit card on file and owns the subscription. Until now this has been a minor concern, for two reasons:

• It is uncommon for an end user to stumble onto these purchasing sites.
• Only a limited subset of products is actually available for self-service purchase.

Run a few cmdlets and you can see everything available today:

Why this is becoming a margin problem#

Microsoft recently announced in the message center that two more offerings join self-service purchasing on April 19, 2021. How many products they intend to add long-term is unclear, and that uncertainty is the issue. For MSPs, the concerns are concrete:

• License sprawl outside the CSP model and your main margin stream.
• Products supported directly by Microsoft instead of through the CSP provider.

Because Microsoft's long-term intentions are uncertain, the safe move is to disable this purchasing path across all the tenants you manage in Partner Center.

The script that disables it everywhere#

This script checks for the MSOnline module, installs it if missing, connects to Partner Center, and disables self-service purchasing in every tenant:

Write-Host "Checking for MSOnline module..."

$Module = Get-Module -Name "MSOnline" -ListAvailable

if ($Module -eq $null) {

        Write-Host "MSOnline module not found, installing MSOnline"
        Install-Module -name MSOnline

    }

Write-Host "Please Enter your Partner Center Global Admin Credentials"

Connect-MSolservice -Credential $credential
$tenants = Get-MsolPartnerContract -All

ForEach($tenant in $tenants){

Write-Host "Disabling Self-Service for $($tenant.Name)" -ForegroundColor Green

Set-MsolCompanySettings -Tenant $tenant.tenantID -AllowAdHocSubscriptions $false

}

The script is on GitHub (opens in new tab).

Credentials: You need to be a Global Admin in Partner Center to run this script.

Once it runs, you see the setting being disabled across your customer tenants:

What the cmdlet actually does, and covering future customers#

Microsoft's PowerShell documentation (opens in new tab) defines the Set-MsolCompanySettings -AllowAdHocSubscriptions cmdlet this way: "Indicates whether to allow users to sign up for email based subscriptions. This setting is applied company-wide."

For net-new customers you onboard later, add the Set-MsolCompanySettings cmdlet to your onboarding checklist, or rerun this script after you have added yourself as partner of record in their account. For more background, see Microsoft's self-service sign-up support article (opens in new tab).