One of the biggest gripes with the Microsoft 365 suite remains the persistent attempts to shove advertisements, self-service purchases, trials and generic end user communication, down our throats. While there is definitely some benefit to doing this for Microsoft, and arguably for some smaller tenants, the majority of enterprises don’t want anything to do with any of the above. Yet, it doesn’t look like things are going to change anytime soon on that front.
Still, there is some good news. While Microsoft is reluctant to stop these practices, they are making it a bit easier for tenants to control the self-service purchase and trial settings, by introducing the corresponding set of controls within the Microsoft 365 admin center. Previously, one had to use the obscure MSCommerce PowerShell module for this. While I wouldn’t expect much to change for larger organizations that likely control these settings programmatically, the simple fact that they are now exposed within the Microsoft 365 Admin center will bring some awareness to their existence. And of course make it easier to control them for smaller organizations.
To access said settings, login to the Microsoft 365 Admin Center as a Global administrator and navigate to the Settings > Org settings page. Therein, scroll to the bottom and look for the Self-service trials and purchases link. Or you can use this direct link: https://admin.microsoft.com/#/manageselfservicepurchase
On the Self-service trials and purchases page, you will be presented with the list of products for which you can control self-service purchase and trial settings. The product list will match the one from the MSCommerce module, and you can expect to find a total of 26 entries at the time of writing:
As you can probably guess from the screenshot above, there has been no change in the default experience – all these products will continue to be enabled by default for self-service purchases and trials, where applicable. Thus, you will need to change the settings here for any product you don’t want your users to sing up for without approval.
To change the settings for any given product, double-click on its entry in the list. In the right-hand pane, select the value that makes most sense for your organization. The available values include: Allow (this is the default value as mentioned above, it gives users the ability to sign-up for trials or purchase the product on their own), Allow trials only (do not allow any self-service purchases, but users can still sign up for free trials, where available), and Do not allow (disable both the self-service purchase and trials). In the example below we are disabling self-service purchase and trials for the Microsoft 365 F3 product:
Apart from Global administrators, users holding the Billing administrator role should be able to make changes to settings on this page. Roles such as Global reader will have read-only access. The behavior again matches the MSCommerce module.
One thing that the UI settings do not cover is the so-called third-party offer types, as detailed for example in this article. To view the settings on these and make changes as necessary, you still need to use the MSCommerce module. For example:
#View settings for third-party offer types Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase -Scope OfferType #Disable self-service purchase for any product of "Power BI Visuals" offer type Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -OfferType POWERBIVISUALS -Value Disabled
And that in a nutshell is what the newly introduced self-service purchase and trial settings are all about. Governance-wise, there is nothing new here, Microsoft is just providing us with a UI to manage the already existing controls. Said controls are still enabled by default, allowing every user in the tenant to do with the supported products as they please. Likewise, Microsoft continues to introduce new products that allow for self-service purchase and trials, so it doesn’t look like we will have a policy shift on that front anytime soon.
Even more interesting is the fact that Microsoft chose to introduce yet another “proxy” API in order to implement support for said settings via the Microsoft 365 Admin Center, instead of providing us with a set of proper Graph API endpoints. Yet we keep hearing about that Graph-first approach that supposedly drives all new developments, on paper that is. Anyway, for the time being, if you want to manage those controls programmatically, you are stuck with the MSCommerce PowerShell module or the REST endpoints that power the cmdlets within it.