1. Automated Azure Licencing
Joshua Rack
Principal Consultant – Kloud Solutions
@jrack

2. Agenda Azure Licencing – who cares? What do you need?
What are my options?
Demo – Azure AD Dynamic Groups
How extensible is this?
What should I know!
Question?

3. About me
Joshua Rack
I’m a Kloudie – Principle Consultant with Kloud Solutions
Speciality in Identity and Access Management, Azure AD Services and Federated Services
16+ years industry experience
10+ years in security around Identity and Access Management
5+ years in cloud adoption through IAM

4. Azure Licencing – Who cares?
What are Azure Licences
Office 365
Enterprise Security & Mobility
Dynamics CRM
Azure AD Premium etc.
Historically only able to licence per user
Scripted solutions have been used for larger organisations
Management difficult and often unreliable

5. What are my options? Introducing Azure AD Group Licencing
Allows licences to be assigned to groups within Azure AD
This can be Azure Security AD Groups or Security Groups sync’d from your on-premise AD
Users can be members of multiple groups with licencing policies.
Users can still be manually assigned licences without affecting group based licences
Create dynamic groups in Azure AD to automate membership
Select licence SKUs (can have more then 1)
Select assignment options (disable certain plans within licence e.g. Exchange Online)

6. What do you need? Azure Licence Subscriptions (Obviously ) Azure AD
Users populated in Azure AD (Sync’d or manually)
And…… Nothing that’s it!

7. demonstration
How to set it up!

8. Content highlight
Ensure Azure AD is populated (Azure AD Connect) Create dynamic groups Assign licences and options to group Groups have audit logs

9. How extensible is it? Simple Rule configuration
Advanced Rule Configuration

10. What should I know? What’s the catch?
Service is in public preview (so it’s not perfect)
In preview you need Azure AD Premium to use this feature
Currently does not support nested groups
Only supported with security groups (Office Groups not supported)
Large group assignment can affect performance
Licence Management is not “reactive” to all changes
Biggest thing! This is in preview! So what we have demonstrated today could change!
(e.g. 100,000 users) on directory synchronisation with large number of changes generated from assignment
License management automation does not automatically react to all types of changes in the environment. For example, you might have run out of licenses, causing some users to be in an error state. To free up the available seat count, you can remove some directly assigned licenses from other users. However, the system does not automatically react to this change and fix users in that error state.
Work around is to “reprocess”

11. Question and Answer

12. Questions? Comments? More info
Contact Related links:

13. Thanks for listening
Remember to submit your feedback so you go in the draw to win prizes at the end of the day