Configuration guide: Microsoft 365 E5 license optimization

Introduction

Managing Microsoft 365 licenses efficiently is crucial for cost control. Organizations often struggle with assigning the right licenses to the right users, leading to unnecessary expenses. To address this, an automated workflow within Entra ID streamlines the process. By detecting E5 license holders, seeking reclamation consent, and transitioning to E3 licenses, organizations can save time and reduce costs. Leveraging Power BI Pro consumption data enhances accuracy in targeting users for license adjustments.

This page will guide you through the structure of the content.

Content list and dependency

Name	Description	Dependencies
Microsoft 365 E5 license optimization	Workflow orchestrates E5 to E3 licensing optimization process to save time from the manual license reclaim process and reduce costs from unnecessarily assigned licenses.
Microsoft 365 E5 license optimization	Dashboard presents the results of Microsoft 365 licensing cost optimization workflow.
Microsoft 365: Power BI	Application monitors the Power BI Microsoft 365 application.	Workflow schedule query can use this application data to select the right scope of devices.
M365 E5 to E3 license - workflow invoke	Campaign asks users if they are using an application.	Workflow parameter activates this campaign.

Type

Name

Description

Dependencies

Microsoft 365 E5 license optimization

Workflow orchestrates E5 to E3 licensing optimization process to save time from the manual license reclaim process and reduce costs from unnecessarily assigned licenses.

Microsoft 365 E5 license optimization

Dashboard presents the results of Microsoft 365 licensing cost optimization workflow.

Microsoft 365: Power BI

Application monitors the Power BI Microsoft 365 application.

Workflow schedule query can use this application data to select the right scope of devices.

M365 E5 to E3 license - workflow invoke

Campaign asks users if they are using an application.

Workflow parameter activates this campaign.

Configuration guide

To effectively use this library pack, the content must be installed and configured appropriately. Below are some suggested steps to install and configure the content properly before use.

Step 1) Install library pack content

Go to the Nexthink Library and install all required content.

Step 2) Edit campaigns

Navigate to the manage campaigns administration page to review and edit your campaigns.

For each installed campaign, please ensure to:

Customize the sender name and image.
Review and adjust questions.
Publish the campaign when you are ready to use it.

We recommend the following configurations for these campaigns:

Name	Trigger	Priority
M365 E5 to E3 license - workflow invoke	API	Urgent

Name

Trigger

Priority

M365 E5 to E3 license - workflow invoke

API

Urgent

Step 3) Configure Entra ID integration

If Entra ID hasn’t been configured yet, here are the guidelines. It’s recommended to seek help from an Azure administrator.

To connect Microsoft’s Graph API with the Nexthink platform, two integration points are necessary. One integration point is needed to import the UPN into the user table of the data model. Another integration point is needed to manage the API credentials. For comprehensive details, please refer to the Entra ID integration for workflows.

Edit workflow parameters

Step 4.1) Edit workflow parameters

Here are the parameters for the Microsoft 365 E5 license optimization workflow:

Ask for permission?: This parameter controls the option of optimizing the license with or without user consent. It has two possible values: "Yes", which means that a campaign should be triggered to obtain user consent, or "No", which means that the changes of licensed group assignment will be done without user consent.
MS365 E5 authorization group: This parameter contains the ID of the Entra ID licensed group, which controls Microsoft 365 E5 license assignments. The parameter needs to be maintained with a locally assigned ID.
MS365 E3 authorization group: Similar to the MS365 E5 parameter, this parameter contains the E3 licensed group.

Step 4.2) Maintain API thinklets locally defined credentials

Each Service/API thinklet requires locally maintained credentials. In this step review all relevant thinklets and maintain credentials.

Step 5) Define scheduled trigger

This workflow is primarily designed to run automatically using a scheduled trigger. However, it can also be manually triggered for ad hoc usage.

The following query can be used as a workflow schedule or investigation. This query selects all devices where no Power BI usage was detected. The workflow then checks each user using those devices for group membership. If any of these users belong to the group, which implies they have the license, they will be asked if the license can be reclaimed.

NQL using Application Experience data:

Code

1 devices during past 30d
2 | where login.last_login_user_name != null
3 | include web.events during past 30d
4 | where application.name == "Microsoft 365: Power BI"
5 | compute app_usage_ = event.duration.sum()
6 | include execution.events during past 30d
7 | where application.name == "Microsoft 365: Power BI"
8 | compute desktop_app_usage_ = execution_duration.sum()
9 | where app_usage_ == null and desktop_app_usage_ == null

An alternative way to select devices for the workflow is to use Software Metering. In this case, 90 days of data is available. For more information on how to configure application in Software Metering visit Managing Software Metering page.

NQL using Software Metering data:

Code

1 devices
2 | include software_metering.events during past 90d
3 | where meter_configuration.nql_id == "microsoft_365_power_bi"
4 | compute desktop_app_usage = desktop_execution_duration.sum(),
5          web_app_usage = web_focus_time.sum()
6 | where desktop_app_usage == null and web_app_usage == null

Usage guide

Your content is now configured and ready to be used. For usage overview and recommendations, you can visit the usage guide:

Usage guide: Microsoft 365 E5 license optimization