Google licenses

[dhalvorsen]

I took on a new role a few months ago and have had a lot of new things to learn.  I am looking to clean up my licenses (because I have to within the next few days before our renewal).  This has never been cleaned up and I have lots of users that have licenses that shouldn't and lots of users that need licenses.  Regardless, I'm looking for options where I could do it in mass.  I got my list of users and licenses and I've sorted it out, but now I need to remove licenses from those users.  There is no way I'm doing it one at a time from the user directory and it's been a long time since I used GAM (only ever used it one time).  Yes, I know I need to get familiar with GAM, but in the short term, I need to do this now.  Amplified IT apparently has a license tool?  How does everyone else remove their licenses for users?

[icrew]

I know it's not exactly the answer you wanted, but in my opinion GAM honestly is the easiest way. In particular, GAM Advanced (GAMADV) has nice tools to manage licenses based on membership in Groups, for example.

Check out https://github.com/taers232c/GAMADV-XTD3/wiki/Licenses for the details. The GAM mailing list at http://groups.google.com/g/google-apps-manager/ is also a wonderful resource. 

It's just my 2 cents, but it seems likely to me that even if you include taking the time to get GAMADV set up, using it to update the licenses is still likely to be faster than other methods.

Hope that helps, at least a little.

Ian

[dhalvorsen]

So it turns out that I need to reinstall mine with how long it's been since I've used it (shocker).  Anyway, after I get mine updated, is there anything I need to modify in this command for it to work, or is it universal as it is? (this was from Amplified IT's website - https://www.amplifiedit.com/everything-to-know-about-education-plus-licenses/)

gam print users query “isSuspended=true” | gam csv – gam user ~primaryEmail delete license 1010310003

If I wanted to take a custom csv that I've created, how could I do that?  Would the csv have to have anything in it other than a column of the email addresses?  When I talk about being new to GAM and having a lot to learn, that is no understatement and I just do not have the time to invest in it right now.  My organization is really messy with licenses (how I inherited it recently).  If I could figure out the GAM side, I would be tempted to remove all licenses and then let the auto assignments do the work in Google.  There are years worth of students that are gone with licenses and no newer students have been assigned licenses for years.

Thank you

[Kim_Nilsson]

Hiya,

It seems you missed my post further down on this page, where I posted a gam script that will do exactly that, remove all licences.

[dhalvorsen]

Sorry, I meant to reply to you as well.  I didn't miss it, but in all honesty, I'm quite confused looking at it.  I would like to get to the point where I can understand that, but as of now, I do not follow.  I think I've only ever done 1 command in GAM, which was years ago.  With how powerful GAM is, I also want to be able to understand the command and how it works before I blindly enter things into GAM.

Also, if you were to unassign all licenses, how quickly does the auto assign in Google add them back?  Would I then want to go into Google and turn off the auto assign and turn it back on?

[Kim_Nilsson]

Aha, then I'll give you another command, that'll do exactly what you want, but...

That requires you to actually spell out exactly what you want.

Do you want to remove the licence from all users?
Or do you want to remove the licence from all suspended users regardless of where they are?Or do you want to remove the licence from all suspended users in this one particular OU where nobody should have a licence? (That's what my script does, and what I also describe in my post.)
Or do you already have a CSV with all users you wish to remove the licences from, with the email and the correct current licence on each row?

Rule #1: You can't remove a licence from a user inside an OU where licences are auto-assigned. The user has to be moved elsewhere first.

Rule #2: You can't remove a licence from a user unless you specify the correct licence. So you have to print the user with the current licence first.

[Kim_Nilsson]

The licences will be auto-assigned fairly quickly.

But you should still do it during non-working hours/days.

[sujka]

We use Amplified IT (now owned by CDWG) to provision licensing like literally yesterday. They are also our reseller so I am not sure if that is a requirement or not. The caveat I see if if you are not already following OU best practice or start to creep into different directions you can only recursively go 10 OUs down (not that you should really ever have that many) AND/OR you need to tell them to update your include/exclude every time you change the OUs.

I know in the long run Google is working on something easier as well to mass remove them. For auto assigning Google has the ability to turn it off and on for OU(s).

Mike

[Kim_Nilsson]

Using auto-assign for adding licences is definitely a recommendation.

Meaning you make sure that you put people in OUs and then they get licences automatically.

When you don't want people to have licences anymore, you move them to OUs without auto-assign, and remove the licences, either manually (when you move them), or with gam (since pointing gam at an entire OU is super easy).

Usually, such users should also be suspended, because accounts without licences shouldn't be actively used.

Here is my script which will remove licences from all users in the OU /Suspended, regardless of which licence the user has (which you have to provide when you tell gam to remove a licence).

$ cat bin/delete-enterprise-licences-from-suspended-users-in-OU-Suspended-lomma

#!/bin/bash
# Delete licenses from suspended users in the OU /Suspended in Lomma school district.

# This is where my GAMADV-XTD3 is installed.
GAM=/home/kim/gamadv-xtd3/gam

# I like to log what I'm doing. Every run gets a separate logfile.
LOGFILE=/home/kim/GAM-activities/Lomma/licenses-logfile-$(date +'%Y-%m-%d_%H%M')

# Set the correct section (lomma).
SECTION=lomma

# Which OU should we work with.
OU="/Suspended"

# Select the correct section (lomma).
$GAM select $SECTION save

# This is a long one-liner command!
# Printing all licences for our chosen OU and using that as input for the delete command.
$GAM config csv_output_row_drop_filter Licenses:regex:^$ csv_output_row_filter "orgUnitPath:regex:'${OU}'" print users query "isSuspended=true" licenses fields ou | $GAM redirect csv - multiprocess redirect stdout $LOGFILE redirect stderr stdout csv - gam user ~primaryEmail del license ~Licenses

# Reset the section to the default.
$GAM select default save

[jstaime]

If you are syncing with AD - you can use GCDS to add and remove licenses automatically for you as well. You would need an AD group that contain all active users and then set GCDS to autoapply and remove licenses for you. 

This is how we have things setup for our staff - students, that's more complicated. 

Run GAM script that automatically move the user to a temp OU that's not autoassigned and then remove the licenses to everyone in that OU before migrating that batch of users into the permanent location for Suspended accounts. 

You're in the right hand with @Kim_Nilsson though - he will guide you through GAM and am thankful he was around when I was learning GAM myself. Once you know GAM though, you don't go back!!!

[Kim_Nilsson]

Yes, other systems for syncing users may also be able to manage licences.

I know Microsoft's MIM can do it (and pretty much any other API calls).