Who consumed or applied a M365 license today?

Quick one today.

Recently a customer (Simon, thanks!) had a sudden disappearance of a number of vacant licenses which they were about to consume for other objects.

They wanted to investigate on which objects this occurred and who did it.

All of this can be found in the audit logs.

For example here is a date filter with the activity “Change user license”, you can drill into the targets (object which was changed) and actor (who performed the change).

However, if you have group licensing it might have a wider reach. You can obviously drill into what names were added into groups through the audit logs as well.

But, if you wanted to know via powershell what objects actually ended up changing, this would also help….

Get-AzureADUser -All $true |select UserPrincipalName -ExpandProperty AssignedPlans | Where-Object {$_.AssignedTimestamp -gt (get-date('2020-07-07 00:00:01'))} | select UserPrincipalName,AssignedTimestamp -Unique

Then you’d get a nice output of what has been updated

I did have some fun with the dates having to reverse how the search worked (dd/mm/yyyy with yyyy/mm/dd), sometimes you can’t see the wood through the trees, so Twan helped me out.