Automating removal of user licenses.


In my opinion, this is a must. The logic is simple, you identify inactive users and either remove them or assign them a free Stakeholder license, and save money.

Tip 1 : There are several options from which you can choose to run the automation, below are some of them:


  1. As a script that you run manually.
  2. Automate using Azure Pipelines
  3. Automate using Azure Functions

Here is one of the approaches we are following, which makes use of Rest APIs for Azure DevOps and Azure Functions.
This is a graceful approach where the users will be notified about their license getting downgraded. They will also have the choice to login to ADO within a specified time to retain their license. The Axure Function is timer triggered - you can choose to keep the "notifying the users" logic and "removal" logic in the same function or separate functions.

During the notification flow:

  1. Get the list of users using ADO Rest API, and find the list of users who:
    • have not accesses in the last x days and
    • holds a Basic or Basic + Test Plans license type.
You can decide on the value of x, probably keep it somewhere around 30-45 days.

  1. Send an email out to these users saying that since they have not access ADO for x days, their license will be downgraded to Stakeholder. Also provide them an option to avoid the downgrade by giving them a buffer of a few days, within which they should login to ADO so that the last accessed date gets updated.

  1. Store the user list.

For the removal flow, :

  1. Check if the user list stored from step 3 in the first execution has users. If yes, then clean the list up, by either retaining their licenses if they had logged in during the buffer period or downgrading them to Stakeholder if they had not. The list will be empty by the end of this step.

  1. Get the next list of inactive users.

  1. Load the next set of inactive users to the list after sending them the warning emails.

This process continues.

Tip 2: Dealing Basic + Test Plan licenses separately.

Since the Basic + Test Plans license is way costlier compared to Basic, you can even think of downgrading them to Basic sooner.

There are some blog posts out there explaining how to do this. One of my colleagues is also working on putting a post together with the details, I'll add it here as soon as it goes live.

Cheers!

Comments

Post a Comment

Popular posts from this blog

Azure DevOps - getting project stats for all projects

Image
If you have quite a lot of projects in your Azure DevOps organization and is looking for a way to filter the inactive projects out, that’s what   we will discuss today.   This is going to be based on the data the we see in the "Project stats" section on the landing page of an ADO project. This data gets fetched using the   "Contribution/HierarchyQuery/project" REST Api, which for some reason doesn't seem to be documented. So we may have to keep an eye out for any changes.   The apis lets you get project stats like: Work Items : created and updated Repos : Commits pushed with the number of authors, PRs created and completed the range can be specified, and accepts a maximum value of 30 days. If you use TFVC, that data is also returned - like the number of changesets and authors. I am not using it for the calculation here as we don't use TFVC.  You can also get the metrics for builds and releases - j ust in case you are interested, the
Read more

Export the members of a project level group from all the projects in an Azure DevOps

Image
How many project administrators do you have on an average per project? Though there is no real mandate or best practice on the number, I think you don’t want too many people with project admin privileges. This could also be an auditing question to figure out who can do what. Same can be the case with Build and Release admin group, other default groups or any of the custom security groups that you may have created at the project level. If you are trying to export such a list, here is a script that can help you. You can provide any project level group as the input to the script, and it will export a list containing the members of the group, across all the projects in your organization to a csv file.  The script lists both users and groups that are members of the group given as input, but do not expand groups further. You can then filter by project to look at the details of individual projects. How to run the script: The script takes three parameters: Name of th
Read more

Managing user licenses and cost for Azure DevOps.

Image
User licenses contribute to a major share of the cost for Azure DevOps services. In this post we will focus mainly on user licenses and some tips for managing them efficiently. Managing the cost associated with other paid services for Azure DevOps will be covered in a separate post. If you are part of the Azure DevOps admin team of your organization, you should be having an idea about the monthly / annual spend for Azure DevOps. The user who sets up billing for Azure DevOps services needs to have permissions at the subscription level, as explained in this article -  Add a user who can set up billing for Azure DevOps . Often what happens is, setting up billing for Azure DevOps is done by someone who has more privileges in Azure - like a subscription admin. However once the subscription is linked, an ADO collection admin can then add people and assign them licenses.  It is also possible that the ADO admin doesn't get a copy of the bill, thereby blocking the visibility to the
Read more