Turn Off Self-Service Purchases in Microsoft 365

Microsoft 365 has a route for users to buy their own products rather than products purchased and licenced by the company. This blog outlines how to turn this off.

Install the MSCommerce PowerShell module with:

Install-Module MSCommerce

Only PowerShell v5 is supported. You can install it into PowerShell v7 but it will not run.

Then connect to the MSCommerce endpoint with:


Then login with the administrator account.

Version 1.x stops working from 17th April 2024, so the following is needed from an administrative PSv5 console to update the module if you have it installed already:

Update-Module MSCommerce -Force

List all the products you are able to purchase “self-service” and see the state of these products, that is Enabled or Disabled. Do this with Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase – you can see them all disabled in the below picture, but the default is they would all be enabled.

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase

The list of products as of the date of writing this blog in April 2024 totals 25 products (up from 12 as of Sept 2021). As new products are added you will need to come in here and disable them as they will be added in an enabled for self-service purchase state. There is, as of 2024, no support for automation of this and requires you to check manually for additional products that Microsoft have enabled and which you need to disable!

To turn all these products off, just run the following PowerShell:

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | ForEach {Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $_.ProductId -Enabled $False}

To disable some but not all of the products, you need to disable just those you are interested in. To do this, run the following MSCommerce PowerShell code to display all the products

Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase

Then disable selected products using the ProductID from what you see in the output above, Microsoft 365 Enterprise being shown as the example ProductID

Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId CFQ7TTC0HHS9 -Enabled $False

To remove already assigned licences on users, the user needs to do this. For instructions see https://learn.microsoft.com/en-us/microsoft-365/commerce/subscriptions/manage-self-service-purchases-users?view=o365-worldwide

Photo by Wilson Vitorino: https://www.pexels.com/photo/selective-focus-photography-of-turned-on-light-bulb-2177473/




8 responses to “Turn Off Self-Service Purchases in Microsoft 365”

  1. Michel Casanova avatar
    Michel Casanova

    thank you!!!!

  2. Eric avatar

    A bit crude but this works to disable all of them

    $policies = Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | Out-String
    $lines = $policies.Split([Environment]::NewLine)
    foreach ($row in $lines){if($row -like ‘Enabled*’){
    $id = $row.Split(” “) | where {$_ -like “CFQ*”}
    Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $id -Enabled $False

  3. Chris King avatar
    Chris King

    Not sure about it not return objects, as of today this works fine.

    Get-MSCommerceProductPolicies -PolicyId AllowSelfServicePurchase | foreach{Update-MSCommerceProductPolicy -PolicyId AllowSelfServicePurchase -ProductId $_.productid -Enabled $false}

    1. Brian Reid avatar

      Thanks. I used to have a v. similar script on the blog and it stopped working. Nice to hear its back again, but maybe it will go again in the future!

  4. Todd Nelson avatar

    Is there a way to disable this option for all future products? From the looks of it, we’ll have to periodically check and then disable manually.

    1. Brian Reid avatar

      Correct – you need to check occasionally and block new products

  5. Paul Fortner avatar

    Thank you for this. Will this also prevent non-admin users from creating trial Azure subscriptions?

    1. Brian Reid avatar

      No. This will only turn off the features listed and is all related to M365 Commerce. You can stop Azure subscriptions by blocking creation of other tenants by your users in the Entra ID Portal, but of course they could log out and then create their own subscription in a new tenant. Within your tenant, they would need the rights to create a subscription.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.