Auto-Assign Licenses with Group-based Licensing in Microsoft 365

Dealing with the nuances of license management within Microsoft 365 has long been a challenge for administrators. The complex task of assigning and transferring licenses to each user individually can lead to inefficiencies and errors that hamper overall productivity. However, the solution lies in a game-changing approach called group-based licensing. By creating groups based on users’ roles, departments, or teams, this innovative feature provides a streamlined way to manage licenses. This task can be accomplished with the Azure portal (Entra admin center) or PowerShell.

Let’s dive into the nitty-gritty of improved license management and 🔎 explore the possibilities of group-based licensing.

What is Group-based Licensing in Microsoft 365?

Group-based licensing allows you to assign one or more license subscriptions to a Microsoft 365 group. Licenses assigned to the group are added to everyone who is added to the group, and the licenses are removed when they are removed from the group.

Prerequisites For Group-based Licensing

Your organization must meet the following prerequisites to process the group-based licensing.

Azure AD Premium P1 and above (Paid or Trial) or any one of the following Microsoft 365 Licenses (Paid or Trial)
- Microsoft 365 Business Premium
- Office 365 Enterprise E3
- Office 365 A3
- Office 365 GCC G3
- Office 365 E3 for GCCH
- Office 365 E3 for DOD and above

Note: You must be a license administrator, user administrator, or global administrator to utilize group-based licensing.

Set Up Group-based Licensing in Microsoft 365

Setting up group-based licensing in your Microsoft 365 environment is a straightforward process. Microsoft 365 Admins can set it up with any of the following methods.

Create a group-based license in Azure portal
Assign group-based licensing using PowerShell

Note: Admins must specify the usage location of the user, before assigning a group-based license. If not, the usage location will inherited from the location of the directory.

Create a Group-based License in Azure Portal

To create a group-based license in the Azure portal, you need to follow the below two steps.

Create a group in the Azure Active Directory
Assign licenses to groups in Azure AD
Verify group-based license assignment
Check Microsoft 365 license assignment path

Create a Group in the Azure Active Directory

The first step for the creation of a group-based license is to create a group in the Azure Active Directory. To create a group using the Entra admin center follow the steps below.

Log in to the “Azure portal” and head to the “Azure Active Directory” (Entra ID).
Navigate to the “Groups” tab and select the “New group” option.
Select the respective “Group type” and enter the “Group name”.
Click on “No members selected” and go to the “Users” tab.
Select the required users to assign group-based licenses.
Click on the “Select” button and select the “Create” button.

Assign Licenses to Groups in Azure AD

After the creation of groups with users, you have to assign licenses. Follow the procedure below to assign licenses to Microsoft 365 groups.

Head to the “Licenses” tab in the “Azure Active Directory”.
Go to the “All products” tab and select (tick) the appropriate licenses to be assigned.
Click on the “Assign” option.

Select the “Add users and groups” option.
Choose the “Groups” tab and select the respective group and click on “Select”.

Assign License to a Group in Microsoft 365

Click the “Next : Assignment options >” button and toggle “On/Off” the services available with the selected subscription pack.

Click “Next: Assignment options >”, finally review the details and select the “Assign” option.

Now the licenses will assigned to the selected group.

Verify Group-based License Assignment

You can easily verify the group-based license assignment in the “Groups” tab of the Entra ID. To do so, follow the steps:

Navigate to the respective group in the “Groups” tab.

Select “Licenses”, there you can see a notification message displaying “License changes have been applied to all users”.

Group-based License Assignment Confirmation

This message represents the confirmation of the group-based license assignment.

Check Microsoft 365 License Assignment Path

To check whether the license is assigned directly or inherited from a group, follow the steps below.

Head to the “Licenses” tab in the “Azure Active Directory”.
Go to the “All products” tab and click on the selective licenses to be checked.

Check Microsoft 365 License Assignment Type

Group-based Licensing Using PowerShell

Though the Entra ID helps admins to manage Microsoft 365 services, many admins rely on PowerShell for its time-saving capabilities and to perform bulk operations.

You can adhere to the following steps to configure group-based licenses using PowerShell. As Microsoft has announced the deprecation of the Azure PowerShell modules, here we are using the Graph PowerShell module. Before getting started using PowerShell, make sure to connect to the Microsoft Graph PowerShell module.

Create group with Microsoft Graph PowerShell
Add users to group using Graph PowerShell
Apply license to the group using MS Graph
Check whether the license is directly assigned or inherited

Create Group with Microsoft Graph PowerShell

To create a group using graph PowerShell, execute the cmdlet below after replacing the respective values.

New-MgGroup -BodyParameter @{ 
	DisplayName = <DisplayName>
        GroupTypes = @("Unified")
	MailEnabled = <$falseOr$true>
	MailNickName = <MailNickName>
	SecurityEnabled = <$falseOr$true>
}

New-MgGroup -BodyParameter @{

DisplayName = <DisplayName>

GroupTypes = @("Unified")

MailEnabled = <$falseOr$true>

MailNickName = <MailNickName>

SecurityEnabled = <$falseOr$true>

}

Substitute ‘true’ or ‘false’ based on your group needs. The ‘GroupTypes’ parameter with the value ‘Unified’ will create a Microsoft 365 group. To create a Security group, you can simply omit the ‘GroupTypes’ parameter.

Note: Please note the “Id” after the creation of the group for future reference. This value will be needed for the addition of users in the groups and the license assignment.

Add Users to Group Using Graph PowerShell

To add users to a group using the graph PowerShell, you must know the ”Id” of each user to be added to the group. To know the “Id” of all the users run the comment below.

Get-MgUser –All

1	Get-MgUser –All

After the execution, take note of the “Id” for each respective user who will be added to the newly created group. Save these Ids in a CSV file following the format demonstrated below.

Once you create the CSV file, execute the following cmdlet with file location and group Id to add the users to the group.

Import-Csv <FileLocation> | Foreach {New-MgGroupMember -GroupId <GroupId> -DirectoryObjectId $_.Id}

1	Import-Csv <FileLocation> \| Foreach {New-MgGroupMember -GroupId <GroupId> -DirectoryObjectId $_.Id}

Here, replace the <GroupId> with the Id, which is noted during the creation of the group.

Apply License to the Group Using MS Graph

Before assigning a license to the group, it is essential to determine the “SkuId” of the specific license to be assigned. To know the “SkuId” of the particular license, execute the cmdlet below.

Get-MgSubscribedSku –All

1	Get-MgSubscribedSku –All

Once you have the “SkuId”, use the following cmdlet, replacing the <GroupId> and <SkuId> with the appropriate values, to assign the license to the group.

Set-MgGroupLicense -GroupId <GroupId> -AddLicenses @{SkuId= <SkuId>} -RemoveLicenses @()

1	Set-MgGroupLicense -GroupId <GroupId> -AddLicenses @{SkuId= <SkuId>} -RemoveLicenses @()

Note: The above method would be useful for existing users to get group-based licenses. If you want to add users to the license group in the user creation itself, create a CSV file like the below format and execute the script.

Import-CSV <FileLocation> | Foreach { 
$PasswordProfile = @{Password =$_.Password} 
$params = @{ 
    DisplayName=$_.DisplayName 
    PasswordProfile=$PasswordProfile 
    AccountEnabled=$true 
    MailNickName=$_.MailNickName 
    UserPrincipalName=$_.EmailAddress 
    } 
$NewUser = New-MgUser -BodyParameter $params 
$UserId = $NewUser.Id 
New-MgGroupMember -GroupId <GroupID> -DirectoryObjectId $UserId 
}

Import-CSV <FileLocation> | Foreach {

$PasswordProfile = @{Password =$_.Password}

$params = @{

DisplayName=$_.DisplayName

PasswordProfile=$PasswordProfile

AccountEnabled=$true

MailNickName=$_.MailNickName

UserPrincipalName=$_.EmailAddress

}

$NewUser = New-MgUser -BodyParameter $params

$UserId = $NewUser.Id

New-MgGroupMember -GroupId <GroupID> -DirectoryObjectId $UserId

}

Replace <FileLocation> with the actual CSV file location and <GroupId> with the corresponding group ID for the license group.

Check Whether the License is Directly assigned or Inherited

After the assignment of licenses through groups, admins can easily check the license assignment path whether it is assigned directly or inherited from a group. The following script can help you to get the license assignment type. Here, replace the <SkuId> with the “SkuId” of the selective subscription.

$subscription = Get-MgSubscribedSku -All | Where SkuId -eq <SkuId>
$users = Get-MgUser -Filter "assignedLicenses/any(x:x/skuId eq $($subscription.SkuId) )"
foreach ($user in $users){
    $licenseDetails = Get-MgUser -UserId $User.Id -Property "licenseAssignmentStates" | select -expandproperty "licenseassignmentstates"
    $userSkus=[PSCustomObject]@{
    DisplayName = $user.DisplayName
    Subscription = $subscription.SkuPartNumber
    AssignedThroughGroups = ($licenseDetails | ? { $_.AssignedByGroup }).Count -gt 0
    AssignedDirectly = ($licenseDetails.SkuId).Count -gt ($licenseDetails | ? { $_.AssignedByGroup }).Count
    }
    $userSkus
}

$subscription = Get-MgSubscribedSku -All | Where SkuId -eq <SkuId>

$users = Get-MgUser -Filter "assignedLicenses/any(x:x/skuId eq $($subscription.SkuId) )"

foreach ($user in $users){

$licenseDetails = Get-MgUser -UserId $User.Id -Property "licenseAssignmentStates" | select -expandproperty "licenseassignmentstates"

$userSkus=[PSCustomObject]@{

DisplayName = $user.DisplayName

Subscription = $subscription.SkuPartNumber

AssignedThroughGroups = ($licenseDetails | ? { $_.AssignedByGroup }).Count -gt 0

AssignedDirectly = ($licenseDetails.SkuId).Count -gt ($licenseDetails | ? { $_.AssignedByGroup }).Count

}

$userSkus

}

The above script provides Microsoft 365 user report with the assignment type.

Common License Assignment Errors in Group-based License

The following license assignment errors may occur when you are assigning licenses in a group-based manner.

Conflicting Service Plans: This error may arise if one of the products listed in the group includes a service plan that conflicts with another service plan already assigned to the user by another product. To resolve this, you need to remove the user from the group.

This error displays as “MutuallyExclusiveViolation” in PowerShell.

Not Enough Licenses: This error may occur if enough licenses are not available for the products that are specified in the group. You need to either purchase more or free up unused licenses from other users.

This error displays as “CountViolation” in PowerShell.

Limitations Of Group-based Licensing

Below is a list of some of the commonly known limitations regarding group-based licensing.

Doesn’t Support Nested Groups: Group-based licensing currently does not include the ability to add groups that contain other groups.
Only Suitable with Security Groups: This functionality is limited to security groups and Microsoft 365 groups with the attribute “SecurityEnabled” set to true.
License Assignment Type Visibility in M365 Admin Center: Group-based licensing is not currently supported in the Microsoft 365 Admin Center. Licenses assigned or inherited through a group appear as regular user licenses in Microsoft 365 admin center.
Affect the Performance with Directory Synchronization: Assigning or changing licenses to a large group of users (say 100,000 users) can have a negative impact on directory synchronization with Azure AD and on-premises systems.
Problem with Dynamic Groups: It is vital to ensure that the user is a member of a dynamic group before proceeding with the license assignment. This is necessary to facilitate proper license assignment.
Difficulty with High Loads: During high-load situations, there may be delays in processing license changes for groups or membership changes for groups with existing licenses. In such cases, you may need to contact Microsoft Support Services for any assistance.

Gain Enriched Microsoft 365 License Reports with AdminDroid for Completely Free!

In fact, this blog provides essential insights into group-based licensing within Microsoft 365. However, efficient management of assigned licenses in your Microsoft 365 environment is equally important. Proper license management and monitoring ensure optimal utilization of resources and adherence to license compliance. Don’t worry! Now, simplify the license management in your Microsoft 365 environment at zero cost with the assistance of AdminDroid Microsoft 365 reporting tool.

AdminDroid’s Microsoft 365 License Reporting gives unimaginable and free license reports, eliminating the need for complex PowerShell cmdlets. AdminDroid Microsoft 365 license usage reports allow admins to get reports in a few clicks. It also enables admins to get free license-related reports with three sections:

License Reports:

All Licensed Users Report
Licenses Assigned for Sign-in Disabled Users Report
Users by Assigned Subscriptions Report
Detailed License Provisioning Report
Unlicensed Users Report
Users With Free Subscriptions Report
Users With Trial Subscriptions Report

License Expiry Reports:

Users with Soon-to-Expire Purchased Subscriptions Report
Purchased Subscription Expired Users Report
Users with Soon-to-Expire Trial Subscriptions Report
Trial Expired Users Report
Users with Suspended Subscriptions Report

Subscription Report:

Subscription Usage Report
Expired Subscriptions Report
Unused Subscriptions Report
Purchased Subscriptions Report
Trial Subscriptions Report
Free Subscriptions Report

Microsoft License Dashboard – AdminDroid

Moreover, AdminDroid’s free Azure AD reporting tool provides detailed reports of user-related information, giving administrators the ability to get Microsoft 365 user details. It generates extensive insights on Microsoft 365 user activities, user passwords, group activities, licenses, and subscriptions.

Also, admins can grab the entire visibility and track changes over Microsoft 365 accounts and groups activity through Azure Active Directory management, which offers a robust suite of 190+ reports.

Additionally, AdminDroid offers 1800+ reports and 30+ dashboards for all Microsoft 365 services such as SharePoint, Exchange Online, MS Teams, Power BI, Yammer, etc. Admins can experience all these reports in their Microsoft 365 domain free for 15 days with the premium edition.

Discover the advantages of AdminDroid by downloading it today and enjoy the benefits of a 15-day free premium edition trial.

Wrapping Up

In conclusion, we hope that the blog has provided you with an overview of group-based licensing in Microsoft 365. Do not stop with this! Give a try to auto-claim policies, which goes beyond group-based licensing. If you have any comments or questions, please don’t hesitate to contact us. We value your feedback and welcome any inquiries you may have!