How to assign licenses with group-based licensing in Entra ID

Group-based licensing in Entra ID replaces per-user licence assignment with a rule: members of this group get this licence with these service plans. Build the groups (dynamic by department or job attribute where you can), assign licences at the group, then migrate existing direct assignments and remove them. From then on, joiners get licensed when HR data lands them in the group and leavers lose the licence when they leave it — which is the only way licensing stays correct at scale.

For how licences and groups fit together conceptually, and the dynamic-group patterns that work, see Entra ID groups and group-based licensing. The wider picture of what to buy is in Microsoft 365 plans and pricing.

Prerequisites

• Entra ID P1 for licensed users (see FAQ).
• License Administrator role for assignments; Groups Administrator or User Administrator to create groups. Global Admin is not needed.
• Usage location populated on users. Group-based licensing can assign to users without one (it falls back to the tenant's location), but some service plans are unavailable in some countries and will error; set usageLocation from HR data via Entra Connect or Lifecycle Workflows.
• Enough licences. Group-based licensing does not create headroom; it exposes the lack of it as an error. Check Microsoft 365 admin center → Billing → Licenses first, and read the licence overrun runbook if you are close.

Steps

1. Design the groups

One group per licence profile, not per licence. Typical set: LIC-M365-E3-Standard (E3 with everything on), LIC-M365-E3-NoTeamsPhone, LIC-M365-F3, LIC-Copilot, LIC-Visio-P2. Keep add-ons in their own groups so a user can be in LIC-M365-E3-Standard and LIC-Copilot independently.

Make base-licence groups dynamic where an attribute reliably distinguishes populations — (user.department -eq "Retail Stores") for F3, (user.employeeType -eq "Employee") for E3 — and add-on groups assigned (static), because Copilot and Visio seats are budget decisions someone approves.

2. Create the groups

Entra admin center → Groups → New group: type Security, membership type Dynamic User, and the rule from step 1. Validate the rule with Validate rules against a few known users before saving. Dynamic membership processing takes minutes to an hour for a large tenant on first evaluation.

3. Assign the licence to the group

Entra → Groups → the group → Licenses → Assignments. Tick the product; under it, turn off the service plans you do not want (Yammer/Viva Engage, Sway, Kaizala-style leftovers, or Exchange Online if a population uses another mail system). Save. The assignment shows as In progress then Active; users show the licence as Inherited from the group.

With PowerShell (Graph):

Connect-MgGraph -Scopes "Group.ReadWrite.All","Organization.Read.All"
$sku = Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "SPE_E3"
Set-MgGroupLicense -GroupId <groupId> -AddLicenses @{SkuId = $sku.SkuId; DisabledPlans = @()} -RemoveLicenses @()

4. Migrate direct assignments

For each user who already has the licence directly: confirm they are a member of the group and the licence shows Inherited as well as Direct, then remove the direct assignment. In bulk: Entra → Billing → Licenses → All products → the product → Licensed users → filter Assignment path: Direct, select all, Remove license — Entra only removes the direct path and keeps the inherited one. Do a pilot batch of ten first.

5. Handle errors

Groups → the group → Licenses → Assignments shows a red count for users in error. Users → the user → Licenses shows the reason: Not enough licenses (buy or trim), Conflicting service plans (two groups, remove one), Usage location not allowed (set the location), Dependent service plan missing (a plan you disabled is required by another — re-enable it). Errors do not auto-retry after you fix the cause; use Reprocess on the group or the user.

Verify

• A test user added to the group gets the licence within minutes and a mailbox shortly after; removed from the group, the licence disappears at the next processing pass (and the mailbox goes soft-deleted after 30 days per normal rules).
• Billing → Licenses consumed count matches group memberships; no user shows Direct on a licence a group also provides.
• Zero users in error state on every licensing group; make that a weekly check in PowerShell reporting.

Roll back

Removing a licence from a group removes it from every member on the next pass — which is instant and irreversible for mailbox data after the soft-delete window, so never remove a group licence assignment as a "quick fix". If a group's rule is wrong, fix the rule; if you must pause, convert the group to assigned membership (which freezes its current members) before editing. Direct assignments can always be re-added to individual users while you sort it out.