Episode 4 — Licensing — Editions and Group-Based Licensing

Episode 3 gave you the group toolbox — security vs Microsoft 365 groups, assigned vs dynamic membership, and the long list of nesting limitations. Now we put groups to work on one of their most common jobs: distributing licenses at scale — and we sort out which Microsoft Entra ID edition unlocks which administrative feature.

Learning objectives

• Distinguish the four Microsoft Entra licensing options — Free, P1, P2, and Microsoft Entra Suite — and how each is acquired.
• Identify which AZ-104-relevant admin features require P1 (Conditional Access, SSPR writeback, Entra custom roles…) and which require P2 (Identity Protection, PIM).
• Assign licenses to a group from the Microsoft 365 admin center or with Graph PowerShell, respecting the prerequisites (roles, usage location).
• Avoid the classic group-based licensing pitfalls: nested groups, missing usage location, and unsafe moves between licensed groups.
• Diagnose license assignment errors using the Errors & issues tab.

Why it matters

Licensing questions on AZ-104 are rarely about prices — they are about which edition unlocks which feature and why a user in a licensed group didn't get a license. As an administrator, picking the wrong tier blocks a project (no Conditional Access on Free), and mishandling a group move can cut a user off from their mailbox mid-morning. Ten minutes here saves both exam points and helpdesk tickets.

The four licensing options

Microsoft Entra is available in several licensing options, stacked from a free baseline to a full product suite. User and group license assignments are managed through the Microsoft 365 admin center, not the Entra admin center — remember that portal split.

🧠 Mnemonic: "Free to sign in, P1 to control access, P2 to manage risk & privilege."

Which features need which edition

The table below concentrates the feature splits that matter for AZ-104. Scan the P1 and P2 columns: they are the exam's favorite dividing lines.

Three nuances deserve prose:

• SSPR appears in every edition, but capabilities vary by license: the exam-critical fact is that SSPR with password writeback to on-premises AD requires P1 or P2. For a full end-user SSPR deployment, assume at least P1 — Episode 6 details the flow.
• Custom roles: don't conflate the two systems. Microsoft Entra custom roles require a P1 license for every user holding a custom role assignment (built-in Entra roles are free). Azure RBAC — including its custom roles — is free; it is a different authorization system, covered in Episode 7.
• Administrative units split finely: creating AUs is Free, but AU administrators (a P1 license per admin scoped to the AU), dynamic AU membership (P1 per AU member), and restricted management AUs (P1 per AU administrator) are premium.

Always free — and what happens when licenses lapse

Some identity features carry no licensing requirement at all:

• Managed identities for Azure resources — automatically managed identities for applications, at no extra cost.
• Microsoft Entra Connect — the sync engine is free and included with your Azure subscription (only Connect Health needs P1).
• Microsoft Entra Verified ID — included with any Microsoft Entra ID subscription, even Free (the Face Check premium add-on comes with the Entra Suite).
• Microsoft Entra External ID — core features free for your first 50,000 monthly active users (MAU).

License expiry behaves differently per feature — a favorite trick question:

• Conditional Access: when the required licenses expire, policies aren't automatically disabled or deleted. You can still view and delete them, but no longer update them.
• PIM: when the P2 (or ID Governance) license expires, PIM features are no longer available — eligible assignments are removed, but permanent role assignments are unaffected. Note who needs a PIM license: users with eligible or time-bound assignments, members/owners of PIM for Groups, approvers of activation requests, and users performing access reviews.

Group-based licensing

Assigning licenses user by user does not scale. Group-based licensing lets you assign a product to a security group, mail-enabled group, or Microsoft 365 group; every direct member receives the license automatically.

Where and who:

• Portal: Microsoft 365 admin center > Billing > Licenses (not the Entra admin center).
• PowerShell: the Microsoft Graph PowerShell SDK cmdlet Set-MgGroupLicense.
• Required role: at least Groups Administrator, License Administrator, or User Administrator.

Assigning (portal): on Billing > Licenses, select Assign licenses, search for the group, pick the subscription the seats come from, optionally Turn apps and services on or off to trim individual service plans, and confirm. Unassigning works from the product's details page: find the group's row, open the more-actions menu, Unassign.

# Assign or unassign licenses on a group via Microsoft Graph PowerShell
Set-MgGroupLicense -GroupId <group-id> `
  -AddLicenses @{SkuId = "<sku-id>"} -RemoveLicenses @()

Prerequisite: usage location

Some Microsoft services aren't available in all locations, so a user's usage location must be specified before a license can be assigned. With group-based licensing, users without a specific location inherit the location of the tenant — convenient, but wrong for multinational tenants. Always set the usage location explicitly as part of your user creation flow (Episode 2's Properties tab is where it lives).

Pitfall: nested groups are ignored

Group-based licensing doesn't support nested groups. If you assign a license to a group that contains another group, only users in the first-level group receive the license — nested members get nothing. This is the Entra-side nesting behavior you met in Episode 3: nesting doesn't propagate licenses (whereas Azure RBAC role assignments are transitive through group nesting — two different systems, contrasted again in Episode 7).

Pitfall: moving users between licensed groups — order matters

To move a user from one licensed group to another without service interruption:

1. Add the user to the destination group first.
2. Confirm the new license shows on the user's Licenses page.
3. Only then remove the user from the source group.

Remove first, and the user is unlicensed until processing completes — a temporary but very real loss of access.

Errors and flow limits

When assignments fail, go to Billing > Licenses, select the product, and open the Errors & issues tab to inspect each user's error. Common error types: insufficient licenses (not enough seats), conflicting service plans, missing dependencies, proxy address issues, and usage location problems.

Know these numbers as UI/flow limits of the Microsoft 365 admin center, not platform limits: you can assign licenses to a maximum of 20 groups at a time; Reprocess handles up to 20 users at a time; success/failure lists are paginated at 999 users. Also note that processing a very large group (say, 100,000 users) can take a long time and affect performance.

When users leave

Recall Episode 2: deleting a user soft-deletes the account for 30 days — and frees the licenses immediately, whether they were assigned directly or through a group. Group-based licensing keeps this tidy by design: leave the group, lose the license.

Exercises

Exercise 4.1 — Pick the minimum edition

For each organization, state the minimum Microsoft Entra ID edition required:

1. Contoso wants Conditional Access policies requiring MFA on all cloud apps.
2. Fabrikam wants just-in-time activation of the Global Administrator role with approval.
3. Tailwind, a 20-person startup, only needs MFA via the Authenticator mobile app and baseline protection.

Exercise 4.2 — Move a user without interruption

A user must move from group Lic-E3-Sales to group Lic-E3-Marketing; both carry the same product license. Put these steps in the correct order and justify: (a) remove from Lic-E3-Sales; (b) add to Lic-E3-Marketing; (c) verify the license on the user's Licenses page.

Exercise 4.3 — Diagnose a missing license

Maria was added yesterday to a group that carries a licensed product, but she still has no license. List, in the order you would check them, at least three possible causes and where you would verify each.

Key takeaways

• Four options: Free (in Azure/M365 subscriptions), P1 (standalone or M365 E3+/Business Premium), P2 (standalone or M365 E5+; includes P1), Microsoft Entra Suite (requires P1).
• P1 buys the admin levers: Conditional Access, SSPR writeback, Entra custom roles, dynamic groups, AU administrators, Connect Health.
• P2 buys risk and privilege: Identity Protection (risk-based CA) and PIM — on license expiry, eligible assignments are removed, permanent ones stay.
• Entra custom roles need P1, but Azure RBAC and its custom roles are free — two different systems.
• Managed identities, Entra Connect, Verified ID, and External ID (≤ 50,000 MAU) cost nothing extra.
• Group-based licensing lives in the Microsoft 365 admin center (Billing > Licenses) or Set-MgGroupLicense; requires Groups/License/User Administrator.
• Set the usage location explicitly — users without one inherit the tenant location.
• Nested groups get no licenses; when moving users, add to destination, verify, then remove from source.

Quick recall

Q: Which edition is required for plain Conditional Access, and which for risk-based Conditional Access? A: P1 for Conditional Access; P2 (Identity Protection) for risk-based policies.

Q: Your P2 licenses lapse. What happens to PIM role assignments? A: Eligible assignments are removed; permanent assignments are unaffected (and Conditional Access policies, similarly, are not auto-disabled — just no longer updatable).

Q: Scenario — you assign a license to group A, which contains group B. Who is licensed? A: Only direct members of group A. Group-based licensing doesn't support nested groups, so members of B receive nothing.

Q: A user has no usage location set and belongs to a licensed group. What location applies? A: They inherit the tenant's location — which is why you should set usage location explicitly during user creation.

Q: Where do you inspect why a group member failed to get a license? A: Microsoft 365 admin center > Billing > Licenses > select the product > Errors & issues tab.

Q: Is the "20 groups at a time" figure a platform limit? A: No — it is a flow limit of the Microsoft 365 admin-center assignment experience, like Reprocess's 20-users batch and the 999-user pagination.

Coming up

Your tenant now has users, groups, and licenses — time to open the doors. Episode 5 covers Microsoft Entra B2B collaboration: how guest invitations and redemption work, what the #EXT# guest object really is, and the crucial difference between cross-tenant access settings and external collaboration settings.