At a large international NGO where I spent several years managing IT across multiple countries, assigning Microsoft 365 licenses was a monthly chore. New hire joins in Mombasa, someone in IT gets a WhatsApp asking to assign the license. Staff member transfers to a different project, nobody updates the license tier. Someone resigns, the active seat sits for three to four weeks until the next audit cycle catches it. Multiply that across 400-plus staff spread across 14 countries and you get overspend, compliance findings, and IT officers wasting hours in admin that should not exist.
The fix was already built into Entra ID (then called Azure AD). Group-based licensing assigns and reclaims M365 licenses automatically based on group membership, and with dynamic groups, the membership itself is automatic. Set it up once, and license management largely runs without you.
This post covers the full setup: what you need, the four steps, the dynamic membership rule that makes it genuinely self-maintaining, and the one failure mode worth monitoring.
What Group-Based Licensing Actually Is
The concept is straightforward: instead of assigning a license directly to a user, you assign it to a security group. Every member of that group inherits the license. Add someone to the group, they get the license within minutes. Remove them, the seat is reclaimed automatically.
The useful extension of this is dynamic membership. You write a rule in Entra ID, such as "any user whose department attribute is set to Customer Support," and the group manages its own membership based on Entra user attributes. New hire's account is created with the right department, they join the group by rule, they get licensed. No IT ticket, no manual step, no lag.
What You Need Before Starting
Group-based licensing requires Microsoft Entra ID P1 (for the license assignment feature) and dynamic groups also require Entra ID P1. Both are included in Microsoft 365 Business Premium, E3, and E5, and in the Enterprise Mobility + Security E3 bundle. If your org is on M365 Business Basic or Standard, check your license detail in the Microsoft 365 admin center before proceeding. You may need to add Entra ID P1 as an add-on.
You'll also need the Global Administrator or License Administrator role in Entra. Budget about 30 to 45 minutes for initial setup, plus an hour or so to migrate existing users if you have more than a handful.
The Four-Step Setup
Step 1: Create your license groups
In Entra ID (portal.azure.com), go to Groups and create a new Security group for each license tier you use. If you have a mix of E3 and E5 users, make one group per tier. For add-ons like Power BI Pro or Visio Plan, create separate groups for those.
Use a consistent naming prefix so these groups are easy to identify and audit:
M365_E3_AssignedM365_E5_AssignedM365_PowerBIPro
At this point, leave membership type as Assigned. You'll switch to dynamic later once the license assignment is in place.
Step 2: Assign the license to each group
Open each group, navigate to Licenses, then click Assignments. Select the relevant M365 license plan and choose which service plans to enable or disable. For example, you might disable Sway or Kaizala org-wide since very few people use them. Save.
That's the core setup done. Any user you add to this group will receive the license within a few minutes. Entra processes group license assignments asynchronously, so the first few assignments may take up to 10 minutes to appear.
Step 3: Migrate existing users (one-time manual effort)
This is the only part that requires real effort, and it's a one-time task. You need to identify every user who currently has each license assigned directly, add them to the appropriate group, verify the group-inherited license shows as active on their account, and then remove the direct license assignment.
A useful Microsoft Graph PowerShell snippet to list everyone currently holding an E3 license by SKU ID:
# Replace the SkuId with your actual E3 SKU from Get-MgSubscribedSku
Get-MgUser -All -Property DisplayName,AssignedLicenses |
Where-Object { $_.AssignedLicenses.SkuId -contains "YOUR_E3_SKU_ID" } |
Select-Object DisplayNameFor orgs with more than roughly 50 users, it's worth doing this migration in batches and monitoring for errors in Entra's Groups > Licenses view before removing any direct assignments.
Step 4: Add dynamic membership rules
This is what makes the setup self-maintaining. Open the license group, go to Members, and change the membership type to Dynamic User. Write a rule using Entra user attributes.
A simple rule for a support team:
(user.department -eq "Customer Support") or
(user.jobTitle -contains "Support Specialist")From this point forward: new hire gets their Entra account created with the matching department or job title attribute, they join the group automatically, they get their M365 license. No IT ticket. No delay.
When they leave and their account is disabled or removed, they exit the group and the license is reclaimed. The whole license lifecycle runs on attribute changes, not on someone remembering to do something.
Dynamic groups require clean HR data in Entra. If your department and job title attributes are inconsistent (some users say "Cust. Support", others say "Customer Support"), the rules will miss people. Cleaning up those attributes before you switch to dynamic membership is worth the time.
The Conflict Problem to Watch For
If a user ends up in two groups that assign overlapping service plans within the same license SKU, Entra flags a conflict and the assignment fails. The user gets a warning badge in the portal, but you may not notice it unless you're actively monitoring.
Set up an alert in Entra ID > Monitoring > Diagnostic settings (or use a simple Azure Monitor alert rule) to notify you whenever a group license assignment error fires. It takes about five minutes to configure and means you find out about failures before a new hire logs a "why can't I access Teams" ticket on day one.
The other conflict to watch: nested groups. Entra supports group-based licensing on security groups, but the inheritance does not propagate through nested group membership. Users must be direct members of the license group, not members of a subgroup. This catches teams that love nested AD/Entra group structures.
The Compliance Payoff
Every license assignment and reclamation is logged in the Entra audit log with a timestamp, who triggered it (the dynamic rule or a manual admin action), and the license change details. If you're ever in a SOC 2, ISO 27001, or internal security audit and the question is "how quickly do you reclaim licenses after offboarding," you can pull a filtered audit log export and show exactly when each user's group membership changed and when the license was returned to the pool.
For any org managing M365 at scale, this replaces the two-week spreadsheet archaeology that typically precedes those reviews. The data is already there, structured, and accurate.
What This Looks Like Running
At the top US company I work with now, new hire provisioning is automated end to end: an HR system action triggers account creation in Entra with the correct attributes, the dynamic group picks up the new account and assigns the license, and by the time the new hire sits down at their desk, their account is provisioned and licensed without anyone in IT touching a single screen. Offboarding runs the same way in reverse, with the license timestamp in the audit log as the evidence record.
This is not zero-human-involvement. Someone still creates the HR record, reviews the audit log monthly, and handles edge cases like contractors on custom license blends. But the humans are doing judgment work, not clicking through a license screen fifty times a month.
Where to Start
If you're on M365 Business Premium, E3, or E5 and you're still assigning licenses manually, start with one group for your most common license tier. Get the assignment working, migrate five or ten users, verify the inherited licenses land cleanly, then expand. The dynamic membership rule can come after; the core value of group-based assignment is there even before you automate the membership.
Working through your M365 setup or trying to figure out if your license tier includes Entra ID P1? Drop me a line and I'm happy to look at the specifics.
Comments