3.2.4. License Management
💡 First Principle: A license is an entitlement attached to an identity — and entitlements at scale must follow membership, not tickets. Group-based licensing turns "who gets P2?" into a group-membership question, which by now you know how to automate with dynamic rules.
Mechanics: assign licenses (and toggle individual service plans within them — e.g., assign E5 minus Yammer) directly to users or to groups; group members inherit; leave the group, lose the license. UsageLocation is required before assignment (services are geo-restricted) — the classic silent failure: dynamic group adds a user without usageLocation → license assignment errors for that user, visible in the group's license-errors view. Other error states: not enough licenses (purchase or trim), and conflicts between mutually exclusive plans from different groups.
Inheritance rules that reach the exam: direct and group assignments stack (removing the group's license keeps a direct one); a user in two groups granting the same product consumes one seat but shows both sources; removing a user from a licensing group removes inherited services after evaluation lag (dynamic-group timing again). Reporting lives in Billing → Licenses (consumed vs available, per-product) and per-group error views; Graph (Get-MgUserLicenseDetail) scripts audits at scale.
Design heuristic stems reward: dynamic groups keyed on department/jobType assign base licenses automatically; delta needs (P2 for the security team) come from additional groups; direct assignment remains for exceptions only.
⚠️ Exam Trap: "Some users in the licensing group have no license" → check usageLocation first, then seat count, then plan conflicts — in that order of likelihood. The fix is setting the attribute (ideally at provisioning), not re-adding users to the group.
Reflection Question: Design the group structure to give all employees E3, the security team P2 on top, and interns E1 instead — using dynamic rules and no direct assignments. What attribute hygiene does your design depend on?
