Which groups can carry licences, who can assign them and how membership drives access.
From Ultra Transcenders AB-650 by Tony Rough (coming November 2026)
Group-based licensing assigns licences to a group so membership drives access: add a user and the licence follows, remove them and it is withdrawn. It works with security groups, mail-enabled groups and Microsoft 365 groups. In the Microsoft 365 admin center you do it on the Licenses page; the same function exists in the Microsoft Entra admin center and through Set-MgGroupLicense. Who can do it: Groups Administrator, License Administrator or User Administrator.
| Item | Rule |
|---|---|
| Nested groups | Not supported. Only users in the first-level group get the licence |
| Groups per assignment action | Up to 20 groups at a time |
| Reprocess | Up to 20 users at a time |
| Error and success lists | Paged, 999 users at a time |
| Usage location | Must be set on the user. If missing, group-based licensing uses the tenant location |
| Groups containing B2B guests | Do not configure group-based licensing for them |
| Large groups | Very large groups can slow processing |
Remember that users get all products assigned to a group. If one product fails (no licences, conflict, dependency), other products in the same group may not be assigned either.
Add the user to the destination group first, confirm the new licence on the user’s Licenses page, and only then remove the user from the source group. Removing first leaves the user unlicensed until processing completes, which takes longer in big tenants.
| Error | Cause | Fix |
|---|---|---|
| Not enough licences | Fewer available licences than group members | Buy more, remove direct assignments, free licences |
| Conflicting service plans | For example, Office 365 E1 assigned directly and E3 through a group, with overlapping Exchange Online plans | Disable one plan or remove the redundant direct licence |
| Other products depend on this licence | A plan cannot be removed because another product needs it (Audio Conferencing depends on Skype for Business) | Remove or reassign the dependent product first; otherwise the inherited licence may become direct |
| Usage location not allowed | Missing or unsupported location | Set a valid usage location |
| Duplicate proxy addresses | Two users share a proxy address, so Exchange licensing fails | Correct the address, then reprocess |
Before deleting a licensed group, remove its licences. Inherited licences can convert to direct assignments when another assigned product depends on them. To find groups with errors, use the Microsoft Entra admin center (Billing > Licenses > Overview) or the group’s own page; to retry, use Reprocess on the product’s Errors & issues tab.
Common trap: Licensing a “department” group made up of other groups covers everyone in the departments - group-based licensing ignores nested groups, so only direct members of the licensed group are licensed.
Common trap: Moving a person to a new licensed group by removing them from the old group first - the user is unlicensed until the new assignment finishes processing. Add to the destination first, verify the licence, then remove from the source.
This note is one section of Ultra Transcenders AB-650: Administering Microsoft 365 and AI Services, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Microsoft Learn.
Due on Amazon in November 2026, in Kindle and paperback editions.
About the book · AB-650 terms in the glossary · All AB-650 study notes
How administrative units scope roles to a subset of users, groups and devices.
How built-in and custom authentication strengths define which method combinations satisfy a policy.
How a Conditional Access policy combines assignments, conditions and access controls.
What the harmless phishing simulations are, and the licence and permissions needed to run them.
What the Copilot policy location is, which template offers it and the controls it provides.
How SharePoint data access governance reports and Purview data risk assessments help to find oversharing.
The three audience options for when tenant users receive new features, and where Frontier fits.
Where Copilot issues are tracked: Service health for incidents and Message center for changes.