sharepoinTony

@info – The practical side of SharePoint

O365: How to setup Group Licensing

Posted by sharepoinTony on October 22, 2019

Summary: Azure Active Directory (AAD) Security Groups may have Licenses applied to them as long as they are “Static” – they cannot be a Dynamic group (one where members are dynamically included via a query).  Static groups are defined as those with a Membership type of Assigned.  This cannot be done in the O365 Admin Portal, the group must be created in AAD.  All members of the group will have the assigned license applied to them. Using AAD Groups can simplify license management for your organization.

Steps

Login and go to the Azure Active Directory portal, in the <Company> Overview section select Groups and Click New group  

Create the group – critical items are highlighted in this example

Notice that I am naming the Group very literally. As you work through these steps you will see that I actually changed the name of my group to be more easily recognized within AAD. I now use “LIC-” as a prefix to all groups created for licensing. This helps with the management of groups as well as providing a simply way to use the license groups you create. Search for “LIC” and you will find all of your license groups to work with.

I am using the following for the Group description: Members of this group will be assigned the “<insert official license name here>” license. This is not only uniform and descriptive, but it also leaves no room for error when any Global or Account manager is adding members to groups.

You must Select Owners before completing the creation of the group, but you can leave Members empty for now.

Click the Create button at the bottom of the page.

Then from the Groups-All groups page select the created group to open the Group blade. Note the group has been renamed to LIC-POLPremium from the rather long name initially used (Project Online Premium License Holders).

Select Licenses from the Manage menu  

In the Licenses blade, select Assign from the top, then expand the Configure required settings item to open the Products blade.

Then select the license for this group (Products).

Products blade
Products blade

Click Select to return to the Assign License blade, then select Assignment options and select the desired options. 

NOTE that depending on the license, different Enabled Services may be required.  Attempting to save will generate an error if you don’t have correct items selected.  I discovered, for example, that for the Professional license you must select SharePoint in addition to one (or both) of the Project options.

Click OK in the License options blade.

Then click Assign in the Assign license blade. <don’t skip this step or no license will be assigned>

A small popup will appear in the top right displaying “Assigning licenses” and then will change to “Licenses assigned” briefly, then disappear.

If it errors you will see it in that small popup.  The error typically means the Enabled Services do not match the license requirement…at least that is to the best of my knowledge at this time.

Now you will see that the License is Active and has Enabled Services when you go to Groups and pull up the group you assigned the license

Now the AAD Security Group is ready to populate with users.

Click on the Groups-All groups bread crumb at the top and only this new group should display. That is the behavior I found when I wrote this, but things change so you may need to search for your group

Optionally, Search for “LIC” to see all license enabled groups.

Select this desired “LIC” group and then select Members

From the Members blade you can “Add members” 

Spot Check & Verification

If desired you can verify by going to Users in AAD and select one of those that you added as a member to the group, check their Licenses and it should now display the license.  You will see that they have the same licenses assigned “directly” and “inherited” from groups.  This one should display as inherited.

Also note that if you have previously assigned a license directly and then setup a group and and these same people as members you can ‘fix’ this to avoid duplicate licensing. Simply “Remove License” from the user, selecting the “Direct” license. The inherited license will remain and your user won’t even see a blip.

Epilog

Active Directory (AD) Security groups can also have licenses assigned in AAD, thus you could create your license groups in your on-premise AD and still use the license assignment steps described above. This may work best for organizations who are continuing to manage their users within AD and may be more easily integrated into an IDM (Identity Management) system.

Also note that my screen shots and descriptions were done in the Government Community Cloud so your view may be different.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

 
%d bloggers like this: