How to identify and resolve license assignment problems for a group in Microsoft Entra ID (formerly Azure Active Directory)

Identifying license problems in groups and resolving them is a crucial part of license management. It is necessary for cost control and resource optimization. It ensures operational efficiency, enhances security, and maintains positive vendor relationships.

Steps to identify users in an error state in a group in Microsoft Entra ID:

1. Sign in to Microsoft Entra ID as at least License Administrator.
2. Select Billing > Licenses to view a page where you can see and manage all the licensable products.
3. Select the group you want, and on the overview page, select Licenses. If any users have license assignments errors, a notification will appear.
4. Click on the notification to view all the affected users. Click on each user if you want to see more details.
5. To identify all the groups that have at least one error, go to Licenses > Overview. An information box will be displayed here if any groups require your attention. Select the box to see the list of groups.

Other common license issues in Microsoft Entra ID:

1. If there aren't enough licenses for one of the products in the, you need to either purchase new ones or free up unused ones. To see how many licenses are available, go to Identity > Billing > Licenses > All products. Select a product to see which users and groups are using the license.

   PowerShell report this error as CountViolation.

    Copied

   Click to copy entire script

2. If a product specified in the group contains a license that conflicts with another license already assigned to the user via a different product, the decision to resolve this falls to the administrator. Microsoft Entra ID doesn't automatically resolve license conflicts.

   PowerShell report this error as MutuallyExclusiveViolation.

    Copied

   Click to copy entire script

3. If a product in the group contains a license necessary for another license in another product to operate, then to resolve this issue, you need to verify that the required license is still assigned to users or that the dependent services are disabled for those users. Then you can remove the group license from those users.

   PowerShell report this error as DependencyViolation.

    Copied

   Click to copy entire script

4. Due to local laws and regulations, some Microsoft services are unavailable in certain locations. Ensure that you specify the Usage location property for the users before assigning a license. If you attempt to assign a group license to a user in an unsupported location, it will fail and record an error. To solve this, remove users from unsupported locations from the licensed group. You can also modify the usage location, though this should be done only if the current location values don't represent the user's actual location.

   PowerShell report this error as ProhibitedInUsageLocationViolation.

    Copied

   Click to copy entire script

5. When using Exchange Online, some users in your organization may have incorrectly been configured with identical proxy address values. Consequently, when group-based licensing attempts to assign a license to such users, it encounters error and displays the error message "Proxy address is already being used."

   To see if there is a duplication proxy address, execute the following PowerShell cmdlet against Exchange Online:

   Get-Recipient -Filter "EmailAddresses -eq 'user@contoso.onmicrosoft.com'" | fl DisplayName, RecipientType,Emailaddresses

    Copied

   Click to copy entire script

6. The user encounters a LicenseAssignmentAttributeConcurrencyException recorded in the audit logs when group-based licensing attempts concurrent assignment of the same license. This typically occurs when a user belongs to multiple groups with the same assigned license. Microsoft Entra ID automatically retries processing the user license until the issue is resolved, requiring no action from the customer.
7. Multiple product licenses can be assigned to a group. Microsoft Entra ID attempts to assign all specified licenses to each user. However, if it encounters business logic issues preventing the assignment of one product, it refrains from assigning other licenses in the group as well. This could occur due to insufficient licenses or conflicts with other enabled services for the user. Users who fail to be assigned licenses can be identified, and the affected products can be reviewed accordingly.
8. Before deleting a licensed group, you must remove all its assigned licenses. This can be time-consuming and may fail if users have dependent licenses or proxy address conflicts. Dependent licenses will change from inherited to direct when the group license is removed.
9. Certain Microsoft Online products you own may be add-ons, requiring a prerequisite service plan to be enabled for a user or group before a license can be assigned. With group-based licensing, both the prerequisite and add-on service plans must be in the same group to ensure that any users added to the group can access the fully working product.
10. It might be required to manually trigger the processing of a group to update the user status depending on what actions you have taken to resolve the errors.

About M365 Manager Plus

ManageEngine M365 Manager Plus is a Microsoft 365 reporting, auditing, management and monitoring tool. With M365 Manager Plus, you can:

• Enhance your comprehension of Microsoft services using user-friendly reports, easily scheduled, exported, and emailed from a unified console.
• Track all user and admin activities within your Microsoft 365 environment through detailed audit reports.
• Efficiently manage tasks such as bulk user creation, deletion, and password resets, and automate them for time and labor savings.
• Empower technicians with delegated tasks without requiring elevated native privileges.
• Ensure constant monitoring of your organization's health and performance around the clock.
• Reduce the administrator workload by delegating custom roles to help desk technicians.