Forum Discussion
dynamic group based on assigned license
This works perfectly for the dynamic group:
user.assignedPlans -any (assignedPlan.service -eq "TeamspaceAPI" -and assignedPlan.capabilityStatus -eq "Enabled")
To get Service names you can run PowerShell:
Get-AzureADUser -SearchString "UserName" | Select -ExpandProperty AssignedPlans
The whole idea is that you can combine results by the part of the name using "contains" (to get all users licensed for AAD for. instance). I use it to get all users with any Teams License for any E or F licenses.
For the license separation you can use name that only exisit for the E3/E5 plan but you can do the same with Service Plan IDs.
I hope it helped.
Because of the long time passed by, i've updated my personal documentation in the meantime, too.
Just in case someone stumbles upon this topic:
I personally prefer using the ServicePlan ID:
- Get ServicePlan ID via Powershell
- Get-AzureADUserLicenseDetail -ObjectId $user.objectid | Select-Object -ExpandProperty ServicePlans
- Get ServicePlan ID via Graph Explorer (https://developer.microsoft.com/en-us/graph/graph-explorer)
- Dynamic Rule Query
- user.assignedPlans -any (assignedPlan.servicePlanId -eq "xxx-xxx-xxx-xxx-xxx" -and assignedPlan.capabilityStatus -eq "Enabled")
Patrick, I am trying to understand what the problem was with your original solution? I am trying to do the same thing right now and was going to use your original solution, but am not following why you werent happy with it.
Thanks
Entra_lover5 The ServicePlanName isn’t „that unique“, as the SKU is. The approach that worked best for me is the one in my latest reply. (before this one)
ahhh, ok I understand now. I am using the service plan ID not the name, so I didn't realize. I am not sure I am going to actually need the group as I originally thought. My original plan was to create a dynamic group that tracks people with an intune license and then use that to apply intune user windows policies to, but then I realized this is probably a bad idea because I have non-intune licensed users who have business basic that will be logged in to a few shared device licensed intune shared PC. If I do it this way, they wont be applied any policies at all, although I am not 100% clear if they will be applied policies in this situation. Perhaps I have no choice but to apply everything to the device for these few shared (or kiosk) devices that are licensed for intune multi user shared device.
