SOLVED
Home

Dynamic Groups - Premium License Impact

%3CLINGO-SUB%20id%3D%22lingo-sub-44224%22%20slang%3D%22en-US%22%3EDynamic%20Groups%20-%20Premium%20License%20Impact%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-44224%22%20slang%3D%22en-US%22%3E%3CP%3EWhat%20happens%20if%20a%20dynamic%20group%20is%20created%20and%20some%20of%20the%20members%20don't%20have%20an%20AAD%20Premium%20license%20assigned%20to%20them%3F%20Is%20there%20account%20excluded%20from%20the%20group%3F%20Is%20a%20warning%20provided%3F%20Are%20these%20groups%20audited%20by%20MS%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-44224%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-44480%22%20slang%3D%22en-US%22%3ERe%3A%20Dynamic%20Groups%20-%20Premium%20License%20Impact%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-44480%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20is%20an%20issue%20that%20has%20been%20discussed%20ever%20since%20Microsoft%20introduced%20AAD%20dynamic%20groups.%20Any%20account%20that%20comes%20under%20the%20scope%20of%20a%20query%20used%20for%20an%20AAD%20dynamic%20group%20-%20including%20those%20used%20for%20Office%20365%20dynamic%20groups%20-%20require%20a%20license.%20End%20of%20story.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20issue%20does%20not%20arise%20for%20enterprise%20tenants%20who%20license%20AAD%20premium%20for%20other%20reasons%20(like%20writeback%20to%20an%20on-premises%20AD).%20It%20does%20if%20you%20have%20no%20other%20reason%20to%20use%20AAD%20premium...%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-44383%22%20slang%3D%22en-US%22%3ERe%3A%20Dynamic%20Groups%20-%20Premium%20License%20Impact%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-44383%22%20slang%3D%22en-US%22%3E%3CP%20class%3D%22lf-text-block%20lf-block%22%3EWhile%20reading%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-accessmanagement-groups-with-advanced-rules.%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-accessmanagement-groups-with-advanced-rules.%26nbsp%3B%3C%2FA%3E%20I%20saw%20the%20following%3A%3C%2FP%3E%3CP%20class%3D%22lf-text-block%20lf-block%22%3E%26nbsp%3B%3C%2FP%3E%3CP%20class%3D%22lf-text-block%20lf-block%22%3EDynamic%20memberships%20for%20groups%20require%20an%20Azure%20AD%20Premium%20license%20to%20be%20assigned%20to%3CSPAN%20class%3D%22lf-thread-btn%22%3E%3CA%20target%3D%22_blank%22%3E%2B%3C%2FA%3E%3C%2FSPAN%3E%3C%2FP%3E%3CUL%3E%3CLI%3EThe%20administrator%20who%20manages%20the%20rule%20on%20a%20group%3C%2FLI%3E%3CLI%3E%3CSTRONG%3EAll%20members%20of%20the%20group%3C%2FSTRONG%3E%3C%2FLI%3E%3C%2FUL%3E%3CP%3EI%20am%20concerned%20that%20it%20is%20very%20easy%20to%20violate%20the%20terms%20of%20the%20license.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20really%20wondering%20if%20we%20need%20to%20create%20our%20own%20tools%20to%20monitor%20compliance%20or%20if%20there%20is%20something%20provided%20by%20MS%20which%20I%20don't%20know%20about.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-44354%22%20slang%3D%22en-US%22%3ERe%3A%20Dynamic%20Groups%20-%20Premium%20License%20Impact%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-44354%22%20slang%3D%22en-US%22%3E%3CP%3EI%20know%20they%20do%20not%20enforce%20license%20requirements%2C%20but%20you%20are%20most%20likely%20breaking%20the%20terms.%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F64%22%20target%3D%22_blank%22%3E%40Tony%20Redmond%3C%2FA%3E%26nbsp%3Bis%20the%20authority%20on%20this%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-44270%22%20slang%3D%22en-US%22%3ERe%3A%20Dynamic%20Groups%20-%20Premium%20License%20Impact%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-44270%22%20slang%3D%22en-US%22%3EDon't%20specifically%20know%20the%20answers%2C%20but%20my%20assumption%20is%20the%20user%20that%20needs%20to%20%22configure%22%20the%20dynamic%20rules%20is%20the%20only%20one%20that%20requires%20the%20AAD%20Premium%20license.%20Same%20way%20the%20O365%20branding%20works.%3CBR%20%2F%3E%3CBR%20%2F%3EThey%20are%20definitely%20NOT%20excluded%20from%20the%20group%20though.%3C%2FLINGO-BODY%3E
Dean Gross
Respected Contributor

What happens if a dynamic group is created and some of the members don't have an AAD Premium license assigned to them? Is there account excluded from the group? Is a warning provided? Are these groups audited by MS?

4 Replies
Don't specifically know the answers, but my assumption is the user that needs to "configure" the dynamic rules is the only one that requires the AAD Premium license. Same way the O365 branding works.

They are definitely NOT excluded from the group though.

I know they do not enforce license requirements, but you are most likely breaking the terms. @Tony Redmond is the authority on this :)

While reading https://docs.microsoft.com/en-us/azure/active-directory/active-directory-accessmanagement-groups-wit... I saw the following:

 

Dynamic memberships for groups require an Azure AD Premium license to be assigned to+

  • The administrator who manages the rule on a group
  • All members of the group

I am concerned that it is very easy to violate the terms of the license.

 

I'm really wondering if we need to create our own tools to monitor compliance or if there is something provided by MS which I don't know about.

Solution

This is an issue that has been discussed ever since Microsoft introduced AAD dynamic groups. Any account that comes under the scope of a query used for an AAD dynamic group - including those used for Office 365 dynamic groups - require a license. End of story.

 

The issue does not arise for enterprise tenants who license AAD premium for other reasons (like writeback to an on-premises AD). It does if you have no other reason to use AAD premium...

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
35 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
9 Replies