Home

licensing based on azure ad groups

%3CLINGO-SUB%20id%3D%22lingo-sub-284064%22%20slang%3D%22en-US%22%3Elicensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284064%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20tested%20licensing%20based%20on%20azure%20ad%20groups.%20It%20works%20fine%2C%20but%20I%20get%20one%20big%20problem.%3C%2FP%3E%3CP%3EI%20got%205%20E3%20license.%20Now%20I%20put%2010%20users%20in%20the%20group%20which%20assigned%20to%20the%20E3%20license.%20After%20a%20short%20time%2C%20all%2010%20users%20have%20a%20E3%20license%20assigned%20form%20the%20group.%3C%2FP%3E%3CP%3EHow%20can%20get%20a%20report%20that%20we%20missed%205%20licenses%20and%20must%20buy%20it%3F%20Or%20how%20can%20I%20handle%20it%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%3C%2FP%3E%3CP%3EStefan%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-284064%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAccess%20Management%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-285336%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-285336%22%20slang%3D%22en-US%22%3E%3CP%3EYes%20there%20are%20not%20showing%20any%20Errors.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-285204%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-285204%22%20slang%3D%22en-US%22%3EHi%20Stefan%3CBR%20%2F%3E%3CBR%20%2F%3EI%20am%20assuming%20you've%20seen%20this%2C%20and%20azure%20ad%20does%20not%20show%20any%20errors...%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fusers-groups-roles%2Flicensing-groups-resolve-problems%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fusers-groups-roles%2Flicensing-groups-resolve-problems%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3ELicenses%20blade%20in%20azure%20ad%20is%20where%20these%20errors%20should%20show%20up.%3CBR%20%2F%3E%3CBR%20%2F%3ERegards%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284422%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284422%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20error%20is%20reported%20on%20the%20user%20object%2C%20there%20are%20examples%20on%20how%20you%20can%20get%20it%20via%20PowerShell%20in%20the%20article%20I%20linked.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284356%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284356%22%20slang%3D%22en-US%22%3EIn%20the%20absence%20of%20accurate%20reporting%2C%20this%20is%20incredibly%20troubling.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284306%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284306%22%20slang%3D%22en-US%22%3E%3CP%3ENo%20Trail%20license%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20461px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F59327i1AFFF235A3D5B303%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222018-11-08%2022_26_43-Microsoft%20365%20admin%20center%20-%20Abonnements%20-%20Internet%20Explorer.png%22%20title%3D%222018-11-08%2022_26_43-Microsoft%20365%20admin%20center%20-%20Abonnements%20-%20Internet%20Explorer.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284295%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284295%22%20slang%3D%22en-US%22%3EIn%20admin%20portal%20in%20subscriptions%20-%20what%20can%20you%20read%20from%20here%3F%20It%E2%80%99s%20not%20any%20trial%20licenses%20you%20still%20have%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284290%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284290%22%20slang%3D%22en-US%22%3E%3CP%3ENo%20there%20are%20no%20Errors.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284287%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284287%22%20slang%3D%22en-US%22%3EDo%20you%20have%20any%20errors%20in%20licenses%20tab%20in%20Azure%20AD%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284285%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284285%22%20slang%3D%22en-US%22%3ENo%2C%20when%20licensing%20with%20groups%20you%20don%E2%80%99t%20get%20any%20error%20presented%20to%20you%20directly%20when%20you%20don%E2%80%99t%20have%20enough%20licenses%2C%20like%20you%20do%20when%20assigning%20per%20user!%20The%20users%20will%20be%20in%20an%20error%20state%20as%20you%20can%20see%20in%20Azure%20Ad%20under%20Licenses%2C%20and%20as%20%40Vasil%20said%20powershell%20Reports%20this%20as%20a%20%E2%80%9Ccountviolation%E2%80%9D%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284283%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284283%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20for%20your%20Response.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20It%20dosent%20work.%20I%20have%20only%205%20license.%20But%20the%20report%20showed%20that%20all%20is%20okay.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F59324i31387305462F557D%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222018-11-08%2021_41_53-Ausw%C3%A4hlen%20Windows%20PowerShell.png%22%20title%3D%222018-11-08%2021_41_53-Ausw%C3%A4hlen%20Windows%20PowerShell.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%3C%2FP%3E%3CP%3EStefan%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284281%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284281%22%20slang%3D%22en-US%22%3E%3CP%3EVasil%20-%20am%20I%20understanding%20this%20correctly%3A%20CountViolation%20will%20(eventually)%20be%20generated%20when%20I%20have%20overbooked%20the%20number%20of%20User%20SLs%20for%20a%20given%20service%20I%20actually%20own%3F%20So%20the%20service%20isn't%20actually%20enforcing%20compliance%20(for%20the%20underlying%20User%20SLs)%20across%20the%20group%3F%3F%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284211%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284211%22%20slang%3D%22en-US%22%3E%3CP%3EIn%20such%20scenarios%2C%20an%20error%20will%20be%20generated%20(%3CEM%3E%3CFONT%20face%3D%22Segoe%20UI%22%3ECountViolation%3C%2FFONT%3E%3C%2FEM%3E)%2C%20and%20you%20can%20periodically%20go%20over%20the%20list%20of%20users%20with%20errors%20as%20detailed%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fusers-groups-roles%2Flicensing-ps-examples%23get-all-users-with-license-errors-in-a-group%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fusers-groups-roles%2Flicensing-ps-examples%23get-all-users-with-license-errors-in-a-group%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284072%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284072%22%20slang%3D%22en-US%22%3EThis%20feature%20doesn%E2%80%99t%20have%20any%20reporting%20built%20in!%3CBR%20%2F%3EYou%20could%20run%20some%20powershell%20scripts%20like%20this%20one!%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fgallery.technet.microsoft.com%2Foffice%2FOffice-365-PowerShell-0ecdf3b9%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgallery.technet.microsoft.com%2Foffice%2FOffice-365-PowerShell-0ecdf3b9%3C%2FA%3E%3C%2FLINGO-BODY%3E
Frequent Contributor

Hello,

 

I tested licensing based on azure ad groups. It works fine, but I get one big problem.

I got 5 E3 license. Now I put 10 users in the group which assigned to the E3 license. After a short time, all 10 users have a E3 license assigned form the group.

How can get a report that we missed 5 licenses and must buy it? Or how can I handle it?

 

Regards

Stefan

13 Replies
This feature doesn’t have any reporting built in!
You could run some powershell scripts like this one!
https://gallery.technet.microsoft.com/office/Office-365-PowerShell-0ecdf3b9

In such scenarios, an error will be generated (CountViolation), and you can periodically go over the list of users with errors as detailed here: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-ps-examples#get...

Vasil - am I understanding this correctly: CountViolation will (eventually) be generated when I have overbooked the number of User SLs for a given service I actually own? So the service isn't actually enforcing compliance (for the underlying User SLs) across the group???

Highlighted

Thanks for your Response.

 

But It dosent work. I have only 5 license. But the report showed that all is okay.

2018-11-08 21_41_53-Auswählen Windows PowerShell.png

 

Regards

Stefan

No, when licensing with groups you don’t get any error presented to you directly when you don’t have enough licenses, like you do when assigning per user! The users will be in an error state as you can see in Azure Ad under Licenses, and as @Vasil said powershell Reports this as a “countviolation”
Do you have any errors in licenses tab in Azure AD?

No there are no Errors.

In admin portal in subscriptions - what can you read from here? It’s not any trial licenses you still have?

No Trail license

 

2018-11-08 22_26_43-Microsoft 365 admin center - Abonnements - Internet Explorer.png

In the absence of accurate reporting, this is incredibly troubling.

The error is reported on the user object, there are examples on how you can get it via PowerShell in the article I linked.

Hi Stefan

I am assuming you've seen this, and azure ad does not show any errors...
https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-groups-resolve-...

Licenses blade in azure ad is where these errors should show up.

Regards

Yes there are not showing any Errors.

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies