Home

licensing based on azure ad groups

%3CLINGO-SUB%20id%3D%22lingo-sub-284064%22%20slang%3D%22en-US%22%3Elicensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284064%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20tested%20licensing%20based%20on%20azure%20ad%20groups.%20It%20works%20fine%2C%20but%20I%20get%20one%20big%20problem.%3C%2FP%3E%3CP%3EI%20got%205%20E3%20license.%20Now%20I%20put%2010%20users%20in%20the%20group%20which%20assigned%20to%20the%20E3%20license.%20After%20a%20short%20time%2C%20all%2010%20users%20have%20a%20E3%20license%20assigned%20form%20the%20group.%3C%2FP%3E%3CP%3EHow%20can%20get%20a%20report%20that%20we%20missed%205%20licenses%20and%20must%20buy%20it%3F%20Or%20how%20can%20I%20handle%20it%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%3C%2FP%3E%3CP%3EStefan%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-284064%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAccess%20Management%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-285336%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-285336%22%20slang%3D%22en-US%22%3E%3CP%3EYes%20there%20are%20not%20showing%20any%20Errors.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-285204%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-285204%22%20slang%3D%22en-US%22%3EHi%20Stefan%3CBR%20%2F%3E%3CBR%20%2F%3EI%20am%20assuming%20you've%20seen%20this%2C%20and%20azure%20ad%20does%20not%20show%20any%20errors...%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fusers-groups-roles%2Flicensing-groups-resolve-problems%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fusers-groups-roles%2Flicensing-groups-resolve-problems%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3ELicenses%20blade%20in%20azure%20ad%20is%20where%20these%20errors%20should%20show%20up.%3CBR%20%2F%3E%3CBR%20%2F%3ERegards%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284422%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284422%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20error%20is%20reported%20on%20the%20user%20object%2C%20there%20are%20examples%20on%20how%20you%20can%20get%20it%20via%20PowerShell%20in%20the%20article%20I%20linked.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284356%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284356%22%20slang%3D%22en-US%22%3EIn%20the%20absence%20of%20accurate%20reporting%2C%20this%20is%20incredibly%20troubling.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284306%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284306%22%20slang%3D%22en-US%22%3E%3CP%3ENo%20Trail%20license%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20461px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F59327i1AFFF235A3D5B303%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222018-11-08%2022_26_43-Microsoft%20365%20admin%20center%20-%20Abonnements%20-%20Internet%20Explorer.png%22%20title%3D%222018-11-08%2022_26_43-Microsoft%20365%20admin%20center%20-%20Abonnements%20-%20Internet%20Explorer.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284295%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284295%22%20slang%3D%22en-US%22%3EIn%20admin%20portal%20in%20subscriptions%20-%20what%20can%20you%20read%20from%20here%3F%20It%E2%80%99s%20not%20any%20trial%20licenses%20you%20still%20have%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284290%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284290%22%20slang%3D%22en-US%22%3E%3CP%3ENo%20there%20are%20no%20Errors.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284287%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284287%22%20slang%3D%22en-US%22%3EDo%20you%20have%20any%20errors%20in%20licenses%20tab%20in%20Azure%20AD%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284285%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284285%22%20slang%3D%22en-US%22%3ENo%2C%20when%20licensing%20with%20groups%20you%20don%E2%80%99t%20get%20any%20error%20presented%20to%20you%20directly%20when%20you%20don%E2%80%99t%20have%20enough%20licenses%2C%20like%20you%20do%20when%20assigning%20per%20user!%20The%20users%20will%20be%20in%20an%20error%20state%20as%20you%20can%20see%20in%20Azure%20Ad%20under%20Licenses%2C%20and%20as%20%40Vasil%20said%20powershell%20Reports%20this%20as%20a%20%E2%80%9Ccountviolation%E2%80%9D%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284283%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284283%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20for%20your%20Response.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20It%20dosent%20work.%20I%20have%20only%205%20license.%20But%20the%20report%20showed%20that%20all%20is%20okay.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F59324i31387305462F557D%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222018-11-08%2021_41_53-Ausw%C3%A4hlen%20Windows%20PowerShell.png%22%20title%3D%222018-11-08%2021_41_53-Ausw%C3%A4hlen%20Windows%20PowerShell.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%3C%2FP%3E%3CP%3EStefan%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284281%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284281%22%20slang%3D%22en-US%22%3E%3CP%3EVasil%20-%20am%20I%20understanding%20this%20correctly%3A%20CountViolation%20will%20(eventually)%20be%20generated%20when%20I%20have%20overbooked%20the%20number%20of%20User%20SLs%20for%20a%20given%20service%20I%20actually%20own%3F%20So%20the%20service%20isn't%20actually%20enforcing%20compliance%20(for%20the%20underlying%20User%20SLs)%20across%20the%20group%3F%3F%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284211%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284211%22%20slang%3D%22en-US%22%3E%3CP%3EIn%20such%20scenarios%2C%20an%20error%20will%20be%20generated%20(%3CEM%3E%3CFONT%20face%3D%22Segoe%20UI%22%3ECountViolation%3C%2FFONT%3E%3C%2FEM%3E)%2C%20and%20you%20can%20periodically%20go%20over%20the%20list%20of%20users%20with%20errors%20as%20detailed%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fusers-groups-roles%2Flicensing-ps-examples%23get-all-users-with-license-errors-in-a-group%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fusers-groups-roles%2Flicensing-ps-examples%23get-all-users-with-license-errors-in-a-group%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-284072%22%20slang%3D%22en-US%22%3ERe%3A%20licensing%20based%20on%20azure%20ad%20groups%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-284072%22%20slang%3D%22en-US%22%3EThis%20feature%20doesn%E2%80%99t%20have%20any%20reporting%20built%20in!%3CBR%20%2F%3EYou%20could%20run%20some%20powershell%20scripts%20like%20this%20one!%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fgallery.technet.microsoft.com%2Foffice%2FOffice-365-PowerShell-0ecdf3b9%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgallery.technet.microsoft.com%2Foffice%2FOffice-365-PowerShell-0ecdf3b9%3C%2FA%3E%3C%2FLINGO-BODY%3E
Frequent Contributor

Hello,

 

I tested licensing based on azure ad groups. It works fine, but I get one big problem.

I got 5 E3 license. Now I put 10 users in the group which assigned to the E3 license. After a short time, all 10 users have a E3 license assigned form the group.

How can get a report that we missed 5 licenses and must buy it? Or how can I handle it?

 

Regards

Stefan

13 Replies
This feature doesn’t have any reporting built in!
You could run some powershell scripts like this one!
https://gallery.technet.microsoft.com/office/Office-365-PowerShell-0ecdf3b9

In such scenarios, an error will be generated (CountViolation), and you can periodically go over the list of users with errors as detailed here: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-ps-examples#get...

Vasil - am I understanding this correctly: CountViolation will (eventually) be generated when I have overbooked the number of User SLs for a given service I actually own? So the service isn't actually enforcing compliance (for the underlying User SLs) across the group???

Thanks for your Response.

 

But It dosent work. I have only 5 license. But the report showed that all is okay.

2018-11-08 21_41_53-Auswählen Windows PowerShell.png

 

Regards

Stefan

No, when licensing with groups you don’t get any error presented to you directly when you don’t have enough licenses, like you do when assigning per user! The users will be in an error state as you can see in Azure Ad under Licenses, and as @Vasil said powershell Reports this as a “countviolation”
Do you have any errors in licenses tab in Azure AD?

No there are no Errors.

In admin portal in subscriptions - what can you read from here? It’s not any trial licenses you still have?
Highlighted

No Trail license

 

2018-11-08 22_26_43-Microsoft 365 admin center - Abonnements - Internet Explorer.png

In the absence of accurate reporting, this is incredibly troubling.

The error is reported on the user object, there are examples on how you can get it via PowerShell in the article I linked.

Hi Stefan

I am assuming you've seen this, and azure ad does not show any errors...
https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-groups-resolve-...

Licenses blade in azure ad is where these errors should show up.

Regards

Yes there are not showing any Errors.

Related Conversations
Calendar not available for older AD accounts
_jancis in Microsoft Teams on
0 Replies
Question regarding Azure AD license
Marcos95 in Azure Active Directory on
7 Replies
A1 Plus?
Tony Derricott in Office 365 on
4 Replies
Office 365 groups not visible in Outlook client
Deleted in Office 365 Groups on
8 Replies
SP2016/2019 Office Online licensing
Danie Claassen in SharePoint BI on
3 Replies