This is from Microsoft 365 support case #26219180.
It’s unlikely that all users in a Microsoft 365 tenant will have the same license. You’ll have some users with license A, some with license B, and some unlicensed users with roles such as Global Admin. Certain Microsoft 365 products and features such as Intune, Conditional Access Policies, and Safe Links allow you to apply that setting to all users or all recipients in a domain. In some cases, like Intune, from a technical perspective if a user lacks the appropriate license he or she will not be impacted by the setting. In other cases, like some Conditional Access Policies or possibly Safe Links, choosing all users will cause the setting to apply to those who are and are not licensed for that product.
Therefore, to be in licensing compliance the Microsoft 365 global admin, or admin configuring these features, should instead create a dynamic group and have that group query for the user's license. For example, create a dynamic group called Azure AD Premium P1 users and have the dynamic membership rule query for the Microsoft 365 Business Premium license. Then, in your Conditional Access Policy use the Azure AD Premium P1 users group instead of all users.
Choosing not to do the above approach can lead to a situation where, if you are audited by Microsoft, you will be found to be out of compliance.
The feature request is this: configure Microsoft 365 so that "all users" or "all recipients in this domain" means "all licensed users for this product, excluding all who are not licensed for this product." Creating these dynamic groups and updating them based on adding or removing different license names from the tenant will add administrative overhead that I prefer to not have.
Matthew
