'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Create Dynamic Groups Based on Microsoft 365 License Type
Question details
The user needs to create Microsoft Entra dynamic groups based on specific Microsoft 365 license types while excluding blocked or unlicensed users.
- Product
- Microsoft 365 / Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Creating dynamic user groups for managing access based on active subscription licenses.
- Observed behavior
- Microsoft Entra dynamic groups do not support using assigned Microsoft 365 licenses directly as membership-rule conditions.
Ensure you have the necessary administrator permissions in Microsoft Entra ID (formerly Azure AD) to create and edit dynamic group membership rules.
Use the assignedPlans Attribute for Dynamic Groups
Since direct license assignment cannot be used as a condition, you can use the assignedPlans attribute to query service plans associated with the license.
Dynamic groups in Microsoft Entra ID do not currently support membership rules based directly on the top-level assigned licenses (such as Microsoft 365 E3 or E5). Instead, they support rules based on the assignedPlans attribute, which targets the underlying service plans associated with those licenses.
Determine the GUID of the specific service plan included in your Microsoft 365 license that you want to target.
Log in to the Microsoft Entra admin center with at least a Groups Administrator role.
Navigate to Groups > All groups, select an existing dynamic group or create a new one, and set the Membership type to Dynamic User.
Open the Dynamic membership rules editor and use the assignedPlans property to check if it contains the specific service plan ID and ensure the capabilityStatus is 'Enabled'.
Add an 'and' condition to exclude disabled accounts by setting 'accountEnabled -eq true' in your rule syntax.
Looking for a Simpler Office Solution? Try WPS Office
While managing enterprise licenses and dynamic groups in Microsoft 365 can be complex, equipping your team with a reliable office suite doesn't have to be. WPS Office offers a free, lightweight, and highly compatible alternative to Microsoft Office, perfect for users who need core productivity tools without the overhead of complex license management.
- 1. Visit the Official Website: Go to the official WPS Office website to download the latest version for your operating system.
- 2. Install the Application: Run the installer and follow the simple on-screen instructions to complete the setup.
- 3. Start Working Immediately: Open WPS Office and start creating or editing your documents instantly.
Frequently Asked Questions
Can I use Microsoft 365 license names directly in dynamic group rules?
No, Microsoft Entra dynamic groups do not support membership rules based directly on assigned license names. You must use the assignedPlans attribute to target the specific underlying service plans.
What is the assignedPlans attribute?
The assignedPlans attribute is a property in Microsoft Entra ID that lists the underlying service plans associated with a user's assigned licenses. It is used in dynamic queries to filter users based on their active services.
How do I exclude blocked or disabled accounts from my dynamic group?
You can exclude blocked accounts by adding an additional condition to your dynamic membership rule, such as 'accountEnabled -eq true', which ensures only active users are added to the group.
