'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Move Microsoft 365 E3 Licensing to a Synchronized Security Group
Question details
The user needs to migrate users from direct Microsoft 365 E3 license assignments to group-based licensing via an on-premises security group synchronized with Microsoft Entra ID.
- Product
- Microsoft 365 / Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Transitioning organizational licensing models from individual assignments to group-based management.
- Observed behavior
- Users currently hold direct Microsoft 365 E3 licenses, and the goal is to successfully manage their licenses through a synchronized security group without service interruption.
Ensure you have Global Administrator or License Administrator permissions in Microsoft Entra ID, and confirm your on-premises security group is actively synchronizing with the cloud.
Transition to Group-Based Licensing in Microsoft Entra ID
Assign licenses to the synchronized security group and validate the assignments before removing individual licenses to prevent service disruption.
When migrating from direct to group-based licensing, the transition must be handled carefully to avoid dropping service access for active users. Both assignments will temporarily coexist until the direct assignment is explicitly removed.
Log in to the Microsoft Entra admin center. Navigate to 'Billing' > 'Licenses', select the Microsoft 365 E3 product, and click 'Assign'. Select your synchronized on-premises security group and configure the appropriate service plans.
Wait for Microsoft Entra ID to process the license changes. Check the 'Licensed users' tab within the group's profile to confirm all members show a 'State' of 'Active'.
Once group licenses are confirmed active, go to 'Users' > 'All users', select the affected users, and remove their direct Microsoft 365 E3 license assignments. Their access will seamlessly fall back to the group-based assignment.
Looking for a cost-effective alternative to Microsoft 365 E3?
Managing complex Microsoft 365 enterprise licenses can be expensive and time-consuming. WPS Office provides a highly compatible, free, and lightweight alternative for your organization's document creation needs without the overhead of enterprise subscription management.
- 1. Download WPS Office: Visit the official WPS Office website and download the free installation package suitable for your operating system.
- 2. Install the Suite: Run the installer and follow the quick on-screen instructions to deploy WPS Office on your workstation.
- 3. Open Your Documents: Launch WPS Office and immediately open your existing Microsoft Office files without needing any cloud license assignment.
Frequently Asked Questions
Will users experience downtime when switching to group-based licensing?
No, as long as you assign the Microsoft 365 E3 license to the security group and wait for processing to complete before removing the direct assignment, users will not experience any service interruption.
Can I use an on-premises security group for Microsoft 365 licensing?
Yes, provided the on-premises security group is properly synchronized to Microsoft Entra ID (formerly Azure AD) using Entra Connect. The group can then be assigned licenses in the cloud.
What happens if a user is removed from the synchronized security group?
If a user is removed from the group and they do not have a direct license assignment or membership in another licensed group, their Microsoft 365 E3 license will be automatically revoked.
How do I check if a user's license is direct or inherited?
In the Microsoft Entra admin center, navigate to the user's profile, click on 'Licenses', and check the 'Assignment paths' column. It will indicate whether the license is 'Direct' or 'Inherited' from a specific group.
