Exam SC-300 topic 1 question 1 discussion

There is not enough information in the question to provide a 100% correct answer. You can assign licences to any group created within the Azure AD portal. These can include security groups, Microsoft 365 groups, and either assigned or dynamic groups. You can even create a dynamic device security group and assign E5 licences to it, which doesn't make sense but is true (I've tested it). However, the missing bit of information is whether the Microsoft 365 groups have the "SecurityEnabled" attribute set to True. Only M365 groups that have the "SecurityEnabled" attribute set to True can have licences assigned to them. If the group is created in the M365 Admin Centre, then the "SecurityEnabled" attribute is set to False and you can not assign licences to the group. But if the M365 group is created in the Azure AD portal, then the "SecurityEnabled" attribute is set to True and you can assign licences. For the answer, I would make an assumption that because this is an Identity-related exam testing us on Azure AD topics, that the M365 groups were created in the Azure AD portal and therefore have the "SecurityEnabled" attribute set to True. Which means the correct answer is B - all groups.

Wrong, you can assign licenses to Microsoft 365 groups as well. The correct answer is E

You cannot assign license to Dynamic Device group.

The Answer is E - you can't allocate a license to a device

If you have security groups, mail enabled groups, or Microsoft 365 groups, you can assign or unassign licenses for those groups on the Licenses page in the Microsoft 365 admin center. We refer to this as group-based licensing. https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-group-licenses?view=o365-worldwide

For those getting confused about Group 3. I have created a Security Group 'Dynamic Device' type and lisence attached (Microsoft 365 E5) to it, so answer B is correct, we could attached the E5 lisence directly to all groups

I've tested this and the most correct answer available should be C (Group1 and Group2 only). Even though MS documentation still says that licenses can be assigned to M365 groups if securityEnabled = True, it seems that's not the case anymore. I've created 2 M365 groups in Entra portal and i've confirmed fro MS Graph that these groups have the flag securityEnabled = true. However, from M365 admin centre, it's not possible to assign the licenses to these groups -> this means Group4 and Group5 are excluded. Regarding Group3, it's actually possible to assign the E5 license to a group that contains a device, even though it doesn't make much sense because this is targeted for users. Based on this, if there was an answer with Group1 Group2 and Group3 I would say it was the correct one. As we don't have it, Group1 and 2 should be correct answer -> C

I'm with the B camp, however there's not enough imformation here. But, any group which is mail enable and created in AZAD has securityEnabled: true be default, allowing licenses to be added the the required groups. See: https://docs.microsoft.com/en-us/graph/api/group-post-groups?view=graph-rest-1.0&tabs=http#request-body Security and O365 groups can have group based licenses assigned, see (under, Limitations and known issues): https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-group-advanced You can assign enterprise license to devices, see: https://docs.microsoft.com/en-us/microsoft-365/commerce/licenses/manage-licenses-for-devices?view=o365-worldwide

Answer should be "B". The question is simply asking "WHICH OF THESE GROUPS CAN BE ASSIGNED A LICENSE?" The answer, is ALL OF THEM. It doesn't matter if a Device Group can't USE an E5 license. That's not the question. The question is can the group be assigned the license. The answer is yes, yes it can. I tested in my lab env with E5 licensing. ALL GROUPS CAN BE ASSIGNED AN E5 LICENSE, regardless of if that license will be used properly. Of course, a device can't be assigned E5 licensing. That license wouldn't get used if assigned to a Device Group, BUT, you can still assign it to that group. B.

You can create a SG having devices, groups and users. So you can add a license to this group. AAD does not know if a SG has devices, groups or users. Of course the license will assigned only to the users of this group. So Group 3 is eligible. M365 groups have only users. Both groups can be assigned with a license.

The Membership Type and Members are just to confuse all of you. The question is "To which groups can you assign a Microsoft Office 365 Enterprise E5 license directly?" if you test this, you can assign this to any group created in Azure even groups with Azure AD roles set to yes

This qeuestion is one of Microsoft examples and right answer there is C. But this example question is 2 years old, so who knows....

The same question appears in offical SC-300 Measureup practice exam question 22 and answer is: Group 1 and group 2 only. Offical explanations: You can not assign licens to group 3 becvause it is a device group. You can not assign licenses to device groups. You can not assign licences to group 4 and group 5. YOu can not assign licences to Microsoft 365 groups.

E You can assign Azure AD P1 licenses to Group1, Group2, and Group 4 only. You can assign licenses to security groups containing users only or containing users and other groups. This includes both assigned and dynamic user groups. You can also assign licenses to Microsoft 365 Groups. You cannot assign Azure AD P1 licenses to Group3 because it is a device group. You cannot assign licenses to device groups.

In Microsoft Office 365, you can assign licenses directly to individual users or to groups. You can assign Microsoft Office 365 Enterprise licenses directly to the following groups: Security Groups: Distribution Lists (Mail-Enabled Groups) Office 365 Groups (Microsoft 365 Groups) Azure AD Groups: Azure Active Directory (Azure AD) groups can also be used for license assignment in Office 365. Assigning licenses to Azure AD groups works similarly to security groups. Dynamic Distribution Lists: You can also use dynamic distribution lists based on user attributes to assign licenses automatically to users who meet specific criteria.

Measure up have a near identical question Group 1 - Security - assigned user Group 2 - Security - dynamic user Group 3 - Security - dynamic device Group 4 - M365 - dynamic user Which groups can you assigned Azure AD Premium P1 licenses? Answer = Group 1 and 2 only Reasoning - You can assign licenses to security groups containing users only or user and other group. This includes both assigned and dynamic user groups. You cannot assign licenses to group 3 as it is device group. You cannot assign a license to group 4. You cannot assign licenses to M365 groups. Take what you will from that.... I will probably go with them but leave a comment on the question if it comes up.

You can use group-based licensing with any security group, which means it can be combined with Azure AD dynamic groups. Multiple licenses for the same product can overlap, and they result in all enabled services being applied to the user Group-based licensing currently does not support groups that contain other groups (nested groups). If you apply a license to a nested group, only the immediate first-level user members of the group have the licenses applied. The feature can only be used with security groups, and Microsoft 365 groups that have securityEnabled=TRUE. The Microsoft 365 admin center does not currently support group-based licensing. If a user inherits a license from a group, this license appears in the Office admin portal as a regular user license. If you try to modify that license or try to remove the license, the portal returns an error message. Inherited group licenses cannot be modified directly on a use So, you need to use PowerShell to change Normal Office 365 group to Office 365 security enabled #Elevate Office 365 group to security group Set-AzureADGroup -ObjectId XXX -SecurityEnabled:$true