Exam SC-300 topic 1 question 1 discussion

There is not enough information in the question to provide a 100% correct answer. You can assign licences to any group created within the Azure AD portal. These can include security groups, Microsoft 365 groups, and either assigned or dynamic groups. You can even create a dynamic device security group and assign E5 licences to it, which doesn't make sense but is true (I've tested it). However, the missing bit of information is whether the Microsoft 365 groups have the "SecurityEnabled" attribute set to True. Only M365 groups that have the "SecurityEnabled" attribute set to True can have licences assigned to them. If the group is created in the M365 Admin Centre, then the "SecurityEnabled" attribute is set to False and you can not assign licences to the group. But if the M365 group is created in the Azure AD portal, then the "SecurityEnabled" attribute is set to True and you can assign licences. For the answer, I would make an assumption that because this is an Identity-related exam testing us on Azure AD topics, that the M365 groups were created in the Azure AD portal and therefore have the "SecurityEnabled" attribute set to True. Which means the correct answer is B - all groups.

Wrong, you can assign licenses to Microsoft 365 groups as well. The correct answer is E

Device groups, such as Dynamic Device groups, are not eligible for license assignments. Licenses can only be assigned to user-based groups like Security Groups, Mail-Enabled Security Groups, and Microsoft 365 Groups. You can assign a Microsoft Office 365 Enterprise E5 license directly to several types of groups: Security Groups: These groups are used to manage user and computer access to shared resources. Mail-Enabled Security Groups: These groups are similar to security groups but also have an email address. Microsoft 365 Groups: These groups provide collaboration features such as shared mailboxes, calendars, and document libraries

E is correct: Group1 (Security, Assigned) → ✅ Eligible Group2 (Security, Dynamic User) → ✅ Eligible Group3 (Security, Dynamic Device) → ❌ Not Eligible (Device groups cannot have licenses) Group4 (Microsoft 365, Assigned) → ✅ Eligible Group5 (Microsoft 365, Dynamic User) → ✅ Eligible

Group Type: Security groups: Can have licenses assigned. Microsoft 365 groups: Can have licenses assigned if securityEnabled = true. (This information is missing in the table, so by default, Microsoft 365 Groups are not considered security-enabled unless explicitly mentioned.) Membership Type: Both assigned and dynamic user memberships are supported for license assignment. Dynamic device memberships are not eligible, as licenses are for users, not devices.

You can assign licenses to any security group. https://learn.microsoft.com/en-us/entra/fundamentals/concept-group-based-licensing#features https://learn.microsoft.com/en-us/microsoft-365-apps/licensing-activation/device-based-licensing#steps-to-configure-device-based-licensing-for-microsoft-365-apps-for-enterprise

You cannot assign license to Dynamic Device group.

The Answer is E - you can't allocate a license to a device

If you have security groups, mail enabled groups, or Microsoft 365 groups, you can assign or unassign licenses for those groups on the Licenses page in the Microsoft 365 admin center. We refer to this as group-based licensing. https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-group-licenses?view=o365-worldwide

For those getting confused about Group 3. I have created a Security Group 'Dynamic Device' type and lisence attached (Microsoft 365 E5) to it, so answer B is correct, we could attached the E5 lisence directly to all groups

I've tested this and the most correct answer available should be C (Group1 and Group2 only). Even though MS documentation still says that licenses can be assigned to M365 groups if securityEnabled = True, it seems that's not the case anymore. I've created 2 M365 groups in Entra portal and i've confirmed fro MS Graph that these groups have the flag securityEnabled = true. However, from M365 admin centre, it's not possible to assign the licenses to these groups -> this means Group4 and Group5 are excluded. Regarding Group3, it's actually possible to assign the E5 license to a group that contains a device, even though it doesn't make much sense because this is targeted for users. Based on this, if there was an answer with Group1 Group2 and Group3 I would say it was the correct one. As we don't have it, Group1 and 2 should be correct answer -> C

I'm with the B camp, however there's not enough imformation here. But, any group which is mail enable and created in AZAD has securityEnabled: true be default, allowing licenses to be added the the required groups. See: https://docs.microsoft.com/en-us/graph/api/group-post-groups?view=graph-rest-1.0&tabs=http#request-body Security and O365 groups can have group based licenses assigned, see (under, Limitations and known issues): https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-group-advanced You can assign enterprise license to devices, see: https://docs.microsoft.com/en-us/microsoft-365/commerce/licenses/manage-licenses-for-devices?view=o365-worldwide

Answer should be "B". The question is simply asking "WHICH OF THESE GROUPS CAN BE ASSIGNED A LICENSE?" The answer, is ALL OF THEM. It doesn't matter if a Device Group can't USE an E5 license. That's not the question. The question is can the group be assigned the license. The answer is yes, yes it can. I tested in my lab env with E5 licensing. ALL GROUPS CAN BE ASSIGNED AN E5 LICENSE, regardless of if that license will be used properly. Of course, a device can't be assigned E5 licensing. That license wouldn't get used if assigned to a Device Group, BUT, you can still assign it to that group. B.

You can create a SG having devices, groups and users. So you can add a license to this group. AAD does not know if a SG has devices, groups or users. Of course the license will assigned only to the users of this group. So Group 3 is eligible. M365 groups have only users. Both groups can be assigned with a license.

The Membership Type and Members are just to confuse all of you. The question is "To which groups can you assign a Microsoft Office 365 Enterprise E5 license directly?" if you test this, you can assign this to any group created in Azure even groups with Azure AD roles set to yes

This qeuestion is one of Microsoft examples and right answer there is C. But this example question is 2 years old, so who knows....

The same question appears in offical SC-300 Measureup practice exam question 22 and answer is: Group 1 and group 2 only. Offical explanations: You can not assign licens to group 3 becvause it is a device group. You can not assign licenses to device groups. You can not assign licences to group 4 and group 5. YOu can not assign licences to Microsoft 365 groups.