Exam SC-300 topic 1 question 1 discussion

There is not enough information in the question to provide a 100% correct answer. You can assign licences to any group created within the Azure AD portal. These can include security groups, Microsoft 365 groups, and either assigned or dynamic groups. You can even create a dynamic device security group and assign E5 licences to it, which doesn't make sense but is true (I've tested it). However, the missing bit of information is whether the Microsoft 365 groups have the "SecurityEnabled" attribute set to True. Only M365 groups that have the "SecurityEnabled" attribute set to True can have licences assigned to them. If the group is created in the M365 Admin Centre, then the "SecurityEnabled" attribute is set to False and you can not assign licences to the group. But if the M365 group is created in the Azure AD portal, then the "SecurityEnabled" attribute is set to True and you can assign licences. For the answer, I would make an assumption that because this is an Identity-related exam testing us on Azure AD topics, that the M365 groups were created in the Azure AD portal and therefore have the "SecurityEnabled" attribute set to True. Which means the correct answer is B - all groups.

Wrong, you can assign licenses to Microsoft 365 groups as well. The correct answer is E

Chat GPT: To determine which groups you can assign a Microsoft Office 365 Enterprise E5 license directly, you need to understand that only Microsoft 365 groups with either: Assigned membership, or Dynamic user membership ...are eligible for direct license assignment in Azure AD.

Answer: D. User1 and User2 only, Users can be added to groups regardless of licence state. Licences assigned through group-based licensing are applied once the user is a member of the group

Answer is E. You cannot assign an E5 license to a device or a device group as they must be assigned to a user only. You can assign other licenses that are device based licensing for certain products (like 365 apps for enterprise) for shared devices so any user can use the apps etc.

"There are Microsoft 365, Office 365, and Windows licenses - These licenses are assigned to a Microsoft Entra user or group to grant them access to use Office or Windows products. You need one license for each user who needs access to Windows and / or office." Keywords: user, define identity licensing Source: https://docs.google.com/document/d/1oNH9i2ssNi9gISG3JGuxUoUhmAA4xCaGahEKv2dRN6Y/edit?usp=sharing

"There are Microsoft 365, Office 365, and Windows licenses - These licenses are assigned to a Microsoft Entra user or group to grant them access to use Office or Windows products. You need one license for each user who needs access to Windows and / or office." Keywords: user, define identity licensing Source: https://learn.microsoft.com/en-us/training/modules/explore-identity-azure-active-directory/11-define-identity-licensing

Tested this per 15-03-2025: all groups were created in Entra ID. License assignments however need to be done in the 365 admin center, I could assign a license to all the groups. However, when the Microsoft 365 groups are created in the M365 admin center, you cannot assigned a license to the group. sezza_blunt's post is the most accurate and therefor I would vote for B as well.

Device groups, such as Dynamic Device groups, are not eligible for license assignments. Licenses can only be assigned to user-based groups like Security Groups, Mail-Enabled Security Groups, and Microsoft 365 Groups. You can assign a Microsoft Office 365 Enterprise E5 license directly to several types of groups: Security Groups: These groups are used to manage user and computer access to shared resources. Mail-Enabled Security Groups: These groups are similar to security groups but also have an email address. Microsoft 365 Groups: These groups provide collaboration features such as shared mailboxes, calendars, and document libraries

E is correct: Group1 (Security, Assigned) → ✅ Eligible Group2 (Security, Dynamic User) → ✅ Eligible Group3 (Security, Dynamic Device) → ❌ Not Eligible (Device groups cannot have licenses) Group4 (Microsoft 365, Assigned) → ✅ Eligible Group5 (Microsoft 365, Dynamic User) → ✅ Eligible

Group Type: Security groups: Can have licenses assigned. Microsoft 365 groups: Can have licenses assigned if securityEnabled = true. (This information is missing in the table, so by default, Microsoft 365 Groups are not considered security-enabled unless explicitly mentioned.) Membership Type: Both assigned and dynamic user memberships are supported for license assignment. Dynamic device memberships are not eligible, as licenses are for users, not devices.

You can assign licenses to any security group. https://learn.microsoft.com/en-us/entra/fundamentals/concept-group-based-licensing#features https://learn.microsoft.com/en-us/microsoft-365-apps/licensing-activation/device-based-licensing#steps-to-configure-device-based-licensing-for-microsoft-365-apps-for-enterprise

You cannot assign license to Dynamic Device group.

The Answer is E - you can't allocate a license to a device

If you have security groups, mail enabled groups, or Microsoft 365 groups, you can assign or unassign licenses for those groups on the Licenses page in the Microsoft 365 admin center. We refer to this as group-based licensing. https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-group-licenses?view=o365-worldwide

For those getting confused about Group 3. I have created a Security Group 'Dynamic Device' type and lisence attached (Microsoft 365 E5) to it, so answer B is correct, we could attached the E5 lisence directly to all groups

I've tested this and the most correct answer available should be C (Group1 and Group2 only). Even though MS documentation still says that licenses can be assigned to M365 groups if securityEnabled = True, it seems that's not the case anymore. I've created 2 M365 groups in Entra portal and i've confirmed fro MS Graph that these groups have the flag securityEnabled = true. However, from M365 admin centre, it's not possible to assign the licenses to these groups -> this means Group4 and Group5 are excluded. Regarding Group3, it's actually possible to assign the E5 license to a group that contains a device, even though it doesn't make much sense because this is targeted for users. Based on this, if there was an answer with Group1 Group2 and Group3 I would say it was the correct one. As we don't have it, Group1 and 2 should be correct answer -> C