Resolving Microsoft 365 Group-Based Licensing Issues for Users

AB-900 By islever Editorial Last updated

Identify the core security features of Microsoft 365 services

Short answer

AD Add User1 to Group1 or assign a license directly to User1 to grant Microsoft 365 E3 access.

Question

Your organization has a Microsoft 365 subscription.
You create a security group named Group1 and assign a Microsoft 365 E3 license to the group.
You discover that a user named User1 does NOT have access to the Microsoft 365 E3 features.
You need to ensure that User1 can access all the Microsoft 365 E3 features.
Which two actions can you perform? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
  1. Add User1 to Group1. Correct Answer
  2. Assign a Conditional Access policy to Group1.
  3. Assign a Conditional Access policy to User1.
  4. Assign a license to User1. Correct Answer

Key Takeaways

Group-based licensing requires membership; Conditional Access policies do not grant licenses.

Learn how to fix missing Microsoft 365 E3 access by adding users to licensed groups or assigning direct licenses. This guide covers AB-900 licensing troubleshooting.

Common mistake: Choosing Conditional Access policies (B/C) because they sound like 'access' fixes, but they only control resource entry, not license entitlement.

Expert Analysis

The core issue here is Microsoft 365 group-based licensing mechanics. When a license (E3) is assigned to a security group, that license is inherited by all members of the group. User1 lacks access because they are not currently a member of Group1.

The most attractive but wrong approach involves Conditional Access policies (Options B and C). Conditional Access controls access to resources based on conditions like location or device compliance; it does not grant software licenses or entitlements. Assigning a CA policy cannot give User1 an E3 license if they don't have one.

To solve this, you must either provide the license directly or ensure inheritance works correctly. Adding User1 to Group1 (Option A) allows them to inherit the E3 license from the group assignment. Alternatively, assigning the license directly to User1 (Option D) bypasses the group entirely and grants immediate access. Both actions result in User1 having the necessary E3 features.

Exam Strategy

When troubleshooting license issues, distinguish between 'entitlement' (having the product) and 'access' (entering the service). If a user is missing a product feature, check their license assignment first (direct or via group membership). Do not jump to Conditional Access unless the license is confirmed present but access is blocked by policy.

Frequently Asked Questions

Does Conditional Access grant Microsoft 365 licenses?

No. Conditional Access policies control who can access resources based on conditions. They do not assign or grant software licenses.

How long does group-based licensing take to apply?

It typically takes up to 24 hours, though it often happens within minutes. Direct assignment is usually instantaneous.

More AB-900 FAQ →

Community Votes

A
50%
D
50%

50% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. omath 👍 4
    A. Add User1 to Group1. Yes — this is the intended solution. Group-based licensing works only if the user is a member of the licensed group. D. Assign a license to User1. Yes — this is the direct fallback. If group-based licensing isn’t working or you need immediate access, you can assign the license directly to the user.
  2. AnonymousJhb 👍 2
    Correct
  3. DieFear 👍 1
    The question is only about accessing to the license, the other two are not valid answers

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Entra ID Security Group Capabilities and Exchange Mailbox Permissions

S-grade

Microsoft 365 Global Reader Role Permissions Analysis

S-grade

Configuring App Registrations for Third-Party Authentication in Microsoft Entra ID

S-grade

Exchange Admin Center Tasks: Mail Flow Rules and Shared Mailboxes

A-grade

← Back to AB-900 Study Guide