Azure AD Group Licensing with Nested Groups

SC-300 By islever Editorial Last updated

Create, configure, and manage Microsoft Entra identities

Short answer

B Assigning the license to Group1 uses 2 licenses because only direct user members (User1 and User2) are licensed, not nested group members.

Question

You have an Azure Active Directory (Azure AD) tenant that contains the following objects.
✑ A device named Device1
✑ Users named User1, User2, User3, User4, and User5
Five groups named Group1, Group2, Group3, Group4, and Group5
[sampleXML/xmlfile-29_3.png]
The groups are configured as shown in the following table.
[sampleXML/xmlfile-30_1.png]
How many licenses are used if you assign the Microsoft 365 Enterprise E5 license to Group1?
  1. 0
  2. 2 Correct Answer
  3. 3
  4. 4

Key Takeaways

The core concept tested is the non-inheritance of licenses in nested groups; the common trap is assuming all users within any member group (direct or nested) receive the license.

This question tests the limitations of Microsoft Entra ID group-based licensing, specifically regarding nested groups. It establishes that licenses are only assigned to direct user members and do not propagate through group nesting.

Common mistake: Many learners incorrectly choose D (4) by counting User1, User2, User3, and User5, mistakenly including User4 who is a member of Group4 rather than directly in Group1.

Expert Analysis

Why the Answer Is Correct

Group-based licensing in Microsoft Entra ID applies licenses only to users who are immediate members of the target group. It does not support nested groups for license assignment. In this scenario, Group1 has two direct user members: User1 and User2. Therefore, assigning an E5 license to Group1 results in exactly 2 licenses being used.

Why the Other Options Are Wrong

Option C (3) might be chosen if one incorrectly includes User3 from Group3, but Group3 is not a member of Group1. Option D (4) is incorrect because it counts User4 (member of Group4) and potentially misinterprets the hierarchy. Group4 cannot actually be a member of Group1 due to type restrictions (Microsoft 365 vs Security), but even if valid, its members wouldn't inherit licenses anyway.

Community Comment Notes

Community consensus strongly supports B, citing that 'nested group do not inherit licenses'. Several comments correctly point out that 'M365 Group can not be member of Security Group', which technically invalidates the premise of Group4 being in Group1, but the primary licensing rule remains the decisive factor for the exam context.

Official Reference

https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-group-advanced#limitations-and-known-issues

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always distinguish between direct membership and nested membership when calculating license usage. Remember that group-based licensing is flat; it does not traverse group hierarchies.

Frequently Asked Questions

Do nested groups inherit licenses in Azure AD?

No, group-based licensing does not support nested groups. Only immediate user members of the target group receive licenses.

Can a Microsoft 365 Group be a member of a Security Group?

Generally no, as they serve different purposes. However, the key exam point here is that even if allowed, nested members don't get licenses.

More SC-300 FAQ →

Discussion 36 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 36

  1. gills 👍 71
    The answer is simple. Answer is correct. Why? Because nested group do not inherit licenses.
  2. Dobby_41 👍 36
    Group 4 cannot be a member of group 1.
  3. sapien45 👍 6
    Good catch
  4. TBRate3w254325 👍 5
    Answer B is correct. Funny thing...Microsoft goofed on the scenario. Group 1 can't have Group 4 as a member... Microsoft 365 Groups can't be members of security groups https://docs.microsoft.com/en-us/microsoft-365/admin/create-groups/compare-groups?view=o365-worldwide
  5. Domza 👍 5
    no Group nesting is supporting while assigning licenses - users only
Show 25 more comments
  1. SuperMax 👍 4
    According to: https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-group-advanced --> Limitations and known issues: - Group-based licensing currently does not support groups that contain other groups (nested groups). If you apply a license to a nested group, only the immediate first-level user members of the group have the licenses applied. - The feature can only be used with security groups, and Microsoft 365 groups that have securityEnabled=TRUE.
  2. ubt 👍 4
    This is a Copilot answer which is incorrect, it thinks nested groups will take the licence too, if you ask it for an article to proove it, it will give you an article that actually shows you its incorrect
  3. RahulX 👍 4
    B: 2 licenses, because nested group do not inherit licenses and M365 Group can not be member of Security Group.
  4. olnn 👍 4
    correct but why group4 is member of group1?
  5. Ed2learn 👍 3
    I don't know when the change was made but at one point you could only assign licenses to security groups - not Microsoft groups. The purpose of microsoft groups were for collaboration (sharing resources). Security groups were for boundaries. Tested in lab - you may NOT add groups to M365 groups. You may add Security groups to a security group but not add a M365 to a security group. If Security group 1 has user one and an E5 license is assigned to the group and you join security group 2 with user 2 and assign Power BI (for example) to the group- User one will only have E5 and user 2 will only have Power BI license.
  6. Lion007 👍 3 Answered B
    Correct, answer is B. "Group-based licensing currently does not support groups that contain other groups (nested groups). If you apply a license to a nested group, only the immediate first-level user members of the group have the licenses applied." https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-group-advanced#limitations-and-known-issues
  7. f2bf85a 👍 3 Answered B
    It doesn't affect the correct answer, but M365 Groups (Group4) cannot be contained to other groups. This example showing that Group1 contains Group4 is wrong. https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/how-to-manage-groups#add-or-remove-a-group-from-another-group
  8. AlexBrazil 👍 3 Answered B
    Agreed: "Group-based licensing currently does not support groups that contain other groups (nested groups). If you apply a license to a nested group, only the immediate first-level user members of the group have the licenses applied."
  9. allgiga 👍 3
    Correct. B Group-based licensing currently does not support groups that contain other groups (nested groups)
  10. jojoseph 👍 3
    B. nested group do not inherit licenses
  11. Sh1rub10 👍 3 Answered B
    nested group do not inherit licenses
  12. EmnCours 👍 2 Answered B
    Group-based licensing currently doesn't support groups that contain other groups (nested groups). If you apply a license to a nested group, only the immediate first-level user members of the group have the licenses applied.
  13. srysgbvjumozmail 👍 2
    Group4 (MS365) in Group1(Security) is it possible? contraduction with Topic1-Question9
  14. GPerez73 👍 2 Answered B
    Correct B. Tested
  15. dule27 👍 2 Answered B
    B: 2 licenses
  16. melatocaroca 👍 1
    Use group-based licensing with dynamic groups You can use group-based licensing with any security group, which means it can be combined with Azure AD dynamic groups. Dynamic groups run rules against user resource attributes to automatically add and remove users from groups. For example, you can create a dynamic group for some set of products you want to assign to users. Each group is populated by a rule adding users by their attributes, and each group is assigned the licenses that you want them to receive. You can assign the attribute on-premises and sync it with Azure AD, or you can manage the attribute directly in the cloud. Licenses are assigned to the user shortly after they are added to the group. When the attribute is changed, the user leaves the groups and the licenses are removed. https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-group-advanced
  17. Lilianeze 👍 1 Answered C
    When you assign a Microsoft 365 Enterprise E5 license to Group1, the license will apply to all users within the group — not devices, and not duplicated if the user already has it assigned elsewhere. Let’s break it down: Group1 Members: User1 ✅ (counts — not licensed yet) User3 ✅ (counts — not licensed yet) Group2 (Dynamic User group) contains User2 ✅ (counts — not licensed yet) Group4 (Microsoft 365 group) contains User4 ❌ (already licensed via Group4, doesn’t count again) User5 is not part of Group1 — ❌ ignore Device1 is not a user — ❌ ignore User4 already has a license — ❌ ignore Group2 and Group4 are containers, only their user members count ✅ So the unique users who will consume the license via Group1: User1 User2 User3 That’s 3 licenses used.
  18. melatocaroca 👍 1
    Group1 contain User1, User3, Group2, Group4, So one license for User1, one for User3, one for the user within group2, user2, So IMHO 3 licenses Group-based licensing currently does not support groups that contain other groups (nested groups). If you apply a license to a nested group, only the immediate first-level user members of the group have the licenses applied. That discard Group4, from getting a license from group 1
  19. AmazingKies 👍 1
    roup-based licensing currently does not support groups that contain other groups (nested groups). If you apply a license to a nested group, only the immediate first-level user members of the group have the licenses applied. https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-group-advanced#limitations-and-known-issues
  20. WS_21 👍 1 Answered B
    https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-group-advanced#limitations-and-known-issues
  21. Futfuyfyjfj 👍 1
    The er is no 1 option amongst the possible answer options right?
  22. louismt 👍 1 Answered B
    Nested groups are not supported with group based licensing.
  23. ANDRESCB1988 👍 1
    correct, nesting is not support to assing license
  24. test123123 👍 1 Answered B
    Nested group do not inherit licenses.
  25. Domza 👍 1
    to make sure you know your stuff :)

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How Long Are Microsoft Entra Risky User Activity Logs Retained?

S-grade

Azure User-Assigned Managed Identity Regional Scope

S-grade

Which role for the Permissions Management service principal?

S-grade

Prerequisite for Microsoft Defender for Cloud Apps Session Policy

S-grade

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide