Tailspin Toys has 500 employees who all need Microsoft 365 E3 licenses. The IT admin wants to ensure that when new employees are added to the 'Sales Department' Azure AD security group, they automatically and immediately receive a Microsoft 365 E3 license — without any manual intervention. What feature should the admin configure to achieve this?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Think of group-based licensing like a membership club card — the moment you join the Sales Department group, the license is automatically handed to you. Microsoft Entra ID watches the group and handles it in real time. A nightly PowerShell script could work, but that's like having a cashier manually check the member list every morning instead of scanning a card.
Full explanation below image
![Portrait infographic (2048x1536) with a dark blue (#002050) background and white/blue/purple accents. Title at top: 'Group-Based Licensing in Microsoft Entra ID' in white bold text. Center of infographic: A large circle/badge representing the 'Sales Department' security group in Microsoft Entra (blue #0078D4 color, with a people/group icon). Attached to the group circle is a license badge showing 'Microsoft 365 E3' in purple (#7719AA). From the group circle, four arrows point outward to user avatar icons (generic silhouette icons) each showing a small green checkmark and a license badge — labeled 'Auto-assigned ✓'. At the bottom of that section, show a new user avatar with a '+' icon being added to the group, and an arrow showing 'License assigned within minutes' pointing to the same licensed avatar. On the right side, a step-by-step path diagram: Microsoft Entra admin center icon → Identity → Billing → Licenses → All products → Microsoft 365 E3 → [Assign to group button] → Sales Department group. At the bottom of the infographic, a comparison bar: LEFT side (red X): 'Nightly PowerShell Script — 8-24hr delay, manual, error-prone'; RIGHT side (green checkmark): 'Group-Based Licensing — Real-time, automated, built-in'. Blue #0078D4 and purple #7719AA Microsoft color scheme throughout.](/media/microsoft/ab-650/AB-650-e1-q003-infographic.webp)
Full Explanation
Correct Answer — B: Group-based licensing in Microsoft Entra ID by assigning the Microsoft 365 E3 license directly to the 'Sales Department' security group
Group-based licensing is a built-in Microsoft Entra ID (Azure AD) feature that allows administrators to assign one or more Microsoft 365 or Azure service licenses to a security group. Any user who is a member of that group — including nested group members — automatically inherits the licenses assigned to the group. When a new employee is added to the 'Sales Department' group, Entra ID detects the membership change and assigns the Microsoft 365 E3 license within minutes. Similarly, when a user is removed from the group, the license is automatically reclaimed. This is configured in the Microsoft Entra admin center under Identity > Billing > Licenses > All products — select the product, then assign it to the group. Note: group-based licensing requires at minimum a Microsoft Entra ID P1 license (included in Microsoft 365 E3 and above).
Why A is wrong — A nightly PowerShell script: While a scheduled PowerShell script using the Microsoft Graph API or MSOnline module could technically accomplish license assignment, it is not the recommended or modern approach. The critical flaw is timing: a script running nightly means a new employee added to the group at 9 AM won't receive their license until the script runs that night — potentially an 8–24 hour delay. Group-based licensing is real-time, automated, and built-in. Microsoft's best practice guidance explicitly recommends group-based licensing over scripted approaches for exactly this reason.
Why C is wrong — Bulk license assignment via CSV: Bulk license assignment using the CSV export/import feature in the Microsoft 365 admin center is a one-time administrative action used for mass initial assignments. It does not create any ongoing automation — each time a new employee joins, the admin would need to manually run another bulk operation. This approach solves a one-time problem, not the ongoing automation requirement described in the scenario.
Why D is wrong — Enterprise Applications > Assign users and groups: Assigning a group to an Enterprise Application in Microsoft Entra ID grants members of that group access to a specific SaaS application (for example, Salesforce, ServiceNow, or a custom app integrated with Entra ID via SAML/OIDC). This controls application access permissions, not Microsoft 365 license assignments. Microsoft 365 E3 is a license product, not an Enterprise Application, and license assignment is managed through the Licenses blade, not Enterprise Applications.
Exam Tip: Group-based licensing is a key exam topic for any Microsoft 365 administrator certification. Remember: (1) it requires Entra ID P1 or higher (included in M365 E3+); (2) it works with security groups and Microsoft 365 groups but NOT distribution lists; (3) license conflicts (not enough licenses available) generate an error state visible in the group's licensing blade; (4) it is the recommended Microsoft approach for automated license management at scale.