Licensing Advent Calendar – Day 21 – Entra ID groups

We are reaching Christmas. A few more days for the Advent Calendar. Still, I have a lot to share. In this post, I will talk about user license recognition for users inheriting security role permissions via Microsoft Entra ID groups.

Entra ID groups

When the license enforcement was announced, a lot of questions were around the recognition of users without directly assigned security roles, but inheriting them from Entra ID groups. Before jumping into the details, you can learn about the Entra ID group integration using the next posts: How to use Azure Active Directory for managing users and security in Dynamics 365 for Finance and Operations. Note that Azure Active Directory is the old name for Microsoft Entra ID.

In the first versions of the licensing report, the Entra ID group members were not listed. This is because the tool was looking at directly assigned roles in Dynamics 365 F&O initially. Despite the users not being on the list, as an organization, you should be compliant. But how can you be compliant when not all users and security roles are on the list?

When the questions came for the first time, I had an answer ready. If you want to have the users embedded in the report, you can use the Enhanced Entra ID group integration, which is available in the D365FO Admin Toolkit. This toolkit was initiated by Alex Meyer, where I contributed to this open-source initiative by adding another way of integrating with Entra ID group memberships. The security roles were assigned via rules to the users, taking away some functional challenges, but also the licensing challenge. In the meantime, Microsoft promised to have a generic solution for the license reports.

The first step in the license report was reporting the Groups themselves as users. This was included in the report in October: New features User License Consumption report. The name of the group was not listed; a GUID ID was reported. You could find the group name in the Azure Portal by searching in Entra ID for the GUID value. The assigned roles were correct, but the users themselves were missing.

Current licensing reports

After the initial release, Microsoft added the users to an Entra ID group, but the details were not always consistent. Recently, during an office hour call, we concluded that Microsoft was not considering a hybrid approach when users got roles assigned both directly in Dynamics 365 F&O and via Entra ID groups. This seems to be corrected now, where all security roles are counted for the license calculation. Let’s have a look at an example.

Rosemary is assigned to several Groups via the Microsoft 365 admin center. These groups, except Power Automate, are set up in Dynamics 365 F&O.

In the Groups settings, the security roles are assigned. On this form, the fact box Users for group is part of the Enhanced Entra ID group integration (see above) and does not exist in a standard Dynamics 365 F&O environment.

Rosemary only has the System user role in the application, as this is the default role available when creating users. On the right side of the form, you can see that Rosemary is a member of two different Entra ID groups. Note that the fact box with Entra ID groups for user is like the screenshot above, part of the Enhanced Entra ID group feature.

With the assigned Entra ID groups, it is expected that Rosemary is reported to require both a Finance and a Project Operations license.

Also on the Licenses usage summary form, Rosemary is listed with the roles assigned via both Dynamics 365 F&O and Entra ID groups.

License enforcement

At this moment in time, the users with only Entra ID groups assigned are not part of the technical license validation starting January 15, 2026. This will be enforced, but later in time, as the most recent issues around the reporting for Entra ID group members have just been solved.

In case you are using the Enhanced Entra ID group integration, the users will have roles assigned in Dynamics 365 F&O and for that reason, will be part of the license enforcement. The features part of the Dynamics 365FO Admin toolkit also solves other functional challenges, as you can read in the above shared blogs.

There is more…

During the Advent period, each day in December, I will share some thoughts and tips related to the Dynamics 365 user license enforcement. If you have questions about this topic, feel free to contact me via LinkedIn, the comments section below, or the contact form on this blog. I will then either update one of the planned blogs for the coming 24 days or answer questions in a new post.

Dynamics 365 Licensing Enforcement Advent Calendar

I do hope you liked this post and will add value for you in your daily work as a professional. If you have related questions or feedback, don’t hesitate to use the Comment feature below.


That’s all for now. Till next time!