3.3 Licenses, Bulk Operations & Device Join

Licenses connect identity to capability

Many Microsoft Entra and Microsoft 365 capabilities that SC-300 depends on—Conditional Access, PIM, Identity Protection, Entitlement Management, dynamic groups historically, and more—are gated by licenses (for example Microsoft Entra ID P1/P2, Microsoft 365 E3/E5, EMS bundles). As an identity administrator you must assign, modify, remove, and report licenses correctly, not merely create users.

Assign, modify, and report licenses

Direct (per-user) assignment

In the Microsoft Entra admin center or Microsoft 365 admin center paths that surface license blades, you can:

• Assign one or more SKUs (product licenses) to a user.
• Enable or disable individual service plans inside a SKU (for example turn off a workload the user should not receive).
• Remove licenses during offboarding.
• Review which licenses a user currently holds.

Prerequisites that trip people up:

• Usage location must be set.
• The tenant must own available license units (purchased or trial seats).
• Conflicting service plans across SKUs can block assignment until conflicts are resolved.
• Synchronized users still receive cloud licenses in Entra/Microsoft 365; the license is a cloud assignment even when the identity is hybrid.

Reporting and operational hygiene

Administrators report on licenses to answer:

• Who has Entra ID P2?
• Are disabled accounts still consuming expensive SKUs?
• Which groups drive the largest license consumption under group-based licensing?

Portals, Graph (licenseDetails, group license annotations), and PowerShell are all valid. On the exam, emphasize intent: reclaim unused licenses, ensure users who need CA features actually have the SKU that includes them, and avoid assigning mutually exclusive plans incorrectly.

Group-based licensing concepts

Group-based licensing assigns product licenses to a security group. Direct members of that group inherit the license assignment automatically.

Benefits

• Joiner automation: add user to group → license appears.
• Mover automation: change dynamic membership → licenses follow attributes.
• Leaver automation: remove from group → license returned to the pool (after processing).
• Central change: update service-plan options on the group once, apply to all members.

Critical constraints

• Users should be direct members. Nested groups are not supported for group-based licensing.
• Members still need usage location.
• If the tenant lacks enough seats, some members show license errors until seats are added or membership is reduced.
• A user can receive licenses from multiple groups; the effective set is the combination, with conflict handling when plans collide.
• Prefer security groups (often dynamic) dedicated to licensing rather than overloading large collaboration Microsoft 365 groups, though product capabilities evolve—exam scenarios classically use security groups for GBL.

Design pattern

1. Create a security group per license bundle (for example LIC-M365-E5, LIC-Entra-P2).
2. Use dynamic rules aligned to HR attributes when possible.
3. Assign the SKU and required service plans to the group.
4. Monitor group licensing error blades for users missing usage location or conflicting plans.
5. Keep exception users in small assigned groups with change control.

Bulk operations: admin center and PowerShell

SC-300 expects familiarity with scale operations, not only single-object clicks.

Microsoft Entra admin center bulk patterns

Common bulk tasks:

• Bulk create users (CSV template).
• Bulk invite guests (CSV).
• Bulk delete users.
• Download users / export lists for offline analysis.
• Bulk add members to groups (where supported in UI or via exported workflows).

CSV templates enforce column names and formats. Failures usually come from invalid domains, duplicate UPNs, password complexity, or missing required fields such as usage location for follow-on licensing.

PowerShell and Graph at scale

Microsoft Graph PowerShell is the modern automation surface (legacy AzureAD/MSOL modules are retired paths—prefer Graph on current exams):

• New-MgUser, Update-MgUser, Remove-MgUser for lifecycle.
• License assignment cmdlets/APIs for SKU and service-plan management.
• Group membership updates for large cohorts.
• Directory queries for reporting.

Automation best practices the exam may allude to conceptually:

• Authenticate with least-privilege app or admin identity.
• Handle throttling and partial failure.
• Log object IDs and UPNs for audit.
• Prefer group-based licensing over per-user loops when the business rule is group-shaped.

Bulk ops are also how you stage offboarding waves (block sign-in in bulk, then remove licenses) and department reorgs (attribute updates feeding dynamic groups).

Device identities: join versus register

Devices have their own objects in Microsoft Entra ID. Understanding join type is essential because Conditional Access later grants or blocks access based on device state (require compliant device, require Hybrid Entra joined device, filters on device attributes).

Microsoft Entra join

• Device authenticates to cloud identity infrastructure.
• Supports cloud MDM enrollment (for example Intune) for compliance.
• Users sign in with Entra accounts; great for remote/cloud-native orgs.
• Device object appears as joined in Entra; can be targeted by CA device controls when combined with compliance.

Hybrid join

• Preserves on-premises domain join for legacy GPOs, print, NTLM/Kerberos line-of-business apps.
• Requires correct Entra Connect hybrid join setup (SCP configuration, OS support, sync of computer accounts as designed).
• Common CA control: require Hybrid Entra joined device for sensitive apps in enterprises mid-migration.
• Troubleshooting hybrid join is an admin skill adjacent to SC-300; exam focus is recognizing the state and its policy implications.

Registered devices (BYOD)

• User can access corporate resources under device registration without handing the device fully to corporate domain join.
• Often paired with app protection policies (MAM) rather than full device compliance.
• Weaker device trust signal than corporate join + compliance; many Zero Trust designs allow registered access only to lower-sensitivity apps or with session controls.

Device settings that matter for later Conditional Access

In tenant device settings (Entra device settings), administrators influence who can join or register devices:

• Whether users may join devices to Microsoft Entra (all users, selected, or none).
• Whether users may register their devices.
• Additional local administrator options on Entra joined devices.
• Enterprise State Roaming and related settings in broader device configuration (awareness level).

These settings interact with security posture:

Conditional Access linkage (preview of later chapters): policies can require device to be marked compliant (typically via Intune), require Hybrid Entra join, filter on device attributes, or block access from unknown device states. If devices are never joined or registered, those grants cannot be satisfied—users fall back to block or lesser access depending on policy design.

Putting licenses, bulk ops, and devices together

A realistic onboarding flow SC-300 wants you to visualize:

1. Create or sync the user; set usage location.
2. Add the user to dynamic or assigned groups for apps and group-based licenses.
3. User receives a corporate device that is Entra joined or hybrid joined, enrolls in MDM, becomes compliant.
4. Conditional Access allows Exchange/SharePoint/LOB only from compliant or hybrid-joined devices with MFA.

Or for contractors on BYOD:

1. Guest or member account as designed.
2. Limited licenses / access packages.
3. Entra registered device with session controls and app protection rather than full join.

Exam traps

• Assigning licenses without usage location or available seats.
• Expecting nested groups to carry group-based licenses.
• Confusing Entra joined (cloud join) with hybrid joined (AD + Entra) and registered (BYOD attachment).
• Believing registered BYOD automatically meets “require Hybrid Entra joined device.”
• Forgetting that bulk CSV create is only the identity step—licensing and group membership still must be designed.

/practice/azure-sc-300Practice questions with detailed explanations