14.3 License Management
Key Takeaways
- Buying a subscription creates a pool of seats; users cannot use Microsoft 365 until an admin assigns a license — from Users > Active users (person-first) or Billing > Licenses (product-first).
- Group-based licensing assigns a product to a security group, mail-enabled group, or Microsoft 365 group so membership drives who gets the seat; nested groups are not supported.
- A product name (Microsoft 365 E3) is a bundle of service plans (Exchange Online, Teams, SharePoint). Admins can turn individual apps and services off without removing the whole product.
- Removing a license holds Exchange Online mailbox data for 30 days, then deletes it unless a retention policy, retention label, or inactive mailbox preserves it; OneDrive files are not deleted merely because the license was removed.
- Self-service purchase lets users buy some products with their own payment method; tenant admins can allow, allow trials only, or block it, and they cannot assign those seats until they take over the subscription.
Quick Answer: Assign and unassign licenses in the Microsoft 365 admin center on Users > Active users or Billing > Licenses. Use group-based licensing when membership should drive the seat. A product is the SKU you bought; service plans are the apps inside it. Remove a license and Exchange Online data is held 30 days; OneDrive is not deleted until the user account is deleted. Self-service purchase is optional and admin-controlled.
The April 30, 2025 outline asks you to describe license management. Section 14.1 was who you buy from. Section 14.2 was how you pay. This section is who may use what you already own. Official Microsoft language is blunt: a license allows a specific user account to use the services in a SaaS subscription. Contoso can own 100 Microsoft 365 E5 licenses and still have 20 people who cannot open Outlook because nobody assigned the seat.
Assign and unassign — two doors, one job
You must be at least a License Administrator or User Administrator to assign licenses (group-based licensing also allows a Groups Administrator). You do not need Global Administrator to hand Adele a Business Standard seat.
Official admin-center paths:
- Users > Active users — open one person, Licenses and apps, check the product. Or multi-select people and Manage product licenses. This is the person-first door: “Adele needs email.”
- Billing > Licenses — open a product, Assign licenses, type users or groups (up to 20 at a time in that panel). This is the product-first door: “We have 12 unused E3 seats — who should get them?”
You can also create a user and assign a license in the same wizard. You can delete a user to return the seat immediately to the pool. Unassigning a license from a living account also returns the seat, without deleting the identity.
Usage location is not optional trivia. Some Microsoft services are not available in every country. Before a license can be assigned, the admin must set the user’s location. For group-based licensing, users without a location inherit the tenant location. If you have people in more than one country, set location when you create the account.
The Licenses page can aggregate the same product across subscriptions (five Business Premium seats on one order plus eight on another show as 13). Your products still lists each subscription separately. That is inventory math, not two different products.
Dedicated admin-only accounts that only reset passwords or manage SharePoint often do not need a Microsoft 365 productivity license. Official hierarchy guidance calls that out as a security practice: the SharePoint administrator account does not require an E5 just to open the SharePoint admin center.
| Door | Where in the admin center | Best when | What you pick |
|---|---|---|---|
| Person-first | Users > Active users > Licenses and apps | One hire, one offboard, or a short list of names | Products for those people |
| Product-first | Billing > Licenses | “Who should get these unused E3 seats?” | Users or groups for one product |
| Membership-first | Billing > Licenses assigned to a group | A department or role should stay licensed as people join and leave | A security, mail-enabled, or Microsoft 365 group |
Group-based licensing
If you have security groups, mail-enabled groups, or Microsoft 365 groups, you can assign the product to the group. Microsoft calls this group-based licensing. New members receive the license; removed members lose it when processing finishes.
Rules the exam will respect:
- Nested groups are not supported. Only users in the first-level group receive the license.
- On Licenses, a group assignment shows the group name, not every member. Open Teams & groups to see who is inside.
- Large groups (official example: on the order of 100,000 users) can take a long time to process.
- When you move a user from one licensed group to another, add them to the destination first, confirm the new license, then remove them from the source. Removing first can cause a brief (or not-so-brief) outage while the new assignment processes.
- Common assignment errors: no available licenses, conflicting service plans, missing dependencies, invalid usage location. The product’s Errors & issues tab lists who failed and lets you Reprocess after you fix the cause.
Auto-claim policies are a related automation: the tenant can automatically assign certain product licenses when a user first uses an app. They are not a replacement for knowing manual and group assignment; they are another official way seats get claimed.
Product names versus service plans
In the admin center you see friendly product names such as Microsoft 365 E3 or Microsoft 365 Business Premium. Under the hood, Microsoft Entra licensing also knows a string ID (for example ENTERPRISEPACK for Office 365 E3) and a GUID. MS-900 will not ask you to recite GUIDs. It will ask you to know that a product is a bundle of service plans.
A service plan is an individual workload inside the product: Exchange Online, SharePoint, Teams, Microsoft Intune, and so on. When you assign a product you can Turn apps and services on or off so a contractor gets Exchange and Teams but not Power BI, even though the SKU contains Power BI. Turning a service plan off is not the same as unassigning the product, and it is not the same as buying a different SKU.
Conflicting service plans are why two similar products cannot always sit on the same user. The admin center reports that as an assignment error, not as a mystery outage.
What happens when you remove a license
Official Microsoft 365 admin documentation is the wording to trust:
- Exchange Online data associated with the account is held for 30 days. After that grace period, the data is deleted and cannot be recovered, except that content covered by a retention policy or retention labels is retained for discovery.
- After the license is removed, the mailbox is no longer searchable with Content Search or eDiscovery (Premium) unless other preservation applies.
- OneDrive files are not deleted just because you removed the license. They stay until the user is deleted from the Microsoft 365 admin center or removed through Active Directory synchronization. Official OneDrive retention guidance repeats the same idea: blocking sign-in or removing the license does not start the deleted-user OneDrive cleanup clock. Unlicensed OneDrive accounts are separately archived on their 93rd unlicensed day; that archive rule is not the same as the 30-day deleted-user recycle path.
- If the user still has Microsoft 365 Apps installed, the desktop apps show unlicensed product / activation errors.
- Enterprise subscriptions such as Office 365 / Microsoft 365 E3 can preserve a deleted user’s mailbox as an inactive mailbox when the organization uses that compliance feature.
Deleting the user account is a different story from deleting the license. Delete the user and the license is immediately free for someone else, while mailbox and OneDrive retention clocks for a deleted identity start (OneDrive’s default deleted-user retention is also 30 days and can be changed in the SharePoint admin center).
Self-service purchase
Self-service purchase lets individual users buy certain products (historically including Power Platform, Project, and Visio families — the eligible list is per product) with their own payment method. They manage that subscription in a limited admin-center view. Tenant admins cannot assign or unassign those seats until they take over the purchase or trial.
Admins govern the feature under Settings > Org settings > Services > Self-service trials and purchases. Per product they can Allow, Allow for trials only, or Do not allow. New products default to allowing self-service. This is license management because it creates seats the central IT team did not purchase — visibility is in Billing, control is the org setting, and assignment stays with the purchaser until takeover.
Realistic exam-style scenarios
New hire. HR asks IT to give Adele email today. That is Users > Active users (or the add-user wizard) plus a product license — not Marketplace (unless you are out of seats) and not office.com.
Department move. All nurses should receive Microsoft 365 F3 when they join the Nurses group. That is group-based licensing. Do not nest Nurses inside Clinical and expect the nested group to license automatically.
Contractor should not get Power BI. Assign the suite and turn the Power BI service plan off, or assign a product that never included it. Do not delete the user.
Offboarding, keep the identity for a week. Unassign the license. Expect the 30-day Exchange hold. Do not tell legal that OneDrive is already gone — it is not, until the account is deleted (and even then a retention period applies).
Someone bought Visio on a personal card. IT can see it under self-service products. They cannot reassign that seat until they take over the subscription or they block future self-service in org settings.
Exam traps
- Owned ≠ assigned. A pile of unused E3 seats does not mail-enable anyone.
- Removing a license is not deleting the user. Mailbox hold and OneDrive survival differ.
- The 30-day figure is Exchange Online after license removal. Do not invent a different day count, and do not apply those 30 days to OneDrive license removal.
- Group-based licensing does not nest. First-level members only.
- Product ≠ service plan. Turning off Teams inside E3 is not “they no longer have E3.”
- Self-service seats are not centrally assignable until takeover.
- Usage location errors look like “licensing is broken.” Set the location.
Official sources
- Assign or unassign licenses — Active users and Licenses pages; 30-day Exchange hold; OneDrive not deleted until the user is deleted; self-service takeover note
- Assign or unassign licenses to a group — group-based licensing; no nested groups; usage location
- Product names and service plan identifiers — product name versus service plans
- Subscriptions, licenses, accounts, and tenants — a license enables one user on a SaaS subscription
- OneDrive retention and deletion — license removal does not start deleted-user OneDrive cleanup; unlicensed archive on day 93
- Manage self-service purchases and trials — Allow / trials only / Do not allow
- Study guide for Exam MS-900 — license management
Contoso bought 50 Microsoft 365 Business Standard licenses last week, but a new employee still cannot open Outlook on the web. What license-management step is still missing?
A hospital wants every account that joins the Nurses security group to receive a Microsoft 365 F3 license automatically, and to lose that license when the person leaves the group. Which capability is that?
An administrator removes a Microsoft 365 license from a user but does not delete the user account. According to official Microsoft 365 admin documentation, what happens to that user’s Exchange Online data?
A user is assigned Microsoft 365 E5 but must not use Power BI. The company still wants that person to keep Exchange, Teams, and the rest of the E5 bundle. What is the correct license-management action?