Exam SC-300 topic 1 question 1 discussion

There is not enough information in the question to provide a 100% correct answer. You can assign licences to any group created within the Azure AD portal. These can include security groups, Microsoft 365 groups, and either assigned or dynamic groups. You can even create a dynamic device security group and assign E5 licences to it, which doesn't make sense but is true (I've tested it). However, the missing bit of information is whether the Microsoft 365 groups have the "SecurityEnabled" attribute set to True. Only M365 groups that have the "SecurityEnabled" attribute set to True can have licences assigned to them. If the group is created in the M365 Admin Centre, then the "SecurityEnabled" attribute is set to False and you can not assign licences to the group. But if the M365 group is created in the Azure AD portal, then the "SecurityEnabled" attribute is set to True and you can assign licences. For the answer, I would make an assumption that because this is an Identity-related exam testing us on Azure AD topics, that the M365 groups were created in the Azure AD portal and therefore have the "SecurityEnabled" attribute set to True. Which means the correct answer is B - all groups.

Wrong, you can assign licenses to Microsoft 365 groups as well. The correct answer is E

C is the correct answer. The license in the question cannot be assigned to a dynamic device group. If group-based licensing is used, there are a few limitations: a) it does not support nested groups in which case, only the immediate first level user members will get the license. b)The feature can only be used with security groups & M365 groups that have securityEnabled=TRUE. securityEnabled=TRUE is not set by default on any M365 groups and the question does not specifically mention any of the groups being set so we have to assume false. Therefore, the only groups that can be assigned a license is group 1 & 2.

bing says you can assign a license to dynamic groups of type devices

Group-based licensing in Microsoft Entra ID is primarily designed for user accounts. This means that licenses are typically assigned to users, either directly or through their membership in groups. Devices, on the other hand, are not the primary targets for license assignments in this context.​ However, there is a specific scenario where devices can be licensed: device-based licensing for Microsoft 365 Apps for enterprise. In this case, you can assign licenses to devices by adding them to a security group in Microsoft Entra ID and then assigning the appropriate licenses to that group. This method is specifically for Microsoft 365 Apps and is not a general approach for all Microsoft services.​ learn.microsoft.com For more detailed information, you can refer to the official Microsoft documentation on https://learn.microsoft.com/en-us/microsoft-365/apps/licensing-activation/device-based-licensing

Chat GPT: To determine which groups you can assign a Microsoft Office 365 Enterprise E5 license directly, you need to understand that only Microsoft 365 groups with either: Assigned membership, or Dynamic user membership ...are eligible for direct license assignment in Azure AD.

Answer: D. User1 and User2 only, Users can be added to groups regardless of licence state. Licences assigned through group-based licensing are applied once the user is a member of the group

Answer is E. You cannot assign an E5 license to a device or a device group as they must be assigned to a user only. You can assign other licenses that are device based licensing for certain products (like 365 apps for enterprise) for shared devices so any user can use the apps etc.

"There are Microsoft 365, Office 365, and Windows licenses - These licenses are assigned to a Microsoft Entra user or group to grant them access to use Office or Windows products. You need one license for each user who needs access to Windows and / or office." Keywords: user, define identity licensing Source: https://learn.microsoft.com/en-us/training/modules/explore-identity-azure-active-directory/11-define-identity-licensing

Tested this per 15-03-2025: all groups were created in Entra ID. License assignments however need to be done in the 365 admin center, I could assign a license to all the groups. However, when the Microsoft 365 groups are created in the M365 admin center, you cannot assigned a license to the group. sezza_blunt's post is the most accurate and therefor I would vote for B as well.

Device groups, such as Dynamic Device groups, are not eligible for license assignments. Licenses can only be assigned to user-based groups like Security Groups, Mail-Enabled Security Groups, and Microsoft 365 Groups. You can assign a Microsoft Office 365 Enterprise E5 license directly to several types of groups: Security Groups: These groups are used to manage user and computer access to shared resources. Mail-Enabled Security Groups: These groups are similar to security groups but also have an email address. Microsoft 365 Groups: These groups provide collaboration features such as shared mailboxes, calendars, and document libraries

E is correct: Group1 (Security, Assigned) → ✅ Eligible Group2 (Security, Dynamic User) → ✅ Eligible Group3 (Security, Dynamic Device) → ❌ Not Eligible (Device groups cannot have licenses) Group4 (Microsoft 365, Assigned) → ✅ Eligible Group5 (Microsoft 365, Dynamic User) → ✅ Eligible

Group Type: Security groups: Can have licenses assigned. Microsoft 365 groups: Can have licenses assigned if securityEnabled = true. (This information is missing in the table, so by default, Microsoft 365 Groups are not considered security-enabled unless explicitly mentioned.) Membership Type: Both assigned and dynamic user memberships are supported for license assignment. Dynamic device memberships are not eligible, as licenses are for users, not devices.

You can assign licenses to any security group. https://learn.microsoft.com/en-us/entra/fundamentals/concept-group-based-licensing#features https://learn.microsoft.com/en-us/microsoft-365-apps/licensing-activation/device-based-licensing#steps-to-configure-device-based-licensing-for-microsoft-365-apps-for-enterprise

You cannot assign license to Dynamic Device group.

The Answer is E - you can't allocate a license to a device

If you have security groups, mail enabled groups, or Microsoft 365 groups, you can assign or unassign licenses for those groups on the Licenses page in the Microsoft 365 admin center. We refer to this as group-based licensing. https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-group-licenses?view=o365-worldwide