O365 license woes

[dapaulio]

Originally I had A1 faculty licenses assigned by security group A

 

Now I have A3 licensing assigned by security group B

 

Security group A also is a dependent membership which give the staff the environment they should have when they log in, so I can’t just remove them from the group and have done with it. It’s doesn’t work anyway as explained later

 

My problem is that when I remove the license inherited by security Group A the license doesn’t remove properly from the members.

 

So A3 license now says it in conflict with the a1 but the inheritance of the A1 should be gone.

 

I have tried manually removing the license from the user but can’t.

 

When I remove the group memberships on an effected user, sync with aad and then add them again it reassigned the license and still conflicts

 

Move the user out of the aad sync scope effectively deleting the aad user and then moving it back in to scope. The licenses still apply and conflict.

 

No matter what I try I simply can’t get rid of this A1 license so the a3 license will fully engage

 

tia

Edited September 10, 2024 by dapaulio

[dapaulio]

To clarify in that state

There is no license associated to inherited alstaff group

 

The a3 license is associated to membership of the security group a3 for faculty

[DavR]

Two questions.....

 

How long did you leave after removing the license from the group, before checking on the license status of the users? Depending on the size of your tenant, this can take a little while. I'd leave at least an hour and then check back.

 

Could the license be assigned by any other security group the user is a member of? Check each one in Azure to be sure. Are there any nested groups in play, which may mean the user is covered by an A1 license group, indirectly?

 

End of the day, I don't think there's any negative effect of having users licensed for A1 and A3 simultaneously, A3 just outranks A1 in most things. But I, too, would try and tidy that up for the sake of neatness.

[snagrat]

Remove the direct assignment of the A3 to ensure only inherited licenses show.

 

Then force licensing reprocessing on both groups should do it

[dapaulio]

Two questions.....

 

How long did you leave after removing the license from the group, before checking on the license status of the users? Depending on the size of your tenant, this can take a little while. I'd leave at least an hour and then check back.

 

Could the license be assigned by any other security group the user is a member of? Check each one in Azure to be sure. Are there any nested groups in play, which may mean the user is covered by an A1 license group, indirectly?

 

End of the day, I don't think there's any negative effect of having users licensed for A1 and A3 simultaneously, A3 just outranks A1 in most things. But I, too, would try and tidy that up for the sake of neatness.

 

Thanks your comment about being patient, it was semi accurate. So I originally left the changes for 48 hours and it hadn’t done anything but adding the license in on reduce app and services to single app within the license took a couple hours and then freed itself.

 

Continuing this thought process I ran the users out of aad sync practically removing their 365 account waited small while whilst reprocessing all the licenses in between. Then adding the the accounts back in to the aad sync. They recovered with their a1 and a3 licenses however on reprocessing the licenses this began correcting them and properly removed the a1 license.

With now 6 exceptions which are just being damn persistent

 

Conclusion my thoughts are office 365 got stuck a little and also I need to give more patience. It just needed a prod first to wake it up. This got me thinking as I have had an email from ms to update aad connect to now entra connect. Wonder if gremlins like this have been discovered and fixed in this part. Also to back it up I hadn’t noticed but one of the screens just snipped off my screen shots a deprecation from 9sept for that gui. So may all be linked

 

Thanks for everyone’s help

Edited September 11, 2024 by dapaulio

[DavR]

Thanks your comment about being patient, it was semi accurate.

Semi-accurate is what I aim for

 

Glad to hear you worked it out.