Prepstellar
Get the app

AZ-104 · Microsoft Entra users and groups

26 cards

Microsoft Entra Licenses and SSPR

Swipe, scroll or use ← →

  1. Where licenses are assigned

    Paid Microsoft cloud services are not switched on for a tenant as a whole: a license is assigned to each user who needs those services.

    Both ways of doing that live in the same place. Individual and group license assignments are managed in the Microsoft 365 admin center, under Billing > Licenses. Select a product from the list, then work on either its licensed users or the groups it is assigned to.

    Surface What it is for
    Microsoft 365 admin center > Billing > Licenses Assigning products to users and to groups
    Microsoft Entra admin center > Users The user objects themselves, and properties such as usage location
    Microsoft Entra admin center > Password reset The self-service password reset configuration

    Keeping the surfaces apart saves time later: a licensing problem is investigated in Billing, while the property that so often causes it belongs to the user object.

    1 / 26

  2. Quick check

    Where does an administrator assign a product license, whether to one user or to a group?

    1. AIn the Microsoft Entra admin center, under Users and Deleted users

      That page lists accounts deleted less than 30 days ago and holds no license assignment.

    2. BIn the Microsoft 365 admin center, on the Billing and Licenses page

      Right. Billing > Licenses in the Microsoft 365 admin center handles both individual and group assignments.

    3. CIn the Microsoft Entra admin center, under Password reset and Properties

      That blade configures self-service password reset and has nothing to do with product licensing.

    2 / 26

  3. Let a group carry the licenses

    With group-based licensing, one or more product licenses are assigned to a security group, and Microsoft Entra ID applies them to the members of that group.

    The value is in what happens afterwards, without anyone doing anything: new members receive the group licenses, and departing members lose the licenses they inherited from that group. The roster becomes the licensing decision.

    Assignment Who maintains it
    Direct to a user An administrator, for every arrival and departure
    To a security group Membership does it — joining grants, leaving removes

    Two conditions apply before the design works. Group-based licensing requires Microsoft Entra ID Premium P1 or greater, or Office 365 Enterprise E3 or greater, including paid or trial editions. And the tenant must own enough licenses for every unique member of its licensed groups, or assignments will start to fail.

    3 / 26

  4. Quick check

    A licensed security group gains a new member and loses another on the same day. What happens to their licenses?

    1. ABoth keep whatever they had until an administrator revisits the assignment

      Following the roster without administrator action is precisely what group-based licensing provides.

    2. BThe new member gets the group licenses and the leaver loses what it granted

      Right. Membership drives the assignment: joining grants the group licenses and leaving removes what the group provided.

    3. CBoth accounts have to be assigned directly, because a group cannot carry licenses

      One or more product licenses can be assigned to a security group, which then applies them to its members.

    4 / 26

  5. Let a group carry the licenses

    A product is rarely a single thing. Inside it are service plans, and an administrator can disable selected service plans within a product assigned to a group.

    That turns one assignment into a controlled rollout: the product follows the group's membership, while a component that is not ready stays switched off for everyone in it. When launch day arrives, the plan is enabled in the same group assignment and every member gets it at once.

    Compare the alternatives:

    Approach Membership tracking Partial product
    Product assigned to a security group, with a plan disabled Automatic Yes
    Product assigned directly to each user today Manual for each arrival and departure Not through the group
    Product assigned to the group owner alone None — members inherit nothing from an owner No
    5 / 26

  6. Quick check

    A department's licenses must follow its membership automatically, and one service plan must stay switched off until launch. What meets both requirements?

    1. AAssign the product to the security group and disable that plan there

      Right. Group-based licensing tracks joiners and leavers, and selected service plans can be disabled inside the group's product assignment.

    2. BAssign the product directly to every current member and leave the plan enabled

      Direct assignment does not follow membership changes, and leaving the plan enabled ignores the launch requirement.

    3. CAssign the product to the group's owner and let the members inherit it from there

      Members do not inherit anything from an owner's own license; ownership governs the group rather than licensing it.

    6 / 26

  7. Keep your progress in the app

    That’s 3 of 11 quick checks. In the app they stay answered, and every lesson remembers where you left off.

    Get the app Keep reading here

  8. The same license arriving twice

    A user can easily be covered more than once — directly and through a group, or through two licensed groups at the same time. That does not multiply the cost.

    If the same license reaches a user from multiple groups, or from both direct and group assignment, it is consumed only once. Overlapping assignments are combined into a single consumed license for that user.

    • Two licensed groups plus a direct assignment for the same product still consume one license for that person.
    • The tenant still needs enough licenses for every unique member of its licensed groups — unique being the operative word.

    This is why the license count follows people, not assignments. Counting assignments would suggest a shortage that does not exist.

    7 / 26

  9. Quick check

    The same product license reaches a user directly and through two licensed groups. How many licenses does that user consume?

    1. AThree, one for each route the license arrives by

      Assignments are not counted one by one; the same license arriving several times is still a single license for that user.

    2. BTwo, because the direct assignment is counted separately

      A direct assignment is not consumed separately from a group-derived one for the same product.

    3. COne, because overlapping assignments are combined

      Right. The same license reaching a user from several groups or from both routes is consumed only once.

    8 / 26

  10. Usage location decides whether licensing works

    Some services are unavailable in certain locations, so licensing depends on where a user is. Before assigning a license, set the user's usage location to their actual supported location.

    Two rules follow, and both show up as licensing failures rather than as location errors:

    Situation What happens
    A user has no usage location, licensed through a group The user inherits the directory's location
    The usage location is not a supported one The group license assignment fails and records an error on the user

    An inherited directory location is a guess, and a wrong guess produces a failed assignment or a service the person should not have received. Setting the real value at user creation is what prevents both.

    9 / 26

  11. Usage location decides whether licensing works

    Usage location is not the only reason a licensing operation fails. Two more are worth recognizing:

    • Not enough licenses. The tenant must own one for every unique member of the licensed group.
    • Conflicting service plans. Some plans cannot be assigned alongside others in the same product.

    Because group assignment runs in the background, the failures are not shown as an error message at the moment of assignment. Microsoft Entra ID records background group-assignment failures on the affected user object, which is where the investigation starts: open the user, read the recorded error, then fix the cause — a location, a shortage or a plan conflict.

    10 / 26

  12. Quick check

    A user has no usage location when a licensed group assigns a product. Which location is used?

    1. AThe location of the group's owner

      An owner governs the group; their own location is not applied to the members being licensed.

    2. BThe location of the directory

      Right. For group assignment, a user without a usage location inherits the directory's location.

    3. CThe location of the last sign-in

      Sign-in location is not a licensing property, and licensing does not read it.

    11 / 26

  13. What self-service password reset actually covers

    Any user who is already signed in can change their password. The problem SSPR solves starts one step earlier: a person who is not signed in, has forgotten their password or has an expired one.

    Self-service password reset (SSPR) lets that user reset the password from a web browser or from a Windows sign-in screen, and so regain access to Azure, Microsoft 365 and any other application that authenticates through Microsoft Entra ID.

    Situation What the user does
    Signed in, wants a new password Changes it — no SSPR needed
    Signed out, password forgotten or expired Resets it through SSPR

    The benefit is measured on two sides. Administrators carry less help-desk load because users fix password problems themselves, and users do not lose productivity waiting for an administrator to be available.

    12 / 26

  14. Quick check

    Which situation is the one SSPR is designed for?

    1. AA signed-in user who simply wants to choose a new password

      Any user who is signed in can change their password without this feature.

    2. BA signed-out user whose password has been forgotten or expired

      Right. SSPR lets a user who is not signed in reset a forgotten or expired password from a browser or a Windows sign-in screen.

    3. CAn administrator who needs to unlock a resource for a colleague

      SSPR is about a user recovering their own password, not about granting access to a resource.

    13 / 26

  15. Decide who is allowed to use it

    The Self-service password reset enabled property has three settings, and the one it starts on matters.

    Setting Who can use SSPR
    None Nobody — and this is the default value
    Selected Only the members of one specified security group
    All Every user in the organization

    Selected is the pilot setting: enable SSPR for a targeted group of users who can test it and verify that it works as expected, then widen the scope when the results are good. A twenty-person marketing group is the classic first audience.

    The setting is a scope, not a strength. It decides who may reset a password; it never decides how many proofs that person must present.

    14 / 26

  16. Quick check

    Which value does the Self-service password reset enabled property start on, and which one limits the feature to a single security group?

    1. AIt starts on None, and Selected limits it to one specified security group

      Right. None is the default, and Selected enables SSPR only for the members of the specified security group.

    2. BIt starts on Selected, and None is what restricts it to a single security group

      Selected is a choice an administrator makes, and None means no user in the organization can use SSPR.

    3. CIt starts on All, and Registration limits it to one specified security group

      All enables SSPR for everyone, and Registration is where sign-up and reconfirmation are configured, not a scope.

    15 / 26

  17. Proving who is asking

    Identity has to be verified before a password is reset, or the feature becomes a way in for someone impersonating the user. SSPR can require either one or two registered authentication methods, and the available methods are these:

    Method How the user proves identity
    Microsoft Authenticator notification Approves or denies a notification in the app
    Microsoft Authenticator code Enters the code shown in the app
    External email Enters a code sent to an address outside Azure and Microsoft 365
    Mobile phone Enters a code sent by SMS, or takes an automated call
    Office phone Answers an automated call to a nonmobile number and presses #
    Security questions Answers the questions registered earlier

    Enabling two or more methods lets users pick the ones they can actually use. Security questions are the weakest of the set, because the answers may be known to other people.

    16 / 26

  18. Proving who is asking

    Administrator accounts are treated differently, and the difference is not configurable. A strong, two-method authentication policy is always applied to accounts with an administrator role, whatever is configured for other users — and the security-question method is not available to those accounts.

    So a one-method setting for the organization does not lower the bar for an administrator, and an administrator can never satisfy the requirement with security questions.

    Account Number of methods Security questions
    Ordinary user One or two, as configured Available if enabled
    Administrator role Always two Never
    17 / 26

  19. Quick check

    How does SSPR authentication work for an account that holds an administrator role?

    1. AIt follows the one-method setting and may use security questions

      The configured minimum applies to other users; an administrator account is held to the stronger policy regardless.

    2. BIt skips verification when the password has already expired

      Verification is never skipped — an expired password is exactly when impersonation would be attempted.

    3. CIt always requires two methods, and security questions are unavailable

      Right. A strong two-method policy always applies to administrator accounts, and the security-question method is not available to them.

    18 / 26

  20. Tell people that a password changed

    A reset is worth announcing, because a notification is how an impersonation attempt gets noticed. There are two settings, and they have different audiences.

    Setting Who is notified Why it matters
    Notify users on password resets The user who reset their own password, at their primary and secondary email addresses If the reset was done by a malicious user, the real owner is alerted and can act
    Notify all admins when other admins reset their password Every administrator An administrator's password reset is visible to the whole administrative team

    These belong to the notifications part of the password reset configuration; registration settings, which decide whether users must register at next sign-in and how often they reconfirm their information, are configured separately.

    19 / 26

  21. Quick check

    Which setting alerts the wider administrative team when one administrator resets a password?

    1. ANotify all admins when other admins reset their password

      Right. That option notifies every administrator when another administrator resets their password.

    2. BNotify users on password resets at their primary email addresses

      That option informs the person whose own password was reset, at their primary and secondary email addresses.

    3. CRequire users to reconfirm their authentication information

      Reconfirmation is a registration setting that keeps method details current; it notifies nobody about a reset.

    20 / 26

  22. Editions, and writing the password back on-premises

    What a user may do with their password depends on the edition behind them.

    Capability What it needs
    Change a password while signed in Any edition of Microsoft Entra ID
    Reset a forgotten or expired password while signed out Microsoft Entra ID P1 or P2, Microsoft 365 Apps for business, or Microsoft 365
    Password writeback in a hybrid directory Microsoft Entra ID P1 or P2, or Microsoft 365 Apps for business

    In a hybrid organization — Active Directory on-premises and Microsoft Entra ID in the cloud — any password change made in the cloud must be written back to the on-premises directory, or the two copies of the identity stop agreeing.

    21 / 26

  23. Editions, and writing the password back on-premises

    Writeback can be deployed in two ways: with Microsoft Entra Connect or with cloud sync. They are not mutually exclusive.

    Each option can be deployed side by side in different domains, to target different sets of users. That is what makes a merger workable: users from an existing on-premises domain keep writing back through Microsoft Entra Connect, while users arriving in a disconnected domain use cloud sync. Cloud sync can also offer higher availability, because it does not depend on a single instance of Microsoft Entra Connect.

    • Both populations are covered during the deployment, with no domain left without writeback.
    • Neither option has to be removed for the other to work.
    22 / 26

  24. Quick check

    A hybrid organization needs password writeback for an existing on-premises domain and for a disconnected domain gained in a merger, with both populations working during the deployment. What fits?

    1. AUse cloud sync for the merged domain and turn writeback off for the existing one

      Turning writeback off would leave one population unable to write cloud password changes back on-premises.

    2. BUse one mandatory Microsoft Entra Connect instance to cover both domains together

      A disconnected domain is the case the second option exists for; a single instance is not required to serve both.

    3. CUse Microsoft Entra Connect in one domain and cloud sync in the other, side by side

      Right. The two writeback options can be deployed side by side in different domains to target different sets of users.

    23 / 26

  25. Key takeaways

    • Licenses are assigned in the Microsoft 365 admin center under Billing > Licenses, for individual users and for groups alike.
    • Group-based licensing follows the roster. Product licenses assigned to a security group reach new members and leave with departing ones; it requires Microsoft Entra ID Premium P1 or greater or Office 365 Enterprise E3 or greater, paid or trial, and enough licenses for every unique member. Selected service plans can be disabled inside the group assignment, and a license arriving by several routes is consumed only once.
    • Usage location comes first. Without it a group assignment inherits the directory's location; an unsupported one fails and records an error on the user, as do shortages and conflicting service plans.
    24 / 26

  26. Key takeaways

    • SSPR covers the signed-out case. Its scope property defaults to None, Selected limits it to one security group, and All opens it to the organization.
    • Proof is separate from scope. One or two methods can be required from the six available, but administrator accounts always use two and can never use security questions.
    • Editions and writeback: changing a password while signed in works on any edition, resetting while signed out needs P1 or P2, Microsoft 365 Apps for business or Microsoft 365, and writeback runs through Microsoft Entra Connect or cloud sync, side by side if needed.
    25 / 26

  27. Quick check

    SSPR is being piloted with one security group that includes an administrator, who must present two proofs and must not use security questions. Which configuration is valid?

    1. AScope All, with the administrator using one security question and one email method

      Scope All would end the pilot, and security questions are never available to an administrator account.

    2. BScope Selected for that group, with the administrator using two methods that are not security questions

      Right. Selected delivers the group pilot, while the administrator policy independently enforces two methods and excludes security questions.

    3. CScope None, with the administrator relying on the administrator policy to bypass the scope

      None means nobody can use SSPR; the administrator policy strengthens verification but does not grant access past the scope.

    26 / 26

  28. 11 quick checks · then the test

    In the app, finishing the quick checks opens this lesson’s 10-question test, and the ones you miss come back exactly when you’re about to forget them.

    Take this lesson’s test → Get the app
← Previous Keep your progress · Get the app Next card →

The whole course, on your phone

Lessons you can read, audio you can listen to on the way to work, and practice that remembers what you got wrong.

Get the app