Automatically revoke Microsoft 365 licenses from users outside an Active Directory group

Scenario

Cayosoft Administrator supports license management scenarios based on the group membership. This article describes a mover scenario to automatically revoke Microsoft 365 licenses from users who are not members of an Active Directory (AD) group, e.g., users who left the group. The scenario is based on the AD Users | Enforce License rule.

• In my hybrid environment, I have an AD group that enforces specific Microsoft 365 licenses for members. I would like Cayosoft Administrator to automatically revoke the licenses from users who leave the group.

IMPORTANT    The discovery logic depends on the Active Directory extension settings. If the Active Directory extension settings > Advanced settings > Map cloud users by UPN setting is set to Yes, the rule will map users only using UserPrincipalName. The rule won't revoke licenses from users that have mismatched UPNs. If set to No, the rule will first attempt to find users based on objectID and immutableID attributes, and then fall back to UserPrincipalName. The setting is global; the change will affect all related rules and items in your environment. For additional information on mapping, refer to the following article: How to map Active Directory users to Microsoft 365 users.

Prerequisites

• An instance of the AD Users | Enforce License rule.

• A distinguished name of the target group that governs the license assignment.

IMPORTANT    Only direct members of the group are considered members. Users who belong to the group through a nested group are treated as non-members, and their licenses will be revoked.

Steps

Using the AD Users | Enforce License rule, you can create a routine check for user membership in a specific group. If not part of the group, a license/license plan is revoked.

IMPORTANT    If the query criteria contains an incorrect group DN, the rule treats every user in the scope as a non-member and revokes affected licenses from all license holders. Always run a preview before the first run.

1. Create an instance of the AD Users | Enforce License rule: in the main console view, click New > Rule > Show all templates > AD Users | Enforce License, and click Next. Define rule output, location, etc., and complete the initial setup.

2. In the Query criteria setting, specify the query criteria to limit the scope of AD users by limiting the users to non-members of the target group. Specify the target group DN—refer to the provided example and replace the placeholder with the actual group DN:

   Copy

   -not (memberOf -eq 'CN=LicensedGroup,OU=Groups,DC=cayo,DC=net')

3. Set the Include licensed users setting to Licensed users only.

4. Recommended: Set the Filter by licenses setting to match the License options setting so that the preview and the report list only the users who will actually lose the license.

5. In the Action section, set up the License options setting: pick a specific license plan by clicking Add, and select Unassign to revoke the license/license plan. You can define specific actions for every license/license plan in your Entra domain.

6. Save changes and click Preview to review the initial query results. Set up the rule schedule and run the rule when ready.