A Microsoft 365 license reaches a user one of two ways: a direct assignment placed on the user object, or a group-based assignment inherited through membership. The models coexist in most tenants, and the mixture is where licensing confusion concentrates.
How the models differ#
The differences that matter operationally:
- Lifecycle: direct assignments persist until removed by hand; group assignments follow membership automatically.
- Accountability: a direct assignment records an explicit decision about one user; a group assignment records a decision about a population.
- Removal: unassigning a direct license affects one user predictably; changing a group assignment affects every direct member of the group at once.
- Auditability: with groups, the question why does this user have this license becomes a question about who manages the group's membership, which flat views do not answer.
Why mixed tenants get confusing#
Most tenants adopted group-based licensing after years of direct assignment and never finished migrating. The same SKU then reaches different users by different mechanisms, cleanups stall because nobody knows which direct grants are redundant, and every license question needs both models checked.
VisualizerEngine
Both models in VisualizerEngine
License analytics tracks assignments per user across both sources, with the hierarchy path behind every group-based grant. Duplicate detection flags users covered by both models at once, which is exactly the population a migration cleanup needs, and removal impact analysis previews the effect of retiring a direct grant.