A service plan conflict happens when a user inherits the same Microsoft 365 product from more than one group, and those groups disable different service plans inside it. The result is confusing effective access and, in some cases, licensing errors on the user object.
How conflicts arise#
Group-based licensing lets each assignment disable individual service plans, for example assigning E5 but disabling Yammer. When two groups assign the same SKU with different disabled plans, Entra ID merges them: a service plan is enabled for the user if any granting group enables it.
That merge rule surprises administrators constantly. A security team disables a plan in their group's assignment, and it stays active anyway because another licensed group the user also directly sits in still enables it.
Finding the disagreeing groups#
The portal shows the user's effective service plans but attributes them poorly across multiple granting groups. Manually you must enumerate every group that assigns the SKU, then compare the disabled plan lists:
- Compare DisabledPlans arrays across every group granting the same SkuId.
- Then work out which of those licensed groups the affected user is a direct member of.
Connect-MgGraph -Scopes "Group.Read.All"
# List groups with license assignments, then inspect each
Get-MgGroup -Filter "assignedLicenses/any()" -Property displayName,assignedLicenses |
Select-Object DisplayName -ExpandProperty AssignedLicensesVisualizerEngine
How VisualizerEngine answers it
VisualizerEngine tracks conflicts and disabled service plans per user as a built-in analysis. For each affected user it shows every granting group, the path through the hierarchy to each one, and where the disabled plan lists disagree, so the fix is a decision instead of an archaeology project.
Frequently asked questions
If two groups assign the same SKU, does the user consume two licenses?
No. The user consumes one license for the SKU, with service plans merged across the assignments. The waste risk is different: overlapping assignments hide which group is actually needed.