When a user holds a Microsoft 365 license that no administrator assigned directly, the license arrives one of two ways: group-based licensing from a group the user is a direct member of, or an old direct assignment everyone forgot. One Microsoft rule shapes the whole hunt: group-based licensing does not flow through nested groups. Only immediate user members of the licensed group receive the license.
The Azure portal shows you that the license exists and names a source. It does not show the full picture: which other groups also license the user, and what else changes if you remove a membership, which is exactly what you need in order to act safely.
Why this happens#
Microsoft Entra ID lets you assign licenses to groups, and every direct user member inherits the license. Nested groups do not propagate it: per Microsoft documentation, only first-level user members of a licensed group are licensed. So the mystery license comes from a group the user sits in directly, often added by automation, a sync, or a dynamic membership rule, or from a forgotten direct assignment.
In the portal, the user's Licenses page marks the assignment as inherited from a group. When several groups grant overlapping licenses, or nobody remembers why the user is in the granting group at all, the single group name shown is the start of an investigation, not the answer.
Tracing it manually#
The manual method is to walk the membership chain yourself. With Microsoft Graph PowerShell, list the user's license details, then expand the granting group's members recursively until you find the path:
Connect-MgGraph -Scopes "User.Read.All","Group.Read.All"
Get-MgUserLicenseDetail -UserId user@contoso.com
# Licensing follows DIRECT membership only, so list direct groups
Get-MgUserMemberOf -UserId user@contoso.com | Select-Object Id
# For each candidate group, check its assigned licenses
Get-MgGroup -GroupId <group-id> -Property assignedLicenses | Select-Object -ExpandProperty AssignedLicensesWhy the manual method breaks down#
Even with the granting groups identified, the safety questions remain: whether another direct membership or a direct assignment also grants the same SKU, why the user is in each granting group at all, and what non-licensing access they lose if a membership is removed, because access, unlike licensing, does flow through nesting.
- Licensing follows direct membership while access follows nesting, so one membership change can be safe for licenses and harmful for access at the same time.
- Overlapping assignments from multiple groups are easy to miss, so removing one group does not always remove the license.
- Nothing warns you what else the user loses if you remove the membership.
VisualizerEngine
How VisualizerEngine answers it
VisualizerEngine's inheritance mapping shows, for any user, every license source mapped against the surrounding hierarchy, readable in seconds. Conflict and duplicate detection lists overlapping assignments and disabled service plans per user, and removal impact analysis shows exactly who loses what before you unassign anything.
Frequently asked questions
Can a license arrive through more than one group at once?
Yes. Overlapping sources are common, and removing the user from one granting group leaves the license in place if another direct membership or a direct assignment still grants it. That is why enumerating every source matters before acting.
Does removing the user from the group remove the license immediately?
Group-based license removal is processed by Entra ID after the membership change. If the license remains, check whether another group also grants it before assuming a processing delay.