Skip to content

Creating a dynamic group with all AAD Premium licensed users

Dynamic Groups in Azure AD are truly an amazing feature. It lets you manage a large group of users without the need to manually add every one of them in a specific group.

Some organizations only have AAD Premium licenses for a subset of users, using dynamic groups makes it really easy to scope your AADP policies (like Conditional Access policies) to only the licensed users.

As the documentation says you can use the assignedPlans multi-valued property to create a group based on licenses. The AssignedPlans property has three values:

  • capabilityStatus
  • service
  • servicePlanId

The capabilityStatus is a property that tells us if the the license is enabled. Service is the license name, ServicePlanID is the ID for the license. I suggest always using the ID, as this is less subject to change than the service.

Getting the ServicePlanID

Run the ‘Get-AzureADSubscribedSKU’ command after connecting to AzureAD Powershell. This will return the ObjectID, SkuPartNumber and SkuID of every license you own. Select the correct ObjectID of the license you want and write it down.

Use the ObjectID that you got from the previous command. In the command output, you will find the ServicePlanID.

Get-AzureADSubscribedSku -objectid ead8488e-5b94-4a8f-a590-e789b41346f6_b05e124f-c7cc-45a0-a6aa-8cf78c946968 | select -expand serviceplans

Create the AzureAD group

Navigate to Azure Active Directory ( and select ‘Groups’.

Select ‘New group’ in the Groups page.

Choose ‘Security’ as the preferred Group Type and choose ‘Dynamic user’ as the membership type. Choose whatever values you would like for the Group Name and Group Description.
Select ‘Add dynamic query’ to configure the query you would like to base this group on.

Use the following rule for a dynamic group based on all AADP licensed users. Use the ServicePlanID you found through Powershell.

user.assignedPlans -any (assignedPlan.servicePlanId -eq "41781fb2-bc02-4b7c-bd55-b576c07bb09d" -and assignedPlan.capabilityStatus -eq "Enabled")

After creating the group, you can monitor the membership processing status and last update date.

If you wait until the ‘processing status’ states ‘Update complete’, you will find that the group has been populated.

15 thoughts on “Creating a dynamic group with all AAD Premium licensed users Leave a comment

  1. thanks its working , do you know maybe how i do the same thing expect users that inside other group ?
    something like that ….
    user.assignedPlans -any (assignedPlan.servicePlanId -eq “41781fb2-bc02-4b7c-bd55-b576c07bb09d” -and assignedPlan.capabilityStatus -eq “Enabled”) execpt users that are inside thing group “groupID”


      • I think the request is to create a dynamic group based on your described filters, but exclude members of another group.

        gma; instead of using the code, you can also manually add filter criteria; this would help to outline how an exclusion may appear in the code underneath; then customise accordingly.


      • Its not possible to exclude another group. You could exclude certain users through user parameters (like name, department) while using an and statement


  2. Based on the command used, if I wanted to create a dynamic group that adds all users that have an active license on their mailbox, would I just use “user.assignedPlans -any” ?


  3. This is very useful and thank you.
    I have a question though… how do you exclude certain users from this query, for example, i have some service accounts which are assigned E3 licenses but i only want a list for real human beings. The service accounts still need to have the E3 licenses but the group i am interested in should not include those service accounts. What filter options are there?

    Thanks in advance,


      • The service accounts have email addresses e.g. I have tried using user.mail or user.UserPrincipalName but i get an error

        (user.assignedplans -any (assignedplan.serviceplanid -eq “2789c901-c14e-48ab-a76a-be334d9d793a” -and assignedplan.capabilitystatus -eq “enabled” -and user.mail -ne “”)

        The Error is “Failed to save dynamic group. Dynamic membership rule validation error. Mixed use of properties from different types of objects”


      • Could you try something like this?

        (user.userPrincipalName -startsWith “service”) -and (user.assignedPlans -any (assignedPlan.servicePlanId -eq “41781fb2-bc02-4b7c-bd55-b576c07bb09d” -and assignedPlan.capabilityStatus -eq “Enabled”))


    • I would consider “employee id” if not used already. service accounts can get an employee id and a filter can be done in employee id = blank.


  4. George, the following worked for me:

    user.mail -ne “” -and (user.assignedPlans -any (assignedPlan.servicePlanId -eq “5dbe027f-2339-4123-9542-606e4d348a72” -and assignedPlan.capabilityStatus -eq “Enabled”))



  5. Used the following for all users who have AADP 1 OR AADP 2

    (user.assignedPlans -any (assignedPlan.servicePlanId -eq “41781fb2-bc02-4b7c-bd55-b576c07bb09d” -and assignedPlan.capabilityStatus -eq “Enabled”)) -or (user.assignedPlans -any (assignedPlan.servicePlanId -eq “eec0eb4f-6444-4f95-aba0-50c24d67f998” -and assignedPlan.capabilityStatus -eq “Enabled”))


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: