Creating a dynamic group with all AAD Premium licensed users

Dynamic Groups in Azure AD are truly an amazing feature. It lets you manage a large group of users without the need to manually add every one of them in a specific group.

Some organizations only have AAD Premium licenses for a subset of users, using dynamic groups makes it really easy to scope your AADP policies (like Conditional Access policies) to only the licensed users.

As the documentation says you can use the assignedPlans multi-valued property to create a group based on licenses. The AssignedPlans property has three values:

• capabilityStatus
• service
• servicePlanId

The capabilityStatus is a property that tells us if the the license is enabled. Service is the license name, ServicePlanID is the ID for the license. I suggest always using the ID, as this is less subject to change than the service.

Getting the ServicePlanID

Run the ‘Get-AzureADSubscribedSKU’ command after connecting to AzureAD Powershell. This will return the ObjectID, SkuPartNumber and SkuID of every license you own. Select the correct ObjectID of the license you want and write it down.

Use the ObjectID that you got from the previous command. In the command output, you will find the ServicePlanID.

Get-AzureADSubscribedSku -objectid ead8488e-5b94-4a8f-a590-e789b41346f6_b05e124f-c7cc-45a0-a6aa-8cf78c946968 | select -expand serviceplans

Create the AzureAD group

Navigate to Azure Active Directory (aad.portal.azure.com) and select ‘Groups’.

Select ‘New group’ in the Groups page.

Choose ‘Security’ as the preferred Group Type and choose ‘Dynamic user’ as the membership type. Choose whatever values you would like for the Group Name and Group Description.
Select ‘Add dynamic query’ to configure the query you would like to base this group on.

Use the following rule for a dynamic group based on all AADP licensed users. Use the ServicePlanID you found through Powershell.

user.assignedPlans -any (assignedPlan.servicePlanId -eq "41781fb2-bc02-4b7c-bd55-b576c07bb09d" -and assignedPlan.capabilityStatus -eq "Enabled")

After creating the group, you can monitor the membership processing status and last update date.

If you wait until the ‘processing status’ states ‘Update complete’, you will find that the group has been populated.