How to Assign Microsoft 365 Copilot Licenses by Group

Assigning Microsoft 365 Copilot licenses individually to hundreds of users is time-consuming and error-prone. Group-based licensing automates the process by linking a license assignment to an Azure AD group membership. When a user is added to the group, Copilot is automatically enabled. When a user is removed, the license is reclaimed. This article explains how to configure group-based licensing for Copilot in the Microsoft 365 admin center and Azure Active Directory.

What Group-Based Licensing Is and Why It Matters

Group-based licensing lets you assign Microsoft 365 service plans to an Azure AD security group instead of individual user accounts. When a user becomes a member of that group, the system provisions the license automatically. When a user leaves the group, the system removes the license. This approach eliminates manual errors, reduces administrative overhead, and ensures that license counts stay accurate. For Copilot, which requires a base Microsoft 365 E3 or E5 license plus a Copilot add-on, group-based assignment is the recommended deployment method for organizations with more than 20 users.

The feature relies on Azure Active Directory’s license management engine. The engine checks group membership every 24 hours by default and applies or removes licenses accordingly. You can also trigger an immediate re-evaluation by navigating to the group’s license blade and selecting Reprocess. Group-based licensing supports both security groups and Microsoft 365 groups, but security groups are the most common choice for license deployment.

Prerequisites Before You Start

Before assigning Copilot licenses by group, verify the following requirements are in place:

• An Azure AD tenant with at least one Global Administrator or License Administrator role assigned to your account.
• Sufficient Copilot license quantity in your Microsoft 365 subscription. Check availability in the admin center under Billing > Licenses.
• Each target user must already have a qualifying base license such as Microsoft 365 E3, E5, Business Standard, or Business Premium. Copilot is an add-on and cannot be assigned without a base license.
• The group you plan to use must be a security group that is not a dynamic device group. Dynamic user groups are supported.

Steps to Assign Copilot Licenses by Group

1. Create a security group in Azure AD
   Sign in to the Microsoft Entra admin center. Go to Identity > Groups > All groups. Select New group. Set Group type to Security. Enter a group name such as Copilot-Licensed-Users. Set Membership type to Assigned or Dynamic User depending on your needs. Click Create.
2. Add users to the security group
   Open the group you created. Go to Members > Add members. Search for and select the users who should receive Copilot. Click Select. For dynamic groups, configure a membership rule based on user attributes such as department or job title.
3. Open the Microsoft 365 admin center and locate Copilot licenses
   Go to admin.microsoft.com. Navigate to Billing > Licenses. In the list of products, select Microsoft 365 Copilot. If you do not see the product, verify that you have purchased Copilot licenses and that your account has the Global Admin or License Admin role.
4. Assign licenses to the group
   On the Copilot license page, select Assign licenses. In the Assign licenses panel, choose Groups. Type the name of the security group you created in step 1. Select the group. Ensure the toggle for Microsoft 365 Copilot is set to On. Click Assign. The system will begin processing the assignment. This may take up to 24 hours for the first sync.
5. Verify license assignment
   After a few minutes, navigate to the group in Azure AD. Go to Licenses > Assigned products. You should see Microsoft 365 Copilot listed. To check a specific user, go to the user’s profile in Azure AD and view Licenses. The Copilot add-on should appear under Assigned product licenses.
6. Force immediate license processing if needed
   If users do not see Copilot after 30 minutes, open the group in Azure AD. Go to Licenses > Assigned products. Select the Copilot license row. Click Reprocess. This triggers an immediate evaluation of all group members.

If Copilot Licenses Do Not Apply After Group Assignment

Users do not see Copilot in their Microsoft 365 apps

The most common cause is a missing or expired base license. Copilot requires an active Microsoft 365 E3, E5, Business Standard, or Business Premium license on the same user account. Open the user’s license assignments in the admin center and confirm the base license is present and not in a grace period or disabled state. If the base license is fine, check that the user has been added to the correct security group and that the group is not a mail-enabled security group, which Azure AD does not support for group-based licensing.

License assignment shows as failed in Azure AD

Azure AD logs license assignment errors in the group’s activity log. Go to the group in Azure AD, select Licenses, and look for a Failed status next to the Copilot product. Common error codes include DuplicateServicePlans, which occurs when a user already has a conflicting license, and NotAvailableForProduct, which indicates insufficient license quantity. Resolve the underlying issue and then click Reprocess on the group’s license blade.

Dynamic group membership does not update

Dynamic group rules evaluate user attributes that are stored in Azure AD, such as department or country. If a user’s attribute changes but the group membership does not update, verify that the attribute value is correctly populated in the user’s Azure AD profile. Also confirm that the dynamic group rule syntax is valid. Use the Rule builder in Azure AD to test the rule against a sample user. After correcting the rule or data, wait up to 30 minutes for the group to re-evaluate.

Group-Based Licensing vs Individual Assignment: Key Differences

Item	Group-Based Licensing	Individual Assignment
Setup effort	One-time group creation and license assignment	Manual per-user assignment, error-prone at scale
License reclamation	Automatic when user leaves the group	Manual removal required
Processing speed	Up to 24 hours for initial sync; Reprocess for immediate effect	Instant per user
Best for	Organizations with 20+ users or dynamic team structures	Small teams or pilot deployments
Dynamic user support	Yes, via dynamic membership rules	Not applicable

Group-based licensing is the preferred method for production deployments because it scales without manual intervention. Individual assignment remains useful for testing Copilot with a handful of users before rolling out to the entire organization.

You can now assign Microsoft 365 Copilot licenses to an entire department by adding users to a security group. Use dynamic group rules to automate membership based on job title or location. For large deployments, create multiple groups for different regions or business units and assign Copilot licenses to each group separately.