You need to purchase Microsoft Copilot licenses for only a subset of your organization, such as the sales team or the executive board. Assigning licenses individually from the Microsoft 365 admin center is the standard method, but it becomes time-consuming when dealing with many users. This article explains how to buy and assign Copilot licenses specifically for a user group using group-based licensing in Azure AD. You will learn the prerequisite steps, the exact configuration process, and common pitfalls to avoid.
Key Takeaways: Assign Copilot Licenses to a Specific Group
- Azure AD group-based licensing: Automates Copilot license assignment for all members of a security group, eliminating manual per-user work.
- Microsoft 365 admin center > Billing > Purchase services: Where you buy Copilot for Microsoft 365 licenses before assigning them.
- Azure AD portal > Licenses > All products > Copilot: The location to configure group assignment and verify license consumption.
Understanding Group-Based Licensing for Copilot
Group-based licensing lets you assign a product license, such as Copilot for Microsoft 365, to an Azure AD security group. When you add a user to the group, Azure AD automatically assigns the Copilot license. When you remove a user, Azure AD removes the license. This method works for both cloud-only users and synced on-premises users. The prerequisite is that your tenant must have Azure AD Premium P1 or P2 licenses. Group-based licensing does not require any additional software or scripts. It uses the built-in license management engine in Azure AD.
Before you start, confirm that your organization owns enough Copilot for Microsoft 365 licenses to cover the users in the target group. If you buy fewer licenses than group members, Azure AD will assign licenses on a first-come, first-served basis and report errors for the remaining users. You also need the Global Admin or License Administrator role to perform the steps below.
What Group-Based Licensing Does Not Do
Group-based licensing does not create the Azure AD security group for you. You must create the group manually before assigning the license. It also does not handle multi-license scenarios automatically. If a user needs both Copilot and another product that also uses group licensing, you must assign each product separately to the same group or use nested groups.
Steps to Buy and Assign Copilot Licenses to a Specific User Group
Follow these steps to purchase Copilot licenses and configure group-based assignment. The process has three phases: buying licenses, creating the security group, and assigning the license to the group.
Phase 1: Purchase Copilot for Microsoft 365 Licenses
- Sign in to the Microsoft 365 admin center
Go to admin.microsoft.com and sign in with an account that has Global Admin or Billing Admin role. - Navigate to Billing > Purchase services
In the left navigation pane, select Billing then Purchase services. The page shows available subscription offers. - Search for Copilot for Microsoft 365
Use the search bar at the top of the page. Type Copilot and press Enter. The results will show Copilot for Microsoft 365 and other related plans. - Select the plan and configure quantity
Click Details on the Copilot for Microsoft 365 tile. On the product page, enter the number of licenses you need in the User licenses field. For example, enter 50 if you have 50 users in the sales team. Click Buy. - Complete the purchase
Review the order summary and select a billing frequency. Click Place order. The licenses appear in your tenant within a few minutes.
Phase 2: Create an Azure AD Security Group for the Target Users
- Open the Azure AD admin center
Go to aad.portal.azure.com and sign in with a Global Admin account. - Go to Groups > All groups
In the left navigation, select Groups then All groups. - Create a new group
Click New group. In the Group type dropdown, select Security. Enter a name such as Copilot – Sales Team. Set Membership type to Assigned. Add the users who need Copilot licenses. Click Create. - Verify the group membership
Open the group you just created and click Members. Confirm that all intended users are listed.
Phase 3: Assign the Copilot License to the Security Group
- Navigate to Azure AD > Licenses
In the Azure AD portal, select Licenses from the left navigation pane. - Select All products
Under the Manage section, click All products. A list of license products in your tenant appears. - Choose Copilot for Microsoft 365
Find Copilot for Microsoft 365 in the list. If you just purchased it, it may take up to 10 minutes to appear. Click the product name to open its details page. - Assign the license to the group
Click Licensed groups at the top, then click + Assign. In the Select groups pane, search for the group you created earlier, for example Copilot – Sales Team. Select it and click Assign. - Wait for license propagation
Azure AD processes the assignment in the background. For groups with fewer than 100 members, licenses are usually assigned within 5 minutes. For larger groups, it can take up to 24 hours. You can check the status by going back to the group and clicking Licenses. - Verify license assignment for a user
Open a user profile in Azure AD and click Licenses. Confirm that Copilot for Microsoft 365 appears as Assigned.
Common Issues with Group-Based Copilot License Assignment
Not Enough Licenses for All Group Members
If your tenant has fewer Copilot licenses than the number of members in the group, Azure AD will assign licenses to some users and leave others unlicensed. The group’s Licenses blade shows an error for each unlicensed user. To fix this, buy additional Copilot licenses from the Microsoft 365 admin center. After the purchase, Azure AD will automatically assign the remaining licenses within a few minutes.
Copilot License Not Appearing in the Azure AD License List
Newly purchased Copilot licenses can take up to 24 hours to appear in the Azure AD license list. Wait at least 30 minutes before troubleshooting. If the license still does not show, verify the purchase was completed in the Microsoft 365 admin center under Billing > Your products. If the subscription is active but still missing, open a support ticket from the admin center.
User Already Has a Copilot License Assigned Directly
When a user already has a Copilot license assigned directly through their user profile, adding them to a group with group-based licensing can cause a conflict. Azure AD shows a Conflict status on the user’s license page. To resolve this, remove the direct license assignment from the user profile. After removal, the group-based license will apply without conflict.
Group-Based Licensing vs Direct Assignment: Key Differences
| Item | Group-Based Licensing | Direct Assignment |
|---|---|---|
| Management method | Azure AD security group | User profile in admin center |
| Scalability | Handles hundreds of users automatically | Manual, prone to error for large groups |
| User addition | License assigned automatically when user joins group | Admin must assign license manually |
| User removal | License revoked automatically when user leaves group | Admin must remove license manually |
| Required Azure AD license | Azure AD Premium P1 or P2 | None (uses free tier) |
| Error handling | Reports errors per user on the group license blade | No bulk error reporting |
You can now purchase Copilot for Microsoft 365 licenses and assign them to a specific user group using Azure AD group-based licensing. This method saves time and reduces errors compared to assigning licenses one by one. Start by buying the correct number of licenses, create a security group with the target users, and assign the license to that group. For ongoing management, monitor the group’s license blade for errors and adjust license counts as your team grows. As an advanced tip, you can use dynamic membership rules in Azure AD to automatically add users to the Copilot group based on their department or job title, making license management fully automated.