Groups, Shared Mailboxes and Licensing at Scale
Master Microsoft 365 Groups, distribution lists, security groups, shared mailboxes, group-based licensing, and licence monitoring — the backbone of organised admin.
Groups and licensing — the connective tissue of M365
Groups are how Microsoft 365 organises people. Licensing is how you give those people access to services. Get both wrong and you’ll spend your weekdays fixing permissions and your weekends explaining licence costs.
Think of groups like different types of meeting invitations: some give you access to a shared workspace (M365 Groups), some just put you on an email list (distribution lists), some control access to resources (security groups), and some do a bit of everything.
Licensing at scale means assigning licences automatically through groups instead of one user at a time — then monitoring for waste.
Group types compared
| Feature | M365 Group | Distribution List | Security Group | Mail-Enabled Security |
|---|---|---|---|---|
| Primary purpose | Collaboration | Email distribution | Access control | Access control + email |
| Shared mailbox | ||||
| SharePoint site | ||||
| Teams team | Yes (optional) | |||
| Planner | ||||
| Can assign licences | ||||
| Dynamic membership | Yes (Entra P1+) | Yes (Entra P1+) | ||
| Managed in | M365/Entra admin center | Exchange admin center | Entra admin center | Exchange admin center |
| Can contain guests |
When to use which group type
| Scenario | Best Group Type | Why |
|---|---|---|
| Project team needs shared email, files, and a Teams channel | Microsoft 365 Group | Creates the full collaboration stack automatically |
| All-staff announcements (one-way email) | Distribution List | Simple email fan-out, no shared resources |
| Control access to a SharePoint site or Azure resource | Security Group | Purpose-built for access control |
| Finance team needs email AND access control for a SharePoint site | Mail-enabled Security Group | Combines distribution with access control |
Shared mailboxes
A shared mailbox is a mailbox that multiple users can access without needing individual credentials. Common uses: info@company.com, support@company.com, invoices@company.com.
| Feature | Shared Mailbox | M365 Group Mailbox |
|---|---|---|
| Licence required | No (up to 50 GB) | No (for the group) |
| Send as / Send on behalf | Yes | Yes (Send As via PowerShell, Send on Behalf via admin center) |
| Shows in Outlook automatically | Yes (auto-mapped) | Yes (if subscribed) |
| Calendar | Yes (shared calendar) | Yes (group calendar) |
| Needs a password | No — accessed via delegation | No — accessed via group membership |
| Best for | Functional mailboxes (support, info) | Team collaboration email |
Exam tip: Shared mailbox size and licensing
Shared mailboxes are free up to 50 GB. If the mailbox exceeds 50 GB, you must assign a licence (Exchange Online Plan 2 or an M365 licence). This bumps the limit to 100 GB. The exam may ask: “The support shared mailbox is at 48 GB and growing. What should Marcus do?” Answer: Assign a licence or implement a retention policy to manage mailbox size.
Also note: shared mailboxes should NOT have passwords or direct sign-in. If you need to sign in directly (e.g., for a service account), convert it to a regular user mailbox with a licence.
Group-based licensing
Instead of assigning licences to individual users, you assign licences to groups. When a user joins the group, they automatically get the licence. When they leave, the licence is removed.
How it works
- Create a security group or M365 Group — e.g.,
LIC-M365-E5-Users - Assign licences to the group in Entra admin center > Groups > select group > Licences
- Add users to the group — directly or via dynamic membership rules
- Licences are assigned automatically — Entra processes the assignment
- Monitor for errors — Entra shows processing status and any conflicts
Dynamic groups for automatic licensing
Dev sets up dynamic groups for NimbleCloud’s clients:
# Dynamic membership rule example
(user.department -eq "Engineering") and (user.country -eq "United Kingdom")When a new engineer in the UK is created, they automatically join the group and receive their M365 E5 licence. No manual intervention needed.
Licence monitoring
| Where to Monitor | What It Shows |
|---|---|
| M365 admin center > Billing > Licences | Available vs assigned per subscription |
| Entra admin center > Groups > Licence processing | Group-based assignment status, errors |
| Usage reports | Licensed vs actually active users |
| Microsoft Graph API | Programmatic licence queries for dashboards |
Common group-based licensing errors
| Error | Cause | Fix |
|---|---|---|
| Not enough licences | More group members than available licences | Purchase more licences or remove users |
| Conflicting service plans | User is in two groups assigning conflicting services | Adjust group membership or disable specific service plans on one group |
| Missing usage location | User doesn’t have usage location set | Set usage location before licence assignment |
| Service plan dependency | A disabled service plan is required by another enabled plan | Enable the dependent service plan |
Deep dive: Managing licence conflicts
When a user belongs to multiple groups that assign licences, conflicts can occur. For example:
- Group A assigns M365 E3
- Group B assigns M365 E5
Since E5 includes all E3 service plans, this creates an over-assignment (cost waste, not a processing error). The resolution:
- Remove the user from the E3 group — E5 already includes everything in E3, so no functionality is lost
- Or use service plan toggles to disable specific plans in one assignment
The Entra admin center flags these conflicts in the group’s licence processing status. The exam expects you to identify and resolve these scenarios.
Key concepts to remember
Knowledge check
Dev needs to set up a functional email address (support@nimblecloud.com) that three help desk staff can monitor and respond from. No individual licence should be consumed. What should Dev create?
Marcus creates a security group called 'LIC-M365-E5' and assigns Microsoft 365 E5 licences to it. He adds 200 users but 15 users show a licence processing error. The error is 'Missing usage location.' What should Marcus do?
Next up: Automate with PowerShell: Bulk User Operations — why real admins script it once and never click again.