Undo-deprovision of an object previously licensed through Azure Group-Based licensing will have the previous license assigned directly (4369415)

Undo-deprovision of an object previously licensed through Azure Group-Based licensing will have the previous license assigned directly

When an object is deprovisioned in Active Roles, Azure licenses are also removed as a built-in part of the deprovisioning process. When an undo deprovisioning task is performed on the same objects, the previously assigned license is then reinstated automatically.

When using Azure Group-Based licensing, licenses are assigned according to an object's group memberships, rather than directly. When an object that is licensed in this manner is deprovisioned in Active Roles, the object's group memberships are removed and in turn the license is revoked. When undoing the deprovisioning an object in Active Roles that was previously licensed solely through group-based licensing, the license is then added back directly, rather than allowing the license to be automatically re-added via group memberships.

This issue has been identified as a product defect and assigned the Defect ID 388433.

WORKAROUND 1

Monitor un-deprovisioned objects and remove direct assigned licenses as needed.

WORKAROUND 2

Add the Office 365 License Retention policy object in the Deprovision policy and checked off "Retain all licenses assigned to Azure user". This way, no licenses are logged into the change history for it, so nothing is re-added upon undo-deprovision. The user gets placed back into the group membership and gets the group-assigned license again.

Note: Make sure the deprovision policy is not applied somewhere where there are mixed user-assigned and group-assigned licenses.

STATUS

Awaiting resolution in a future release of Active Roles.

388433