MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
A company wants to ensure that all new users created in Microsoft 365 are automatically assigned a specific set of licenses based on their department. The company has 200 users across Sales, Marketing, and IT departments. Each department uses different Microsoft 365 license plans. Which approach should the administrator use?
⚠ Common exam trap
A common mix-up: candidates confuse 'group-based licensing' (which requires groups to be populated) with 'dynamic groups' (which automate group membership), leading them to choose Option B because they think group-based licensing alone is sufficient, but without dynamic groups, the groups must be manually maintained.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
C: Use Microsoft Entra ID Dynamic Groups to automatically add users to groups based on department, and then assign licenses to those groups.
Microsoft Entra ID Dynamic Groups can automatically add users to groups based on their department attribute (e.g., using a rule like `user.department -eq "Sales"`), and group-based licensing can then assign the appropriate Microsoft 365 license plan to each dynamic group. This ensures that any new user created with the correct department attribute is automatically added to the corresponding group and receives the license without manual intervention or scheduled scripts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A: Create a PowerShell script that runs on a schedule to assign licenses based on department attribute.
Why it's wrong here
This approach requires you to build, deploy, schedule, and maintain a custom PowerShell automation pipeline, typically using the Microsoft Entra ID PowerShell module or Microsoft Graph, to query each user's department attribute and then assign the matching license SKU. Because it runs on a timer, new users may wait until the next run before receiving a license, and any unhandled script error can leave users permanently unlicensed. It also creates operational debt for a scenario that Microsoft Entra ID can handle natively, so it is not the most appropriate answer.
- ✗
B: Use group-based licensing and assign each department's users to a security group with the appropriate license.
Why it's wrong here
Group-based licensing itself is the correct underlying mechanism, but this option requires manually placing each new user into the appropriate department-specific security group as part of your provisioning process. Any new user who is not manually added will not receive a license, so the solution does not meet the 'all new users automatically' requirement. The missing piece is automatic membership: dynamic groups should drive the group membership, while group-based licensing automatically applies the license to whichever users become members.
- ✓
C: Use Microsoft Entra ID Dynamic Groups to automatically add users to groups based on department, and then assign licenses to those groups.
Why this is correct
To meet the requirement, combine Microsoft Entra ID dynamic groups with group-based licensing: define a dynamic membership rule such as "user.department -eq 'Sales'" so Microsoft Entra ID automatically adds and removes users as their department attribute changes. When a new user is created with the department attribute set, Microsoft Entra ID evaluates the rule, adds the user to the matching group, and group-based licensing automatically assigns the appropriate license to that user without any manual or scripted intervention. This is a declarative, natively supported solution that scales to thousands of users and works in near real time for new directory objects.
- ✗
D: Manually assign licenses to each user after creation.
Why it's wrong here
Manually assigning licenses to each user after creation requires an administrator to identify every new user, determine the correct license SKU based on department, and click through the licensing UI for each account. This process does not scale, is error-prone, and can be easily missed for high-volume user creation, especially when the requirement is to ensure every new user is licensed at creation. It provides no automation and relies on continuous human action.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Groups and Teams Governance
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.