Monthly Archives: August 2026

Group based licensing and suspended license status…

In a previous blog post, I wrote about the group-based licensing model being an all or none proposition.

Group Based Licensing – an all or none proposition… | TIMMCMIC

When I wrote this post the majority of escalations I was receiving were had a common theme. A group assigned more than one licenses and one of the licenses in the group had no more available licenses.

Recently, I’ve received several escalations where the symptoms are the same but the circumstances are different. A review of the audit logs associated with the users who fail to receive a license indicates that not enough licenses exist. The failure though is not that the license is valid with zero licenses, but one of the licenses on the group is in a suspended or warning status.

Customers may, during a renewal, upgrade the licenses that they have purchased. For example, a renewal may include upgrading from M365 E3 licenses to M365 E5 licenses. Depending on when the renewal is processed, it is possible that the licenses will overlap. The E5 will become active before the E3 expires.

When licenses overlap, group based licensing provides an excellent opportunity to add the new license while still retaining the old license on the user. Although I prefer swapping the licenses personally, many organizations desire to have the dual license assignment to introduce the E5 before removing the E3. Note: This works as long as there is no overlapping service plans.

The issue is that the E3 licenses, in this example, is not removed from the group prior to it entering a suspended status. When a license has entered a suspended status, although it remains valid within the tenant no further license assignments will occur. Therefore, the all or none implementation of group based licensing occurs and new users added to the group receive no licenses. The audit log error leads you to believe that you are out of a specific license, yet when looking at the new license you are assigning there are plenty of free licenses available. Suspended licenses have a count of zero regardless of how many were available at the time the license went into a suspended state.

If you are leveraging a migration between licenses using the dual license approach, it is important that the original licenses be removed from the group prior to the license entering a suspended state. Although the service will eventually clean up all expired licenses from the tenant, while the license exists in a suspended state and appears on a group license assignment will stop.

GCC High, DNS Records, and the M365 Admin Center

Microsoft recently enabled the domains tab in GCC High tenants. This has brought parity to the management capabilities for domains between commercial and GCC High tenants.

It’s finally here! The domains tab in GCC High… | TIMMCMIC

Microsoft 365 GCC High Tenants and Missing Domains | TIMMCMIC

In recent weeks I have worked with several GCC High customers that have opened cases due to the DNS errors that are present in the M365 Admin centers domain tabs. The domains tab in the M365 admin center attempts to compare a tenants DNS records to those discovered in public DNS and highlight potential issues.

DNS Errors and Warnings in the Office 365 Portal | Microsoft Learn

There are several reasons that customers may have DNS errors listed in the M365 admin center. For example, if you still have an Exchange on-premises installation your autodiscover record may point to this installation – that is perfectly acceptable. The health checks contained within the M365 admin center assume a Microsoft 365 exclusive installation.

For GCC High customers the circumstances are slightly different. Prior to the implementation of the domains tab GCC High customers were advised to calculate their DNS records manually.

Domain Name System (DNS) records for Office 365 Government Community Cloud (GCC) High – Microsoft 365 Enterprise | Microsoft Learn

Enable autodiscovery of Intune enrollment server – Microsoft Intune | Microsoft Learn

If you had previously adopted GCC High and followed the published guidance above, you will automatically have DNS errors in the M365 Admin center. The new DNS records published in the M365 admin center for GCC High customers follow the same format now as the commercial records.

Here is a summary table of before and after based on the domain contoso.us

Record TypeRecord NameOld ValueNew Value
MXN/Acontoso.mail.protection.office365.uscontoso-us.mail.protection.office365.us
TXTN/Av=spf1 include:spf.protection.office365.us -allv=spf1 include:spf.protection.office365.us -all
CNAMEautodiscover.contoso.usautodiscover.office365.usautodiscover.office365.us
SRV_sipfederationtls.contoso.ussipfed.online.gov.skypeforbusiness.ussipfed.online.lync.com
CNAMEenterpriseenrollment.contoso.usenterpriseenrollment-s.manage.microsoft.usenterpriseenrollment-s.manage.microsoft.us
CNAMEenterpriseregistration.contoso.usenterpriseregistration.windows.netenterpriseregistration.microsoftonline.us

The entries in the table above that are bolded represent the difference between our manual calculate guidance and the DNS records that are published in the M365 admin center. You can additionally review the records provisioned for your tenant by using the Microsoft Graph command Get-MgDomainServiceConfigurationRecord. Get-MgDomainServiceConfigurationRecord (Microsoft.Graph.Identity.DirectoryManagement) | Microsoft Learn

Is it necessary to change the DNS records for tenants that are already established? No – it is not necessary to change the DNS records at this time. The DNS records calculated manually will continue to function for GCC High customers. Customers may choose to update to the new records now that they are available for conformity to what is published within their tenant. I would recommend for new domains added to GCC High tenants that the new DNS record formats be utilized. This will help prevent issues with automatic DNS checks in the M365 admin center when adding the domain.