GroupAssignmentFeatureToggle lock

Question

We are unable to assign security groups to enterprise applications in our tenant. The UI states:

“Groups are not available for assignment due to your Active Directory plan level. You can assign individual users to the application.”

This is incorrect for our environment. All users in the group have valid Microsoft 365 E3 licenses, which include Entra ID Premium P1 (formerly Azure AD Premium P1). Group-based assignments should be enabled.

We have confirmed:

• The group is a Security group (not Microsoft 365 group)
• All members have M365 E3 licenses assigned
• We are attempting this in the Microsoft Entra admin center
• Group is not role-assignable, nor dynamic
• The group is not nested or empty

We believe our tenant may be affected by a known issue referred to internally as a GroupAssignmentFeatureToggle lock, which blocks group-based assignment despite meeting licensing requirements.

Please verify and unblock group assignment functionality in our tenant. We are prepared to provide additional details if needed.

Thank you,

Answer 1

Hello Mike Bergman,

Thank you for connecting offline to discuss the issue.

I’ve received an update from our engineering team. This issue has been reported by multiple customers, and the team is actively working on a fix. It will require a backend code change, which may take a few weeks to deploy.

In the meantime, as a workaround, you can use Microsoft Graph to assign groups to your applications. Please refer to the following documentation: Manage users and groups assignment to an application - Microsoft Entra ID | Microsoft Learn

If you need help running the necessary Graph queries to assign groups to your application, feel free to reach out—I’ll be happy to assist.

I’ll post an update here as soon as the fix is deployed.