Block ability to assign licenses directly to Azure users

Question

We use group-based M365 licensing rather than assigning directly to users, but occasionally an IT admin will incorrectly assign directly to the user. Is it possible to block the ability to directly assign to a user while allowing license assignment to a security group? Thanks.

Answer 1

As long as they have the perms, they can direct assign.

You could always create a scheduled task that removes any direct assignment:

https://www.alitajran.com/remove-direct-assigned-licenses-for-users-with-group-licenses/#h-step-3-run-remove-directlicense-powershell-script

More:

https://learn.microsoft.com/en-us/answers/questions/2121653/preventing-direct-license-assignments-in-azure-ad