Can I remove a feature from a specific user who has a group-based license?

Question

I have users in a dynamic-group-based license system in Azure AD. I want to disable a feature (let us say "Stream") for one particular user (let us say for disciplinary reasons). Can I do this while the user is in the dynamic group? That is, can I use a direct license to override the group license and disable Stream? Or would I have to remove this user from the dynamic group and apply only a direct license with Stream disabled? Or is there another way? Thanks.

Answer 1

I believe it's only possible to enable additional services by direct assignment, not disable them. Ideally, you would block them on the workload level (if it allows per-user control), and if that's not possible exclude him for the dynamic group.