Microsoft Identity and Access Administrator

In Azure Active Directory, Microsoft 365 Enterprise E5 licenses can be assigned to both security groups and Microsoft 365 groups, provided these groups have the 'SecurityEnabled' attribute set to true. Assuming the groups were created in the Azure AD portal where the 'SecurityEnabled' attribute is true by default, licenses can be assigned directly to the following groups: Group1, Group2, Group4, and Group5. Group3 is a dynamic device group, which does not make sense for user-based licensing like Office 365 Enterprise E5, so it is excluded. Hence, licenses can be assigned to Group1, Group2, Group4, and Group5.

To prevent users from creating user accounts in the contoso.com Azure AD tenant for self-service sign-up to Microsoft 365 services, you need to use the Set-MsolCompanySettings cmdlet. This cmdlet allows you to configure settings at the company level, including the ability to control whether users can perform self-service sign-up with the -AllowAdHocSubscriptions parameter set to $false. This will disable all self-service sign-ups for Microsoft cloud services in the tenant.

User2 will receive an email passcode. User1, being an existing guest user in the fabrikam.com domain, will continue using their existing authentication method and will not be emailed a passcode. User3, being a user within the fabrikam.com domain, will also not be emailed a passcode as they are already part of the organization.

The Licenses blade in the Azure Active Directory admin center is the correct tool for managing and removing licenses from users with minimal administrative effort. This interface allows administrators to view and modify license assignments for individual users or entire groups. By navigating to the Licenses blade, you can efficiently manage the reassignment or removal of Office 365 Enterprise E3 licenses after assigning Microsoft 365 Enterprise E5 licenses to the users.