Overview
The Groups tab in Optimization covers licenses that people receive through a Microsoft Entra ID group. It lists groups that have members who are disabled, inactive, or have never signed in, so you can raise one request per group to remove them. A License changes filter recommends removing a license from a group, or swapping it for a cheaper one, when the members who get it only through that group do not need it.
A license that comes from a Microsoft Entra ID group cannot be removed from a person directly while they stay in the group. This tab is where you act on those licenses.
Business value
Removing unused members from a Microsoft Entra ID group frees the paid seats that the group delivers. The tab shows how many seats each removal frees and what it saves, so you can clean up the groups that matter most first.
Prerequisites
Before you use the tab, connect the tenant and let it finish a sync that reads Microsoft Entra ID groups. See Connect a Microsoft 365 tenant.
Required permissions
You need Read on Optimization to view the tab. You need Manage on Optimization to add removal requests, ignore, and restore. For License changes, Manage on Optimization is required, and Manage on Explore is not enough. The Owner and Contributor roles have these permissions. The Reader role has Read only. For details, see Roles and permissions in Tenant Manager.
Dependencies
- Last sync: the tab shows the Microsoft Entra ID groups, members, and licenses that the last sync read.
- Licenses assigned to Microsoft Entra ID groups: License changes needs licenses that are assigned to groups in the tenant.
- Permission to change Microsoft Entra ID groups: to approve a group change, Turbo360 must be allowed to make that change in your tenant. For each type of change, any one of the Microsoft Graph application permissions below is enough. If none is granted, Approve is disabled on the task, and you can send the task to your IT team instead. Ask your Microsoft Entra administrator to grant one of them with admin consent. See License tasks.
- Microsoft Entra ID group license changes: LicenseAssignment.ReadWrite.All, Group.ReadWrite.All, or Directory.ReadWrite.All.
- Adding or removing Microsoft Entra ID group members: GroupMember.ReadWrite.All, Group.ReadWrite.All, or Directory.ReadWrite.All.
- Adding or removing Microsoft Entra ID group owners: Group.ReadWrite.All or Directory.ReadWrite.All. GroupMember.ReadWrite.All does not cover owner changes.
How it works
Select the tenant in the tree view, expand License management, select Optimization, and then select the Groups tab. The tab loads the first time you open it. The rules for a recommendation are in Recommendations and savings. This article shows how to read and use the tab.
A member is listed when the account is disabled, when the person has never signed in, or when the person has been inactive for longer than the Inactive line. A never-signed-in member is listed only when the account is older than 7 days and the tenant has sign-in data. Microsoft Entra ID groups that you cannot change by hand are left out. These are dynamic groups, groups synced from on-premises Active Directory, distribution lists, and mail-enabled security groups. Excluded users still appear in the list, and they are skipped when you raise the request.
Tiles and filters
Four tiles sit above the grid.
| Tile | What it shows |
|---|---|
| Groups to clean up | The number of Microsoft Entra ID groups with members to remove, and the total number of member removals. |
| Members affected | The members split into disabled, inactive, and never signed in. |
| Annual savings | The estimated yearly saving. A license is saved only when the Microsoft Entra ID group is the person's only source for it. |
| Already requested | The member removals that are waiting for a decision in Tasks. |
The filter pills cut the list.
| Filter | What it lists |
|---|---|
| All | Every Microsoft Entra ID group with members to remove. |
| Disabled | Microsoft Entra ID groups with disabled members. |
| Inactive | Microsoft Entra ID groups with inactive members. |
| Never signed in | Microsoft Entra ID groups with members who never signed in. |
| With licenses | Groups that assign at least one paid license. |
| License changes | Licenses to remove from a Microsoft Entra ID group or swap on a group. See the section below. |
| Ignored | Microsoft Entra ID groups with members you ignored. |
Columns and members to remove
These columns are shown by default. You can add the others in Column options.
| Column | What it shows |
|---|---|
| Group | The Microsoft Entra ID group name. |
| Members | The number of members. |
| Reason | Tags such as "3 Disabled", "2 Inactive", and "1 Never signed in". |
| Seats freed | The paid seats that these members get only from this Microsoft Entra ID group. A seat that a member also gets directly, or through another group, stays after the removal and is not counted. |
| Monthly savings | The monthly saving from removing these members. A dash means no price is known. |
| Ignored | Shown on the Ignored filter. The number of members you ignored. |
| Recommendation | A sentence that says how many members to remove, why, and how many seats it frees. |
The columns hidden by default are Licenses from group and Membership. Membership shows On-premises sync, Dynamic, or Assigned. Rows are sorted by seats freed, and then by the number of members. You can download the grid as "Tenant Manager - Optimization groups.xlsx".
Selecting a row opens a popup with a Members to remove checklist. Each member shows the email and the last activity, with a badge for the reason, Requested, or Ignored. Pills filter the list by Disabled, Inactive, and Never signed in. The footer adds the ticked members to tasks, or restores them on the Ignored filter. Select Explain in the summary card if you want an explanation in plain words. Select Hide to close it. For how explanations work, see Optimization overview.
License changes
This filter lists licenses that a Microsoft Entra ID group assigns, and recommends one of two changes. Tenant Manager looks only at members who get the license through that group alone. Members who also get it directly or through another group keep it.
| Recommendation | When Tenant Manager suggests it |
|---|---|
| Remove from group | None of the members who get the license only through this Microsoft Entra ID group use it. |
| Swap for a cheaper license | Every such member qualifies for the same cheaper license, which needs no add-ons, and the saving stays positive. |
The grid shows 50 rows per page, with these columns: Group, License, Recommendation, Members affected, Savings / month, Reason, and Actions. Hover over Members affected to see up to 10 people with the reason for each. A Microsoft Entra ID group is skipped when any member who gets the license only through it is excluded. A swap is blocked when the cheaper license does not have enough unassigned seats. You cannot ignore a row on this filter.
License changes look at how members use the license over the Evaluation duration in Recommendation settings. Members who are past the Inactive line in Filter settings do not qualify for a swap. To change either setting, see Optimization overview.
Steps
The steps below cover the common tasks on the Groups tab. You start in Optimization for the tenant, with the Groups tab open. For ignoring, restoring, and the settings, see Optimization overview.
Request removal of members from a Microsoft Entra ID group
This procedure raises one request to remove members from a Microsoft Entra ID group, which frees the seats the group delivers.
- Select the Add to tasks icon on a Microsoft Entra ID group row to request every listed member. To pick members, select the row, tick the members in Members to remove, and use the button in the footer that adds the ticked members to Tasks.
- Read the confirmation. Enter a note if you want to record a reason.
- Select Continue.
The request appears in Tasks with the status Awaiting approval. The task note reads "Added from the Groups tab" followed by the members, the reasons, and the seats freed. Members who are excluded, or who already have an open request, are skipped, and the message tells you why.
Request a license change for a Microsoft Entra ID group
This procedure raises a request to remove a license from a Microsoft Entra ID group, or to swap it for a cheaper one.
- Select the License changes filter.
- Select Add to tasks on a row.
- Read the confirmation. It says how many members lose the license, or that every member gets the cheaper license in its place.
- Select Continue.
When the request is approved, Tenant Manager makes the change on the Microsoft Entra ID group in Microsoft 365.
Ignore members of a Microsoft Entra ID group
This procedure hides members from the recommendation without changing anything in Microsoft 365.
- Check one or more Microsoft Entra ID groups, and select Actions > Ignore.
- Choose Ignore always, or choose Ignore until and pick a date.
- Enter a Description if you want to record why, and select Continue.
The ignore applies to everyone in the account, and to the listed members only. A member who becomes inactive later still appears. To bring the members back, open the Ignored filter and select Restore.
Permission behavior
What you can do on the tab depends on your role.
- Without Manage on Optimization, Add to tasks, Ignore, Restore, and Actions are disabled. Hover over one to see "You are not authorized to perform this operation".
- A request is blocked when removing these members is already waiting under Tasks.
- A member who is excluded is skipped when the request is raised, and the removal is refused again if you approve the task.
- Explain needs the Use AI agents permission and the account's AI agents switch. Without them, the button is hidden. On private hosting, it also needs an OpenAI connection.
Example scenario
Wide World Importers wants to know which Microsoft Entra ID groups hold seats that nobody needs. Oskar Nilsen, a module owner, opens Optimization for Wide World Oslo, selects the Groups tab, and sorts by Seats freed. The group Regional sales lists disabled and inactive members, and the recommendation says that removing them frees paid seats.
He selects the row, clears one member who is on leave, and adds the remaining members to Tasks. He then selects License changes and sees that an older license on the Microsoft Entra ID group Warehouse crew can be swapped for a cheaper one. He raises that request too.
Limitations
- Dynamic Microsoft Entra ID groups, groups synced from on-premises Active Directory, distribution lists, and mail-enabled security groups are not listed.
- Seats freed counts only seats that a member gets from that Microsoft Entra ID group alone.
- License changes swaps are for Microsoft Entra ID groups whose members need no add-ons. Per-person swaps are on the Users tab.
- You cannot ignore a row on the License changes filter.
- Recommendations come from the last sync. They are not live.
Troubleshooting
-
A Microsoft Entra ID group is missing although its members are inactive.
Cause: the group is dynamic, synced from on-premises Active Directory, or managed through Exchange.
Fix: change the membership at the source. -
Seats freed shows 0.
Cause: the members also get the licenses directly or through another Microsoft Entra ID group.
Fix: none is needed. Removing them from this group does not free a seat. -
A member was skipped and the message says the user is excluded.
Cause: the user is excluded from removals in Tenant Manager.
Fix: include the user in removals in Explore first, if the removal is intended. -
An expected Microsoft Entra ID group is not under License changes.
Cause: a member uses the license, or a member who gets it only through the group is excluded.
Fix: review the members of the group. -
A swap under License changes is blocked.
Cause: the cheaper license needs an unassigned seat for every member, and there are not enough.
Fix: free seats of the cheaper license, or buy more.
FAQs
-
Does removing a member from a Microsoft Entra ID group remove them from Microsoft 365?
No. The request removes the person from the Microsoft Entra ID group only. Their account stays. -
Why are excluded users still listed?
The list shows every member with a finding. The exclusion is applied when the request is raised and again when it is approved. -
Can I undo an approved removal?
Not from Tenant Manager. To reverse it, raise the opposite change, which is adding the member back.