How to switch Visual Studio license assignment from individuals to groups
13 May 2026
So – you’ve been dutifully opening the Visual Studio Subscriptions Admin Portal, adding individual users, removing them when they leave, and generally keeping the whole thing running? Yay – very happy it works. But there’s a slightly more enterprise-friendly way to assign Visual Studio licenses using Entra security groups, if your identity provider is Microsoft Entra ID (formerly known as Azure Active Directory).
After one afternoon of initial setup, your day-to-day job switches from “add or remove someone in the Visual Studio admin portal” to “add or remove an Entra group member.”
What’s in it for you
Managing licenses
This might not seem like a sea change, but the nifty thing is that it’s likely your enterprise IT department already has some pretty mature bread-and-butter processes for adding and removing Entra group members in response to business-level requests (e.g. through the helpdesk ticketing system, or automatically removing group members whom HR systems report are no longer employees of the enterprise at all).
So you might be able to get out of the manual grant-and-revoke business altogether.
Reporting licenses
Also, if the Finance department ever wants more confidence that Microsoft is granting entitlements (such as Azure DevOps licensure or GitHub Enterprise Cloud licensure) appropriately according to Visual Studio license level, the Finance department won’t have to wait on you personally to export a list of Visual Studio license levels from the Visual Studio admin portal.
Instead, any old staff member with access to see which employee is a member of which Entra security group (which is often everyone at a company) could pull that report of “who’s got which Visual Studio license level,” as long as they know the names of the relevant Entra security groups.
Step 1 - group creation
First, figure out the number of Entra security groups that makes sense for your enterprise to create. The most common approach is one group per Visual Studio subscription level – for example, two Entra groups named:
- Licensed Visual Studio Enterprise Subscribers
- Licensed Visual Studio Professional Subscribers
For each Entra security group you need created, you’ll need to provide your Entra administrator (or whoever handles group creation in your org; there’s probably a helpdesk ticket type for it) with the following details:
| Field | Example |
|---|---|
| Name | Licensed Visual Studio Enterprise Subscribers |
| Description | All members of this group have been assigned a Visual Studio Enterprise subscription via the VS Subscriptions Admin Portal. |
| Owners | You and some backups (note: an “owner” of an Entra security group can in turn be another Entra security group, if that makes it easier to add your whole department in one fell swoop) |
| Starting members | The list of people who currently have that license level (note: as of the time of this writing, each “member” of this Entra security group must be a direct human, and cannot be another Entra security group – Entra wouldn’t complain about nested groups, but Visual Studio would ignore indirect group membership) |
That’s it. Submit that request and wait for confirmation that the groups exist (and, hopefully, are populated with the correct starting members, so you don’t have to do it – but if they leave the membership list empty, read on and add everyone using the usual processes you’ll use as additional people request licensure over time).
Step 2 - Reassign Visual Studio licenses from individuals to groups
Once your new Entra security groups exist, follow Microsoft’s instructions assign Visual Studio licenses to those groups. As a recap, it’s more or less these steps:
- Go to https://manage.visualstudio.com and sign in.
- Navigate to the Manage Subscribers tab.
- Click Add, then choose Microsoft Entra group from the dropdown.
- Type the name of your group in the search field and select it when it appears. You’ll get a preview of the members before committing.
- Choose the appropriate subscription level, set download rights and communication preferences as desired.
- Click Add, then Confirm.
Repeat for each group.
That’s the entire one-time setup.
Existing individual assignments are self-cleaning
Good news about existing individual assignments: according to Microsoft docs at the time of this writing, If someone already has an individual license assignment in the Visual Studio, but they’re also in an Entra security group that has that same license level assigned, the Visual Studio portal is smart about it. They get absorbed into the group assignment and the Visual Studio portal un-lists their individual assignment. Yay for not needing to manually clean up every old individual assignment!
Step 3 - verify it worked
Scroll to the bottom of your subscriber list and you’ll see your groups listed. Click View subscribers on a group to confirm the right people are showing up. Email a few of those individuals and ask them to spot-check that a few of those individuals can still access their Visual Studio benefits; they should see no interruption.
Step 4 - continue onboarding and offboarding
This is where your day-to-day process changes. You probably won’t end up in the Visual Studio administrative portal anymore, day-to-day.
Instead, going forward:
- Someone needs a Visual Studio license? Add them to the appropriate Entra group.
- Someone leaves or no longer needs the license? Remove them from the Entra group.
- Someone leaves the organization entirely? When their Entra account is disabled or removed, their license is revoked automatically — you don’t have to do anything.
A Few Things to Know
- Group-based assignment requires a trusted agreement type (Enterprise Commercial, Education, US Government, Campus, Select 6, or Select Plus). MPSA agreements aren’t supported.
- An Entra group can only be assigned one VS subscription level at a time. If you have a mix of Enterprise and Professional users, use separate Entra groups.
- You can’t edit individual subscriber details for group members (like their communications preferences or whether they have license key access) through the Visual Studio portal. If someone needs a one-off customization, have a new Entra Security Group created that they’re the only member of, and use the Visual Studio portal to set the new Entra Security Group’s permissions accordingly.
- Separate notification email addresses aren’t supported for group-managed subscriptions. Notifications go to the user’s primary Entra email (their UPN).
Summary
Here’s the old process:
| Cadence | What Happens | Who Does It |
|---|---|---|
| Ongoing | Add/remove people from the Visual Studio admin portal as needed | You or fellow VS portal admins |
And here’s the transition (new process in the last line):
| Transition Phase | What Happens | Who Does It |
|---|---|---|
| Planning | Identify groups needed, compile member lists | You (one time) |
| Group creation | Request Entra groups with name, description, owners, members | Entra admin, as requested by you (one time) |
| Portal setup | Add each Entra group to the Admin Portal with subscription level | You (one time) |
| Verify | Confirm members show up and licenses are active | You (one time) |
| Ongoing | Add/remove people from the Entra group as needed | You or fellow group owners, or maybe even central IT for you |
The whole transition should only be a few minutes/hours of hands-on work. Most of the delay will involve waiting on the Entra security group creation request to be fulfilled by your central IT team.
After that, managing Visual Studio licenses stops being a portal task and becomes a simple Entra security group membership management task – one that, if you’re really lucky, can be automated by colleagues who automate Entra security group membership every day.
Disclosure
This post was heavily LLM-generated, with just a bit of editing, sorry, friends! It seemed useful enough to just “git ‘er done” on a busy day and delegate to the writing-machine.
