MS Entra – Users – Assign Licenses

Assign or remove licenses for a user.

Action details

Property	Value
Action label	MS Entra – Users – Assign Licenses
Category	CloudTools
Apex class and method	AssignEntraLicense.assignLicenses
Input type	AssignEntraLicense.AssignEntraLicenseInput
Output type	List<DynamicObject>
Authorization	Microsoft 365 connector; supported authorization depends on the endpoint and target.
Microsoft Graph request	POST /users/{userIdOrPrincipalName}/assignLicense

Prerequisites and permissions

Configure a CloudTools Connector with Connector Type set to Microsoft 365. Complete sign-in for OAuth Delegated (Authorization Code). For supported OAuth Application (Client Credentials) requests, grant application permissions and administrator consent. The identity must have access to the selected resource; directory operations can also require Microsoft Entra roles. Use Creating an Entra ID App and Integration Connectors for setup.

The action permission provider declares these alternatives. They are not cumulative requirements or universally interchangeable; check the Microsoft reference for endpoint, target, and property restrictions.

Permission type	Declared alternatives
Delegated	LicenseAssignment.ReadWrite.All, AgentIdUser.ReadWrite.All, AgentIdUser.ReadWrite.IdentityParentedBy, Directory.ReadWrite.All, User.ReadWrite.All
Application	LicenseAssignment.ReadWrite.All, AgentIdUser.ReadWrite.All, AgentIdUser.ReadWrite.IdentityParentedBy, Directory.ReadWrite.All, User.ReadWrite.All

Endpoints: /users/{userIdOrPrincipalName}/assignLicense. Delegated callers also require a supported license-administration role.

See the Microsoft operation and permissions reference.

Inputs

Input	Apex field	Type	Required	Description
User Id or Principal Name	userIdOrPrincipalName	String	Yes	User id or user principal name to update
Add Licenses	addLicenses	List<AssignedLicenseInput>	Yes	Assigned license objects to add
Remove Licenses	removeLicenses	List<String>	Yes	License SKU ids to remove

Supply a nonempty list with a non-null first request. Graph actions process only that first request. Global inputs do not expose connectorId; subscriber Apex and Flow use CloudTools connector selection. Use Microsoft Graph resource IDs or the specifically documented user identifier, and resolve dynamic values before invocation.

Add Licenses fields (AssignedLicenseInput)

Field	Apex field	Type	Required	Description
SKU Id	skuId	String	Yes	SKU identifier to assign
Disabled Plans	disabledPlans	List<String>	No	Service plan identifiers to disable

Outputs

Returns a flat list of DynamicObject properties mapped from the Microsoft user response. This is neither a license collection nor an operation success object.

Output	Apex field	Type	Description
Property Name	name	String
Property Value	value	String

Behavior and limits

Add Licenses and Remove Licenses must both be non-null collections, even if one is empty. Each added license requires skuId and can include disabledPlans. License assignment depends on available SKUs, user eligibility, usage location, and directory roles. It does not return a flat license inventory.

Use in Flow

Use MS Entra – Users – Assign Licenses where supported. Use a Microsoft 365 application connector configured as Set as default for Flow automations only if the endpoint and target support application access. Supply required values, retain useful outputs, and add fault handling. Delegated connections are not supported for CloudTools Flow automation. The action processes only the first input request.

Use in custom Apex

This subscriber-org example uses the Apptigent namespace. Replace identifiers and example values before use. Configure the connector, complete authorization first, run in a context permitting callouts, and handle exceptions, empty results, and unmapped fields.

Apptigent.AssignEntraLicense.AssignEntraLicenseInput request =
    new Apptigent.AssignEntraLicense.AssignEntraLicenseInput();
request.userIdOrPrincipalName = '87d349ed-44d7-43e1-9a83-5f2406dee5bd';
request.addLicenses = new List<Apptigent.AssignEntraLicense.AssignedLicenseInput>{ /* supply values for this operation */ };
request.removeLicenses = new List<String>{ /* supply values for this operation */ };

Apptigent.AssignEntraLicense.AssignedLicenseInput license =
    new Apptigent.AssignEntraLicense.AssignedLicenseInput();
license.skuId = 'REPLACE_WITH_SKU_ID';
license.disabledPlans = new List<String>();
request.addLicenses.add(license);

List<Apptigent.DynamicObject> results =
    Apptigent.AssignEntraLicense.assignLicenses(
        new List<Apptigent.AssignEntraLicense.AssignEntraLicenseInput>{ request }
    );
System.debug(results);

Use in a Lightning Web Component

Use assignEntraLicense from msEntraConnectorLib through MSEntraConnectorController. These c/ imports apply in the same namespace. Set request.connectorId for direct MSEntraAction calls. The controller captures the request selection for MSEntraAction.

Global input	LWC request mapping
userIdOrPrincipalName	request.userIdOrPrincipalName
addLicenses	addLicenseSkuIds
removeLicenses	removeLicenseSkuIds

entraActionExample.js

import { LightningElement } from 'lwc';
import { assignEntraLicense } from 'c/msEntraConnectorLib';

export default class EntraActionExample extends LightningElement {
    result = null;
    errorMessage = '';
    isRunning = false;
    completed = false;

    async handleRun() {
        if (this.isRunning || this.completed) return;
        this.isRunning = true;
        this.errorMessage = '';
        try {
            const request = { connectorId: 'REPLACE_WITH_CONNECTOR_RECORD_ID' };
            request.userIdOrPrincipalName = '87d349ed-44d7-43e1-9a83-5f2406dee5bd';
            request.addLicenseSkuIds = ['REPLACE_WITH_SKU_ID'];
            request.removeLicenseSkuIds = [];
            this.result = await assignEntraLicense(request);
            this.completed = true;
        } catch (error) {
            this.errorMessage = error.requiresInteractiveAuthorization
                ? 'Sign in to Microsoft for the connector, then try again.'
                : error.message || 'The Entra action failed.';
        } finally {
            this.isRunning = false;
        }
    }
}

entraActionExample.html

<template>
    <lightning-button label="Run action" onclick={handleRun}
        disabled={isRunning}></lightning-button>
    <p role="alert">{errorMessage}</p>
</template>

The library returns one mapped DTO or null. The controller can flatten nested fields, serialize data, or map an action result into an operation DTO. rawJson contains serialized mapped Apex data rather than the untouched Graph response.

LWC returns an operation result with success=true after invocation and rawJson containing the mapped DynamicObject list. It supports SKU ID arrays but initializes disabledPlans as empty; use global Apex for per-license disabled service plans.

Use getMSEntraAuthorizationState, beginMSEntraAuthorization, and createMSEntraOAuthMessageHandler to arrange delegated sign-in. The library normalizes errors but does not automatically sign in or retry. Reset completed for a new deliberate operation, and inspect resource state before retrying a mutation with an uncertain outcome.

Error handling and troubleshooting

Symptom	What to check
Required fields error	Supply a nonempty request list and required or conditionally required inputs. For LWC, use the mapped field names.
Authorization or access denied	Check connector selection, sign-in, endpoint/target permission support, administrator consent, directory roles, and resource access.
Resource not found	Check Microsoft IDs and parent resource relationships. Preserve group/drive/item associations and mailbox/calendar/event IDs.
Missing or unexpected output	Check query support, pagination, wrapper versus item models, public-only properties, and mapped DTO fields.
Operation rejected	Inspect the Microsoft error, supported writable fields, group/calendar restrictions, recipient/license data, and file transfer limits.

See Entra connector introduction.