MS Entra – Users – Get User Licenses

Get license details for a user.

Action details

Property	Value
Action label	MS Entra – Users – Get User Licenses
Category	CloudTools
Apex class and method	GetEntraUserLicenses.getUserLicenses
Input type	GetEntraUserLicenses.GetEntraUserLicensesInput
Output type	List<List<MSEntraUserLicense>>
Authorization	Delegated access only for license details.
Microsoft Graph request	GET /users/{userId}/licenseDetails

Prerequisites and permissions

Configure a CloudTools Connector with Connector Type set to Microsoft 365. Complete sign-in for OAuth Delegated (Authorization Code). For supported OAuth Application (Client Credentials) requests, grant application permissions and administrator consent. The identity must have access to the selected resource; directory operations can also require Microsoft Entra roles. Use Creating an Entra ID App and Integration Connectors for setup.

The action permission provider declares these alternatives. They are not cumulative requirements, not all are least privileged, and a scope can have target-specific restrictions. Check the Microsoft operation reference before selecting permissions.

Permission type	Declared alternatives
Delegated	LicenseAssignment.Read.All, AgentIdUser.ReadWrite.All, AgentIdUser.ReadWrite.IdentityParentedBy, Directory.Read.All, Directory.ReadWrite.All, User.Read, User.Read.All, User.ReadWrite.All
Application	Not declared; see the endpoint restrictions.

Endpoints: /users/{id | userPrincipalName}/licenseDetails; Application permissions are not supported.

See the Microsoft operation and permissions reference.

Inputs

Input	Apex field	Type	Required	Description
User Id	userId	String	Yes	User id or user principal name to query.

Supply a nonempty list with a non-null first request. Graph actions process only that first request. Global inputs do not expose connectorId; subscriber Apex and Flow use CloudTools connector selection. Use Microsoft Graph resource IDs or the specifically documented user identifier, and resolve dynamic values before invocation.

Outputs

Returns an outer list containing one resource collection. It is not one collection for every input request. A null response or unmapped value produces an empty inner collection. This implementation creates a default result object when the response is null; an object alone does not prove that a resource was returned.

Output	Apex field	Type	Description
OData Context	odataContext	String	OData context value
Graph Tips	graphTips	String	Graph tips value
Value	value	List<MSEntraLicenseDetail>	License details

Behavior and limits

This implementation maps the returned collection without following or exposing @odata.nextLink. A result can contain only the first page; do not treat it as a complete tenant or resource inventory.

License detail endpoints require delegated access according to the Microsoft reference. Application authentication and consent do not make this endpoint support application access.

This action maps the response to MSEntraUserLicense wrapper objects rather than a flat collection of MSEntraLicenseDetail. Inspect the wrapper fields and value shape; do not feed these wrappers directly into the license-detail lookup helper, which expects List<MSEntraLicenseDetail>.

Read the wrapper.value collection to obtain List<MSEntraLicenseDetail> for the license lookup helper. The wrapper itself is not a license item.

Use in Flow

Use MS Entra – Users – Get User Licenses where supported. License detail access requires delegated authorization, which CloudTools Flow automation does not support. Use a delegated custom integration for this endpoint.

Use in custom Apex

This subscriber-org example uses the Apptigent namespace. Replace identifiers and example values before use. Configure the connector, complete authorization first, run in a context permitting callouts, and handle exceptions, empty results, and unmapped fields.

Apptigent.GetEntraUserLicenses.GetEntraUserLicensesInput request =
    new Apptigent.GetEntraUserLicenses.GetEntraUserLicensesInput();
request.userId = '87d349ed-44d7-43e1-9a83-5f2406dee5bd';



List<List<Apptigent.MSEntraUserLicense>> results =
    Apptigent.GetEntraUserLicenses.getUserLicenses(
        new List<Apptigent.GetEntraUserLicenses.GetEntraUserLicensesInput>{ request }
    );
System.debug(results);

Use in a Lightning Web Component

Use getEntraUserLicenses from msEntraConnectorLib through MSEntraConnectorController. These c/ imports apply in the same namespace. Set request.connectorId for direct MSEntraAction calls. The controller captures the request selection for MSEntraAction.

Global input	LWC request mapping
userId	request.userIdOrPrincipalName

entraActionExample.js

import { LightningElement } from 'lwc';
import { getEntraUserLicenses } from 'c/msEntraConnectorLib';

export default class EntraActionExample extends LightningElement {
    result = null;
    errorMessage = '';
    isRunning = false;
    completed = false;

    async handleRun() {
        if (this.isRunning || this.completed) return;
        this.isRunning = true;
        this.errorMessage = '';
        try {
            const request = { connectorId: 'REPLACE_WITH_CONNECTOR_RECORD_ID' };
            request.userIdOrPrincipalName = '87d349ed-44d7-43e1-9a83-5f2406dee5bd';
            this.result = await getEntraUserLicenses(request);
            this.completed = true;
        } catch (error) {
            this.errorMessage = error.requiresInteractiveAuthorization
                ? 'Sign in to Microsoft for the connector, then try again.'
                : error.message || 'The Entra action failed.';
        } finally {
            this.isRunning = false;
        }
    }
}

entraActionExample.html

<template>
    <lightning-button label="Run action" onclick={handleRun}
        disabled={isRunning}></lightning-button>
    <p role="alert">{errorMessage}</p>
</template>

The library returns an array of mapped DTOs. The controller can flatten nested fields, serialize data, or map an action result into an operation DTO. rawJson contains serialized mapped Apex data rather than the untouched Graph response.

License DTOs depend on the global wrapper/model mapping. The legacy response wrapper and the detail item model are distinct; an empty or default DTO should not be taken as proof that the user has no licenses.

Use getMSEntraAuthorizationState, beginMSEntraAuthorization, and createMSEntraOAuthMessageHandler to arrange delegated sign-in. The library normalizes errors but does not automatically sign in or retry. Reset completed for a new deliberate operation, and inspect resource state before retrying a mutation with an uncertain outcome.

Error handling and troubleshooting

Symptom	What to check
Required fields error	Supply a nonempty request list and required or conditionally required inputs. For LWC, use the mapped field names.
Authorization or access denied	Check connector selection, sign-in, endpoint/target permission support, administrator consent, directory roles, and resource access.
Resource not found	Check Microsoft IDs and parent resource relationships. Preserve group/drive/item associations and mailbox/calendar/event IDs.
Missing or unexpected output	Check query support, pagination, wrapper versus item models, public-only properties, and mapped DTO fields.
Operation rejected	Inspect the Microsoft error, supported writable fields, group/calendar restrictions, recipient/license data, and file transfer limits.

See Entra connector introduction.