Direct M365 F1 license assignment fails in SailPoint ISC due to concurrency error

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi everyone,

I’m running into a persistent issue with direct Microsoft Entra license assignment via SailPoint Identity Security Cloud (ISC) and I’m hoping someone in the community has found a reliable solution or workaround.

Scenario

  • License SKU: M365_F1_COMM

  • Contains 21 service plans

  • All service plans are modeled as entitlements in SailPoint ISC

  • Requirement: Direct license assignment (group-based licensing is not allowed)

What I’ve tried

  • Assigning all 21 service-plan entitlements in:

    • a single Access Profile

    • a single Role

  • Ensuring they are provisioned together in one request

Result

Provisioning fails with the following error in Entra:

Microsoft.Online.DirectoryServices.LicenseAssignmentAttributeConcurrencyException

This happens consistently, regardless of whether the entitlements are assigned via:

  • one access profile

  • one role

  • or multiple profiles/roles

From what I can tell, ISC appears to send multiple PATCH operations for the same SKU (one per service plan), which causes Entra to reject concurrent updates to the assignedLicenses attribute.

Question

Has anyone successfully:

  • Assigned multiple service plans under the same M365 SKU via direct assignment in SailPoint ISC

  • Without hitting the concurrency exception?

If so:

  • How did you model the entitlements?

  • Are you using SKU-level “bundle” entitlements with disabledPlans?

  • Any workflows or connector configuration that forces a single atomic license update?

I’d really appreciate any real-world experience, confirmation of product limitations, or design patterns that actually work in production.

Thanks in advance!

2

What we’ve found that consistently works as a workaround is to break the license assignment down as follows:

  1. Run an aggregation for the Entra account on the identity
    This ensures ISC has the most up-to-date state from Entra before provisioning changes are applied.

  2. Run Process Identity
    This triggers provisioning from ISC to Entra.

  3. Repeat steps 1 + 2 for each service plan in the SKU
    Because of the concurrency limitations on the Entra side, you can’t assign all 21 service plans for an F1 SKU in one go — instead you assign them one at a time by repeating the aggregate + process sequence.
    For a full M365_F1_COMM license, that means executing step 1 and step 2 21 times (once per service plan).

But this is not a feasible option - But it solves it.