Introducing a Dedicated Microsoft Graph Permission for License Assignment

For a long time, the User.ReadWrite.All permission was the least privilege possible for your application or scripts to perform Direct License Assignment on users in Entra ID (Azure).

This role would also allow the app to read and write all of the user’s profile properties, which is often more than you need when all you’re looking to achieve is license assignments.

Following the Principle Of Least Priviledge with LicenseAssignment.Read.Write.All

Starting July 15th, 2024, administrators have the ability to assign the LicenseAssignment.Read.Write.All permission. This allows an app to manage license assignments for users and groups without granting any additional permissions to user properties that it may not need, following the principle of least privilege (PoLP).