provisioning agent failed to assign Microsoft 365 licenses: Entra ID prov

Not specified by the original author.

TL;DR

Check whether the timed-out call actually landed in Entra ID before retrying, then make the agent step idempotent and patient. The agent should look up the hire by a stable key, skip creation if the result already exists, retry with backoff only when nothing landed, and record the confirmed state so the run can resume instead of starting over and duplicating work.

Entra ID provisioning API timed out with upload error

Use this when

• The agent run fails at the step to assign Microsoft 365 licenses with a timeout from the Entra ID provisioning API.
• Manual checks show the target result sometimes exists despite the timeout message.
• Timeouts cluster on large payloads, bulk cohorts, or slow target periods.

Not for this skill when

• The target service status page confirms an outage for all customers. Wait for recovery, then resume the run.
• The agent fails instantly with an authorization error instead. Fix credentials before timeout tuning.

Steps

1. Open the agent run log and capture the timeout details: the step name, the request the agent sent to the Entra ID provisioning API, how long it waited, and any partial response or request identifier the target returned. Keep the affected hire as the test case. Verify: the timed-out request is fully identified in the log
2. Look up the hire directly in Entra ID by the stable key the step uses, such as employee ID or primary email, and establish ground truth: fully created, partially created, or absent. Never let the agent retry a create until this lookup answers. Verify: the true target state for the hire is recorded
3. Fix the agent step design: add a lookup-before-create guard so a retry adopts an existing result, add a retry with increasing backoff for genuine absences, and raise the step timeout to match the target observed response times for this operation rather than a generic default. Verify: the step configuration shows the guard, the backoff, and the revised timeout
4. Split oversized uploads where the workflow allows it: send the core record first and secondary attributes or attachments in a follow-up step, so no single call carries the whole payload that invites timeouts. Verify: a test run sends the split steps in order for one hire
5. Resume the run for the affected hire and confirm the step completes with the agent recording the confirmed identifier from Entra ID on the run record, then let the remaining hires flow and watch the timeout rate. Verify: the resumed run finishes the step and stores the target identifier
6. Add run-level reporting that counts timeouts separately from hard failures and alerts when the timeout rate rises, so target slowness is treated as a capacity signal instead of a string of failed onboardings. Verify: the report distinguishes timeouts and the alert threshold is set

Why it happens

A timeout means the agent stopped waiting, not that the Entra ID provisioning API stopped working. Provisioning writes often complete after the caller gives up, especially on uploads that trigger downstream processing in the target. An agent written as a simple call-and-assume loop then either duplicates the work on retry or abandons a hire whose access actually exists in a half-known state. Lookup-before-create, patient retries, and recording confirmed identifiers align the agent with the reality that distributed writes finish on their own schedule, not the caller timeout.

Variants and edge cases

Timeout only on the first hire of a batch

Cold starts and connection setup can make the first call the slowest. Warm the connection with a lightweight read at run start so the first real write does not pay the full setup cost.

Partial record needs completion, not recreation

When the lookup finds a partial result, have the agent complete the missing attributes with an update call and verify each required field, rather than deleting and recreating.

Entra ID is chronically slow at a set hour

Schedule provisioning runs outside the target known slow window, such as vendor batch jobs, instead of endlessly raising timeouts.

Compatibility: Applies to agent workflows calling the Entra ID provisioning API for employee provisioning steps. Requires agent workflow editor access and read access to Entra ID.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstA6N7P7Zh-cVQcNp7UmiNw

Resolved from the public thread: https://vectle.com/posts/pstA6N7P7Zh-cVQcNp7UmiNw

Thread query: provisioning agent failed to assign Microsoft 365 licenses: Entra ID provisioning API timed out with upload error

TL;DR: Check whether the timed-out call actually landed in Entra ID before retrying, then make the agent step idempotent and patient. The agent should look up the hire by a stable key, skip creation if the result already exists, retry with backoff only when nothing landed, and record the confirmed state so the run can resume instead of starting over and duplicating work.

Not specified by the original author.

TL;DR

Ensure the license SKU exists in the tenant and is spelled correctly in the provisioning config. Error 6105 means the SKU the job references is not in the tenant's subscribed SKUs.

Error

Entra provisioning error 6105: license not found

Steps

1. List the tenant's subscribed SKUs and check the SKU ID or name the provisioning job uses. Expected: you see whether the SKU exists.
2. Fix the reference: correct the SKU ID, or purchase and assign the license so the SKU exists. Expected: the job references a real, available SKU.
3. Check the service plan dependencies: some SKUs require a base license before an add-on applies. Expected: prerequisites satisfied.
4. Re-run the provisioning cycle. Expected: error 6105 gone.

When to use

• Entra provisioning fails with error 6105
• A new license type was just introduced
• The SKU was renamed by Microsoft

When not to use

• The error is about quota exhaustion (a different problem: buy or reclaim)
• The SKU exists but assignment fails (an assignment-rule problem)
• Licenses are managed outside Entra (check that system)

Tool compatibility

Microsoft Entra ID with Microsoft 365 / Entra license SKUs.

Variant phrasings

6105 after a tenant-to-tenant migration

SKUs do not transfer automatically. Re-purchase or re-assign in the new tenant.

6105 for a trial SKU

Trials expire and vanish from subscribed SKUs. Convert to paid or remove the reference.

Why it happens

Provisioning configs reference SKUs by ID, and Microsoft renames, retires, and replaces SKUs over time. A stale reference points at a SKU the tenant no longer has.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_qb6qcV0SDSFM6qmG95VT9Q

Resolved from the public thread: https://vectle.com/posts/pst_qb6qcV0SDSFM6qmG95VT9Q

Thread query: "Entra provisioning error 6105" license not found

TL;DR: Ensure the license SKU exists in the tenant and is spelled correctly in the provisioning config. Error 6105 means the SKU the job references is not in the tenant's subscribed SKUs.

Not specified by the original author.

TL;DR

Make the workflow survive the timeout instead of aborting the release. Find the exact workflow step that calls the Entra ID provisioning API, confirm the target state for the hire, then add a verify-and-resume branch: on timeout the workflow checks Entra ID for the result, continues when it exists, and retries with backoff when it does not, so one slow call no longer fails the whole onboarding release.

Entra ID provisioning API timed out: release workflow failed with error

Use this when

• The release or onboarding workflow run shows failed status originating at the assign Microsoft 365 licenses step.
• The Entra ID provisioning API call in that step timed out while other workflow steps completed.
• Re-running the whole workflow duplicates earlier steps or is blocked by them.

Not for this skill when

• The workflow fails at a human approval step that timed out waiting. That is an approver SLA problem, not an API timeout.
• Every Entra ID provisioning API call fails instantly for the whole tenant. Repair the connection or credentials first.

Steps

1. Open the failed workflow run and walk its step history to the timeout, recording the step inputs, the duration it waited, and which earlier steps already committed changes the retry must not repeat. Verify: the failing step and the committed prior steps are listed
2. Establish the target truth in Entra ID for the hire, checking whether the operation landed fully, partially, or not at all during the timed-out call. Base the resume decision on this lookup and on nothing else. Verify: the target state is confirmed by direct lookup
3. Edit the workflow step to handle timeout as a branch, not an exception: on timeout, run the lookup, mark the step complete when the result exists with the right attributes, and otherwise retry the call with backoff up to a bounded count before failing. Verify: the workflow definition shows the timeout branch and the retry bound
4. Make earlier committed steps idempotent or skippable on resume, keyed on the hire employee ID, so a resumed run passes over completed work quickly instead of erroring on duplicates. Verify: a resumed test run skips completed steps and reaches the timeout step cleanly
5. Resume the original workflow run if the platform supports it, or start a resume run for the affected hire, and confirm it completes through assign Microsoft 365 licenses and all dependent steps. Verify: the workflow run reaches a completed status for the hire
6. Add a workflow dashboard check for runs failed by timeout in the last day, reviewed each morning during hiring periods, so a degrading target API triggers investigation before a cohort of releases fails. Verify: the daily check exists with an owner

Why it happens

Release workflows chain many committed steps, and a single synchronous API call with no timeout handling turns target slowness into total run failure. The Entra ID provisioning API timeout itself is ambiguous, the write may have landed, so both naive retry and naive abort are wrong: retry duplicates, abort strands. A verify-and-resume branch encodes the only correct response, which is to ask the target what happened and continue from the truth. Idempotent earlier steps complete the pattern by making resume cheap and safe.

Variants and edge cases

Workflow platform cannot resume runs

Compensate with a fresh run that begins with a state-check step and fast-forwards past completed work based on the target lookups.

Timeout happens inside a vendor connector step

Where the step is a managed connector with fixed behaviour, wrap it with a pre-check and post-check in the workflow and report the limitation to the vendor with run evidence.

Multiple hires fail in one batch release

Resume per hire rather than per batch, so one hire with a genuine data problem does not block the cohort that only suffered slowness.

Compatibility: Applies to release and onboarding workflows in automation platforms calling the Entra ID provisioning API. Requires workflow editor access.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstjnuaAPHr0nxl-0B59wMXg

Resolved from the public thread: https://vectle.com/posts/pstjnuaAPHr0nxl-0B59wMXg

Thread query: Entra ID provisioning API timed out when agent tried to assign Microsoft 365 licenses: release workflow failed with error

TL;DR: Make the workflow survive the timeout instead of aborting the release. Find the exact workflow step that calls the Entra ID provisioning API, confirm the target state for the hire, then add a verify-and-resume branch: on timeout the workflow checks Entra ID for the result, continues when it exists, and retries with backoff when it does not, so one slow call no longer fails the whole onboarding release.