[Azure AD Plan] Update access for GDAP users who were previously guests

[onbuyuka]

Summary

A delegated-admin (GDAP) user who had previously logged in to the environment as a guest got the GDAP plan row, but their user access (user groups / permissions) was never updated — so they did not effectively receive the GDAP license. IcM 1888383.

Root cause

In codeunit 9018 "Azure AD Plan Impl.".AssignPlanToUserWithDelegatedRole, the caller (AzureADUserMgmtImpl.Run) passes SkipUpdateUserAccess = UserLoggedInEnvironment, which is true for any returning user. After deleting the old guest plan and inserting the GDAP plan, the procedure hit two early-exits before the access update:

if SkipUpdateUserAccess then exit;   // true for returning users
...
if HasPlans then exit;               // true for former guests (had a guest plan)

so OnUpdateUserAccessForSaaS (the user-group / permission assignment) and the SUPER handling never ran for a former-guest GDAP user.

The earlier guard if IsPlanAssignedToUser(PlanId, UserSID) then exit; already prevents re-processing when the GDAP plan is unchanged, so the two removed checks are redundant for correctness — and crucially, that guard means the access update only re-runs when the plan actually changes (no per-login perf regression for normal returning users).

Fix

Remove the two redundant early-exits and the now-unused HasPlans local, so access is updated on the guest → GDAP transition. Adds regression test GDAPUserWithPreviousGuestPlanGetsAccessUpdated.

Note on provenance

This revives the previously abandoned PR #7490 (closed without merging on 2026-04-01). I reproduced the same code change and test against current main. Posting as draft so the original owners can confirm there was no hidden blocking concern behind the earlier abandonment before this lands.

Verification

• Traced the full caller→callee path; current main matches the pre-fix state exactly. Verified all test-library helpers referenced by the new test exist on current main.
• ⚠️ Not runtime-verified on an NST here (AL does not run locally) — relying on PR CI. The abandoned PR reported the baseline test failed pre-fix (bug reproduced) and passed post-fix; re-running the Azure AD Plan suite on CI is the gate.

Linked work item: AB#612420

🤖 Generated with Claude Code