Currently the workflow is removing groups first, then licenses. However there are a few specific scenarios where it is failing:

1) Group based licenses are for add-on license types (e.g. Defender for Office Plan 2) and is using dynamic membership rules for users having the dependent licenses that are assigned directly (e.g. M365 Business Premium). In this case, direct licenses have to be removed first in the workflow, before groups are removed.

2) Direct licenses are add-on types and have dependent licenses assigned by M365 groups for hybrid-synced users*. When the workflow removes licenses, it doesn't know that there are a mix of group-based and direct licenses, and will just fail when it encounters a group-assigned license.

*This is related to another issue with hybrid-synced users' M365 groups not being removed in the User Offboarding V2 workflow. Since I run the M365 group removal in a listener workflow, it will fail to properly remove licenses.