Every vendor has its own idea of what "give this person a license" even means. Provisioning sounds like one problem, but it is really a dozen, because no two software companies agree. So the Engine does not flatten them into a single integration. It meets every vendor on its own terms.
An approved order is a promise, not a seat. Someone still has to make the entitlement real on the vendor's side, tied to the right billing account, working the same day, and undoable later. Done by hand, that is a different manual dance for every product in the catalog.
The tempting shortcut is to build one integration and force every vendor through it. That either drags everyone down to the crudest common denominator, or it shatters the first time a vendor does not fit. And these vendors do not fit each other at all. Adobe, Microsoft, Canva, and a shelf of research software share almost nothing about how a license is actually granted.
So the Engine carries a purpose-built adapter for each, hung behind one order. Here is what each vendor demands, and why refusing to pretend they are the same is the whole point.
By the numbers
fundamentally different fulfillment methods behind one approval: Adobe's user API, a Microsoft directory group, a Canva team seat, and file-and-key delivery.
each approved Adobe and Microsoft seat is checked against the vendor, and a seat that never landed is put back on its own.
order-and-approval funnel every path shares. The front door is uniform; the fulfillment behind it is not.
from approval to a working seat, unattended. No ticket, no handoff, no queue for a person.
lives of every seat, on one set of adapters: grant it, transfer it to someone else, reclaim it on separation.
Adobe, by API, used carefully
A federated identity, and the one subtlety that makes a seat actually work.
Adobe does give you an API, the User Management API, and the Engine uses it the way it is meant to be used. On approval it provisions a federated identity for the person from their real campus email, then places them in the Adobe user group that carries the entitlement. Clean, fast, and fully unattended.
Why it is clever
Adobe sets a quiet trap: a license can look granted when it is not. Assigning only a product profile leaves the seat inert, because the entitlement really rides on the user group, so the Engine grants the group and lets the profile follow. It also reconciles identity before it acts. The same person can exist in Adobe under their campus ID or a mail-based one, so the Engine resolves the true Adobe identity by the local part of the address and adds to that, instead of minting a confusing duplicate. And when Adobe answers that the account already exists, it adapts and finishes the grant rather than failing.
This fall the Engine picked up three more habits. When someone changes their name, Adobe can rename their account before License Commander's copy of the Adobe roster catches up, so an add aimed at the old address fails. Instead of reporting a failure, the Engine now looks the person up live under every address it has for them, and if the seat is already there, it counts that as done. When a person adds a second Adobe product, the Engine keeps every product group they still hold an active, paid seat for; giving a Creative Cloud Pro holder Acrobat used to strip their Creative Cloud Pro. And ordering knows Adobe's bundles: Creative Cloud Pro already includes Acrobat Pro and Express Premium, and Express Premium includes Acrobat Pro, so an order for a product someone already has inside a bigger one is turned away with a plain note instead of billing the department twice for the same access.
✓ Toil removed hand-adding people in the Adobe console, false "provisioning failed" alarms after a name change, and the silent half-grants that leave someone paying for a seat that quietly does not work.
Microsoft, by borrowing the directory
The one place a group membership does the work, and why that is not the whole story.
Microsoft's own licensing model is group-based licensing: attach a product to a directory group, and simply being a member grants the license, automatically, on Microsoft's side. So for Microsoft the Engine does the natural thing. It adds the person to the correct Entra group through the Graph API, and Azure assigns the real license. Visio, Project, Visual Studio, Copilot, the Power Platform apps, and, as a convenience for now, Mathematica, all ride this one rail.
Why it is clever
This is worth stating precisely, because it is easy to overclaim. Directory-group membership is how the Engine provisions Microsoft, and only Microsoft. It is Microsoft's mechanism, not License Commander's philosophy, and it is one path among four, not the crux of the Engine. What makes it clever is restraint: instead of reaching in to juggle individual license assignments, the Engine leans on the vendor's own machinery, one add to license, one remove to unlicense, and reuses that exact primitive for granting, transferring, and reclaiming.
✓ Toil removed assigning and unassigning Microsoft licenses one person at a time in the admin center.
Canva, from a browser robot to Canva's own API
A vendor that once had no door for automation, and the day it opened one.
Until late August, Canva offered no API for team membership and sat behind a bot wall that blocked headless automation outright. So the Engine drove a real, visible browser on an always-on machine, signed in as an administrator, and invited each person into the team. In August Canva released an Admin API for higher education, and on August 26 the Engine switched over. Today a cloud function seats each approved person on the Canva-Employees team through that API, at their campus address. Campus sign-on does the rest: an employee who logs in to Canva with their UCI account lands on the right team. No browser, no bot wall, no login to lose.
Why it is clever
The order still never waits on the vendor. An approval drops a message on a durable queue, and the cloud function works through it, so a slow moment at Canva can never lose an order. One snag remains, and the Engine handles it without a person: someone who already had a personal Canva account under their UCI email, and never signed in through UCI, cannot be seated until they do. So the Engine emails that person a one-step "sign in once" note, and a safety net that runs every 30 minutes seats them on its next pass after they sign in. Removals are checked, not assumed: after taking a seat away, the Engine reads the team back and records the removal only when the person is really gone. The full Canva story is its own chapter, the Canva Engine.
✓ Toil removed an administrator inviting each new user by hand, a browser robot that needed signing back in, and orders quietly lost when the console misbehaved.
There is no universal API for "give this person a license." So the Engine learned to speak each vendor's language, and to say every sentence backwards, too.
Research software, by files, keys, and fingerprints
Not every license is a cloud seat. Some are a file, a key, or a machine's fingerprint.
A whole shelf of research software predates the idea of a cloud seat entirely. SAS is licensed by a file. SPSS needs an activation key drawn from a finite pool. Some tools bind a license to one machine's hardware fingerprint. The Engine automates each ritual on its own terms: SAS compliance files are delivered to the right people as time-limited secure links, SPSS keys are dispensed from the pool the instant an order is approved, and a purpose-built page captures a machine's Host-ID and routes it straight to the license administrators.
Why it is clever
Handing out keys from a shared pool is a race waiting to happen, so the claim is collision-safe: two approvals in the same second can never be handed the same key. File delivery is scoped by role, so a holder, the person who ordered on their behalf, and the fiscal officer each receive exactly the set they are entitled to and nothing more. Each of these is a small, exact piece of plumbing for a vendor that a single generic integration would simply drop on the floor.
Since October, an administrator can also move an approved per-seat order, such as SAS or SPSS, to a different person in one step. The order number, account, fiscal officer and billing stay exactly as they were, any SPSS keys claimed for the order follow it to the new holder, and the new holder gets their approval email. Named-user licenses like Adobe and Microsoft keep using a transfer instead.
✓ Toil removed emailing license files and keys by hand, tracking which key went to whom, chasing machine fingerprints over email, and re-keying an order by hand when it needs a new owner.
One door, and the whole life of a seat
A single approval on the front; grant, transfer, and reclaim on the back.
All four methods hang off one order-and-approval moment, so a requester and an approver meet one consistent front door no matter what happens behind it. And a grant is only the first act. The same vendor adapters run in reverse to move a paid seat from a departing employee to a new one, and to reclaim a license the day its holder separates. Every operation is idempotent: re-running a grant that already happened is a safe no-op, so a retry, a re-approval, or a nightly reconciliation can never double-grant or double-charge. Since August, every approval route, whether in the app, by email link, or through auto-approval, calls the same single provisioning step, and re-approving an order that is already approved runs it again, which repairs a seat that got stranded along the way.
Why it is clever
One set of adapters doing three jobs, grant, transfer, and reclaim, is what turns a license from a one-way giveaway into a managed asset. Because every grant is reversible, a seat that goes unused does not have to be written off; it can be moved to someone who needs it. And because every path is idempotent, the whole system is safe to re-run, which is exactly what lets the rest of License Commander lean on it without fear of doing harm.
Reversing a grant safely turned out to need one more rule. In October, a batch of orders was filled by handing people spare seats, and then their own earlier seat was used to fill the next order. Giving that earlier seat away pulled them out of Adobe, even though they still held a live license. Once it was found, everyone affected was restored that same day, and the whole class of bug was closed. Now nobody is removed from an Adobe or Microsoft group while they still hold another active seat for that product, and if that check cannot run, the Engine keeps their access. A transfer that fills an order can only take a genuine spare, and the new seat and the old one change together in a single all-or-nothing database step, so two people can never be handed the same spare.
✓ Toil removed treating each license as spent forever, and the fear of automating a grant you cannot cleanly take back.
Checking that every seat actually landed
A daily look at the end state, because a missed grant makes no noise.
Provisioning fires and then reports success, which means a miss can be silent: an order shows approved and billed, but the seat never reached the vendor. So once a day the Engine checks the end state instead of trusting the steps. Every approved seat on the Microsoft rail is compared to its directory group, and a missing one is put back. Since October 13, every approved Acrobat Pro, Creative Cloud Pro, and Express Premium seat is checked too, not only recent orders. The whole Adobe population is compared to License Commander's copy of the Adobe console in one quick pass, and each suspect is confirmed live with Adobe before it counts as missing. A confirmed miss is put back automatically and noted in Sick Bay. On October 17 the check covered 5,998 seats and found none missing.
Why it is clever
It is careful about what it touches. It knows the bundles, so an Acrobat holder in the Creative Cloud Pro group already counts as having Acrobat. It skips seats changed in the last few hours, because the copy of the Adobe roster can lag the real console. A holder it cannot match to an Adobe account is reported, never auto-fixed, so it can never create a duplicate account. An administrator can put a hold on a seat under review, and the check leaves that seat alone. And a clean run closes the check's own earlier "Needs you" notes in Sick Bay, so an old alarm does not linger after the fix.
✓ Toil removed finding out weeks later, from an unhappy user, that a paid seat never worked.
One order, the right method, every time
A user API for Adobe, the directory for Microsoft, Canva's own Admin API for Canva, and files and keys for the research shelf, all behind a single approval, all reversible, all the same day, with every Adobe and Microsoft seat checked again daily. The Engine does not hide how different these vendors are. Meeting each on its own terms, instead of forcing them into one mold, is the engineering.