The account used in user synchronization must be Organization Administrator in order to automatically assign licenses to the created users.

It is not desirable to make a service account, whose password is stored in a decryptable way, always organization administrator.