Hello md4 brm,
Good day!
Thank you for posting to Microsoft Community. We are happy to help you.
Based on your description you want to replace A1 with A3, do I first delete the A1 assignment and then assign A3? if this you issue
Please note that: you don't need to delete the A1 assignment and then assign A3
-First make sure the A3 license is available in your tenant i mean you have subscribed to A3 already
-Then remove(replace) A1 and add A3 to the user
Important
Licenses that a user inherits from a group can't be removed directly. Instead, you have to remove the user from the group from which they're inheriting the license.
Reference: https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/license-users-groups
https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-licensing-whatis-azure-portal
-May i know if the security group is sync from on-premises? this information is important
If my understanding about your issue is wrong, please do not hesitate to correct me by giving me more details i will be glad to assist you.
Please get back to us with necessary information, we’ll be glad to assist you further.
Appreciate your patience and understanding and thank you for your time and cooperation.
Sincerely,
Eben | Microsoft Community Moderator