I granted roles to more users than were purchased

The identity domain doesn't restrict the number of users you can assign roles, but when the service reaches the purchased limit, additional users can’t sign in unless you either deprovision some users or purchase additional users.

Users are provisioned on their first sign in, so this is handled on a first-come, first-serve basis.