I understand the licenses are tied to the tenant. How are they assigned, and what happens if the user leaves the organization?

The Admin manages all configurations and licenses within the tenant. Roles can be reassigned or removed as needed. You should use the admin email to manage these changes, especially if a user leaves the organization.