Grant users global MSP-level access. Existing global role grants are retained. Entries identified by an unknown user ID are skipped, and entries already holding global roles are skipped for role granting. A supplied MSP association can still change for an existing user even when their role grant is skipped. Returned userIDs describe processed role-grant entries and do not enumerate every association change. Email entries can resolve or create users. A failed request can leave earlier changes applied; reconcile current users, roles, and MSP associations before retrying.