Lesson 2: Microsoft Entra ID Tenants and Creating Users

Where this level fits

This level covers the first bullet of Manage Microsoft Entra users and groups: Create users. It is part of Manage Azure identities and governance (20–25% of the skills measured as of April 17, 2026). Groups, user properties and licenses come in later levels.

What a Microsoft Entra tenant is

A tenant is one dedicated instance of Microsoft Entra ID that belongs to one organization. It is the directory that holds identities: users, groups, applications and devices.

If you know Windows Server Active Directory, think of the tenant as the cloud counterpart of a forest: the outer boundary for identities and sign-in. The analogy stops there. A tenant has no domain controllers to manage and no organizational units.

Every tenant has:

• A tenant ID (a GUID).
• An initial domain, such as contoso.onmicrosoft.com.
• Optional verified custom domains, such as contoso.com.

How subscriptions trust a tenant

A subscription holds resources (virtual machines, storage accounts). A tenant holds identities. The two are linked by a trust relationship:

1. Every Azure subscription trusts exactly one Microsoft Entra tenant.
2. One tenant can be trusted by many subscriptions.
3. The subscription relies on that tenant to authenticate and authorize users, applications and devices.

Two separate role systems follow from this split:

• Microsoft Entra roles (for example User Administrator) control directory objects such as users, groups and domains.
• Azure roles (for example Owner) control Azure resources in a subscription.

An Owner of a subscription is not automatically an administrator of the tenant.

Safety point: if a subscription is associated with a different directory (Subscriptions > select the subscription > Change directory), users who had Azure role assignments lose their access. Role assignments are not transferred; you must reassign them in the new directory.

Member users and guest users

Every user object has a User type of Member or Guest. This property sets the user's default directory permissions.

Where the user authenticates is a separate question. An internal user has credentials stored in your tenant. An external user signs in with an account from somewhere else. The common pairs are internal member (an employee) and external guest (an invited partner). Inviting external users is taught in a later level.

Task 1: Create a user in the portal

Required role of least privilege: User Administrator.

1. Sign in to the Azure portal and open Microsoft Entra ID, or sign in to the Microsoft Entra admin center and browse to Entra ID.
2. Select Users.
3. Select New user > Create new user.
4. On the Basics tab, complete the fields:
   • User principal name: a unique username plus a domain selected after the @ symbol.
   • Mail nickname: derived from the user principal name unless you clear that option.
   • Display name: for example, Chris Green.
   • Password: auto-generated by default. Clear Auto-generate password to type your own.
   • Account enabled: checked by default. Clear it to block sign-in.
5. Optional: select Next: Properties to set User type (Member or Guest), job and contact details. Select Next: Assignments to add groups or roles.
6. Select Review + create, then Create.
7. Deliver the initial password to the user through a secure channel.

Task 2: Create a user with Azure CLI

az ad user create has three required parameters: --display-name, --password and --user-principal-name.

az ad user create \
  --display-name "Chris Green" \
  --user-principal-name chris@contoso.com \
  --password "<initial-password>" \
  --force-change-password-next-sign-in true

Check these points:

• The user principal name must contain one of the tenant's verified domains.
• --force-change-password-next-sign-in defaults to false. Set it to true so the user replaces the initial password.
• --mail-nickname is optional.

Verify the result: az ad user show --id chris@contoso.com

Task 3: Create a user with Microsoft Graph PowerShell

1. Connect with a scope that permits user creation. User.ReadWrite.All is the least privileged permission.
2. Build a password profile as a hashtable.
3. Run New-MgUser.

Connect-MgGraph -Scopes "User.ReadWrite.All"

$PasswordProfile = @{
  Password = '<initial-password>'
  ForceChangePasswordNextSignIn = $true
}

New-MgUser -DisplayName 'Chris Green' `
  -UserPrincipalName 'chris@contoso.com' `
  -MailNickname 'chrisg' `
  -PasswordProfile $PasswordProfile `
  -AccountEnabled

Supply all five values: -DisplayName, -UserPrincipalName, -MailNickname, -PasswordProfile and -AccountEnabled. Unlike the CLI, -MailNickname must be specified here.

Task 4: Single creation or bulk creation

Choose the method from the scenario:

• One or a few users, or users needing individual settings: use Create new user, the CLI or PowerShell.
• Many users with data already in a list or spreadsheet: use Bulk create with a CSV file.
• A repeatable, automated process: script it with the CLI or Microsoft Graph PowerShell.

Bulk create steps:

1. Browse to Users > Bulk create.
2. Select Download to get the CSV template.
3. Keep the column headings exactly as downloaded. Add one user per row.
4. Fill in the three required columns: Name [displayName], User name [userPrincipalName] and Initial password [passwordProfile].
5. Upload the file. Fix any validation errors, then select Submit.
6. Check the outcome on the Bulk operation results page. The results file gives the reason for each error.

Remember three limits:

• Bulk create makes internal member accounts. No invitation emails are sent, so you must communicate the credentials yourself.
• Extra columns that you add to the template are ignored.
• If a bulk operation does not complete within the hour, split the records into smaller batches.

What the exam asks about this

Expect scenario questions on these points:

• The subscription-to-tenant relationship, and what happens to Azure role assignments when the directory changes.
• Whether a described person should be a member or a guest.
• Which command or cmdlet creates a user, and which parameters are required.
• When bulk creation from a CSV file is the efficient choice, and which columns the file must contain.
• The role of least privilege for creating users.

This course is independent of Microsoft, and it does not guarantee a pass.

Key takeaways

• A tenant is a dedicated instance of Microsoft Entra ID. It holds identities, not resources.
• A subscription trusts one tenant; a tenant can be trusted by many subscriptions.
• Changing a subscription's directory removes access granted through Azure role assignments.
• Member and Guest are user types with different default directory permissions.
• Portal path: Users > New user > Create new user. Least-privilege role: User Administrator.
• CLI: az ad user create with --display-name, --password and --user-principal-name.
• PowerShell: New-MgUser with a -PasswordProfile hashtable, -MailNickname and -AccountEnabled.
• Bulk create uses a downloaded CSV template with three required columns and creates internal member accounts.