6.2 Bulk User Management with Graph & Entra PowerShell

Bulk User Management with Graph & Entra PowerShell

Quick Answer: The MSOnline and AzureAD PowerShell modules are deprecated and retired — use Microsoft Graph PowerShell (Microsoft.Graph) or the newer Microsoft Entra PowerShell (Microsoft.Entra) module instead. The Microsoft 365 admin center also supports bulk CSV operations for add, invite, restore, and export.

MS-102 expects you to know both the GUI bulk tools and the PowerShell automation path, and critically, to know which PowerShell modules are current. Getting this wrong in production breaks automation; getting it wrong on the exam loses easy points.

Admin-Center Bulk Operations

The Microsoft 365 admin center provides point-and-click bulk tools under Users → Active users and Users → Deleted users:

• Bulk add users — download the CSV template, fill in display name, user principal name, first name, last name, usage location, assigned licenses, and other columns, then upload to create many users at once.
• Bulk invite guest users — invite external collaborators in bulk from a CSV of email addresses.
• Bulk restore deleted users — select multiple deleted users and restore them within the 30-day soft-delete window.
• Export users — export the active user list to CSV for reporting or offline editing.

These GUI tools are fine for one-off migrations, but repeatable operations belong in PowerShell. That is where the deprecation story matters.

The MSOnline / AzureAD Deprecation

The older MSOnline (Connect-MsolService, Get-MsolUser) and AzureAD (Connect-AzureAD, Get-AzureADUser) modules are deprecated. Microsoft has retired them and removed support; they no longer receive feature updates and will fail against the current service endpoints. The two supported replacement paths are:

1. Microsoft Graph PowerShell — the Microsoft.Graph module, the primary automation surface for Microsoft 365 and Entra ID.
2. Microsoft Entra PowerShell — the newer Microsoft.Entra module, designed as a closer cmdlet-name successor to MSOnline/AzureAD for Entra ID-specific operations.

Any new automation, runbook, or exam answer must use one of these. Do not write or recommend Connect-MsolService or Connect-AzureAD.

Microsoft Graph PowerShell

Install the module and connect with the required scopes:

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.ReadWrite.All", "Group.ReadWrite.All", "Directory.ReadWrite.All"

Connect-MgGraph triggers a device-code or interactive browser sign-in and consents to the listed scopes. Scopes map to Microsoft Graph permissions; for user and license management you typically need User.ReadWrite.All, Group.ReadWrite.All, and Directory.ReadWrite.All.

Key cmdlets for user and group management:

License assignment via Graph PowerShell uses Set-MgUserLicense, which takes the user, an AddLicenses array of SKU IDs, a RemoveLicenses array, and optionally disabled service plan IDs within AddLicenses.

Microsoft Entra PowerShell

The Microsoft Entra PowerShell module (Microsoft.Entra) is the newer Entra ID-focused module that mirrors the old MSOnline/AzureAD cmdlet verbs more closely, easing migration:

Install-Module Microsoft.Entra -Scope CurrentUser
Connect-Entra -Scopes "User.ReadWrite.All", "Group.ReadWrite.All"

Key cmdlets include Get-EntraUser, New-EntraUser, Set-EntraUser, Remove-EntraUser, Get-EntraGroup, and New-EntraGroupMember. For license assignment, Entra PowerShell wraps the same Graph license APIs. Use Entra PowerShell when an organization is migrating existing MSOnline/AzureAD scripts and wants minimal cmdlet-name churn; use Graph PowerShell when you need the broadest Microsoft 365 workload coverage in one module.

A Realistic Bulk Provisioning Flow

A common onboarding flow reads a CSV of new hires, creates each user, sets usage location, assigns a license, and adds them to groups that drive group-based licensing and app access. The PowerShell below is illustrative — it shows the cmdlet pattern, not a production-hardened script:

# Assumes Connect-MgGraph with User.ReadWrite.All, Group.ReadWrite.All already consented
$users = Import-Csv "C:\Onboarding\NewHires.csv"
$e3Sku = Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "ENTERPRISEPACK"

foreach ($u in $users) {
  $newUser = New-MgUser -DisplayName $u.DisplayName `
    -UserPrincipalName $u.UPN -MailNickname $u.MailNickname `
    -UsageLocation $u.UsageLocation -PasswordProfile @{ Password=$u.TempPassword; ForceChangePasswordNextSignIn=$true } `
    -AccountEnabled

  Set-MgUserLicense -UserId $newUser.Id -AddLicenses @{ SkuId = $e3Sku.SkuId } -RemoveLicenses @()

  # Add to a group that grants app access (group-based licensing can also be used here instead)
  New-MgGroupMember -GroupId $u.GroupId -DirectoryObjectId $newUser.Id
}

When group-based licensing is in place, the Set-MgUserLicense call can be omitted entirely and the New-MgGroupMember step alone provisions the license — a cleaner pattern that keeps licensing tied to group membership.

Common Bulk Scenarios

• Bulk create — read a CSV, loop New-MgUser with mandatory properties, then enable accounts.
• Bulk license assignment — either via group membership (New-MgGroupMember) or a loop of Set-MgUserLicense for direct assignment; prefer the group path for maintainability.
• Bulk group membership — enumerate a CSV of user UPNs and group IDs, resolve each to an object ID, and call New-MgGroupMember.
• Bulk offboarding — disable accounts (Update-MgUser -AccountEnabled:$false), remove from licensing groups (or call Set-MgUserLicense with RemoveLicenses), and optionally Remove-MgUser to soft-delete; sign-out sessions via Revoke-MgUserSignInSession to cut active tokens immediately.
• Bulk restore — within the 30-day window, Restore-MgUser -UserId <id> reactivates a soft-deleted user with properties and group memberships intact.

Choosing the Right Tool