5.1 Creating & Managing Users Including External Users

Creating Users in Microsoft 365

Every identity in Microsoft 365 is rooted in Microsoft Entra ID (formerly Azure AD). You can create users from two admin surfaces that write to the same directory:

• Microsoft 365 admin center → Users → Active users → Add a user (streamlined wizard for cloud-only users, license assignment, and roles)
• Microsoft Entra admin center → Identity → Users → All users → New user (full directory surface — also handles B2B guests, external identities, and PowerShell/API-driven provisioning)

Required Properties

Exam trap: The Usage Location field is a country code (e.g., US), not a free-text location. If license assignment fails with a compliance error, usage location is missing or set to a country where the service SKU is unavailable.

First Sign-In Behavior

When you check Require password change at first sign-in, the user must reset on initial logon — the temporary password you typed is single-use. With Entra Password Protection enabled, banned-password lists and smart lockout apply to that first reset too. Disabling the checkbox is appropriate for service accounts and break-glass administrators whose password rotation is handled out-of-band.

---

User Account States and the 30-Day Restore Window

A user object in Entra ID moves through three lifecycle states:

Deleting a user from either admin center moves them to the Deleted users blade in the Entra admin center (Identity → Users → Deleted users). For 30 days the object — including its UPN, group memberships, licenses, and Exchange mailbox (Disconnected state) — can be restored in full. After 30 days the object is hard-deleted and only a support ticket within the mailbox's retained period can recover mail data.

Practical rule: When an employee leaves, block sign-in first, then remove licenses (to free the seat), and only delete the account after confirming mailbox/data export is done. Block-then-delete avoids an accidental 30-day countdown while you decide whether to keep the mailbox as a shared mailbox.

---

External Users: Entra B2B Collaboration

Entra B2B collaboration lets a host tenant invite external identities to collaborate as guest users without creating a new credential for them in the host directory. The guest signs in with their own home identity (work/school account, personal Microsoft account, Google, or email one-time passcode) and is issued a guest object in the host tenant.

The #EXT# UPN Convention

A guest's UPN in the host tenant is namespaced with #EXT# so it cannot collide with a native member's UPN:

  Original email:  alice@gmail.com
  Host tenant:     contoso.onmicrosoft.com
  Guest UPN:       alice_gmail.com#EXT#@contoso.onmicrosoft.com

The guest still signs in with alice@gmail.com — the #EXT# UPN is an internal directory identifier, not a sign-in string. Redemption happens on first sign-in: the guest is redirected to their identity provider, consents, and a refresh token is stored in the host tenant.

Member vs Guest

Guest Access Restrictions

External Collaboration Policy in Entra ID controls who can invite guests and which domains are allowed/blocked. Tenant restrictions and B2B allow/block lists let you whitelist or deny invitations by domain (e.g., allow partner.com, block gmail.com). At the group level, M365 Group guest access is a separate toggle per group classification.

B2B Direct Connect (Teams Shared Channels)

B2B direct connect is a different trust model: no invitation, no guest object in the host. Two Entra tenants establish a cross-tenant access policy that trusts each other's users for Teams shared channels only. The visiting user stays in their home tenant for authentication and appears in Teams via the shared channel — no #EXT# UPN, no redemption step. This is the mechanism that powers Teams Connect shared channels and is configured under Entra ID → External Identities → Cross-tenant access settings.

---

Managing Profile Properties, Sign-In Blocks, and License Reassignment

• Profile properties (job title, department, manager, contact info) are edited from the user's flyout in either admin center or via Microsoft Graph (PATCH /users/{id}). Manager is a navigation property — setting it surfaces org chart data in Delve and Teams.
• Block sign-in is a one-click toggle under the user's account. It invalidates existing refresh tokens and stops new sign-ins while preserving the mailbox and group memberships — the recommended first step for offboarding.
• Reassigning licenses: Remove a license from one user and assign it to another in a single operation from Licenses → Bulk assign/unassign. Usage location on the destination user must already be set; otherwise the assignment silently fails.
• Sign-in logs (Entra admin center → Monitoring → Sign-in logs) show the conditional access policies evaluated, the authentication method used, and the client app — essential when a user reports 'I can't sign in.'