Bulk Create M365 Users, Assign Licenses, and Export Credentials CSV

Bulk create users via the Microsoft 365 admin center

The admin center supports bulk creation via CSV upload. This is the best GUI path when you have 5+ users.

Step 1 — Prepare your input CSV

Create a CSV with the M365 admin center's required columns:

User name,First name,Last name,Display name,Job title,Department,Office number,Office phone,Mobile phone,Fax,Address,City,State or province,ZIP or postal code,Country or region
alice.smith@contoso.com,Alice,Smith,Alice Smith,,Beta Users,,,,,,,,,United States
bob.jones@contoso.com,Bob,Jones,Bob Jones,,Beta Users,,,,,,,,,United States

Step 2 — Upload the CSV

1. Sign in to admin.microsoft.com as a Global admin or User admin
2. Navigate: Users → Active users → Add multiple users
3. Click Upload a CSV file and select your prepared file
4. Under Set user settings, choose:
   • Sign-in status: Allow user to sign in
   • Product licenses: Select your target SKU (e.g. Microsoft 365 E5)
5. Click Next, review the summary, and click Create users
6. Microsoft 365 generates temporary passwords and offers a Download results CSV — this is your credentials file. Download it immediately; it is not retrievable later.

Step 3 — Add users to a group

1. Navigate: Teams & groups → Active teams & groups
2. Open the target group (or create a new one with Add a group)
3. Go to the Members tab → View all and manage members → Add members
4. Search and add each new user

Step 4 — Assign a directory role (optional)

1. Go to entra.microsoft.com → Identity → Roles & admins → Roles & admins
2. Search for the target role (e.g. User Administrator) and open it
3. Click Add assignments, select the new users, and confirm

Step 5 — Secure handoff

Store the downloaded credentials CSV in a password manager or encrypted vault, share with the requester via a secure channel, and delete your local copy.

Automate with Microsoft Graph

The Graph API flow for each user is: create → assign license → add to group → assign role. Wrap these in a loop over your input list.

1. Discover prerequisites (once)

Get the SKU id for the license you want to assign:

GET https://graph.microsoft.com/v1.0/subscribedSkus

Response: find the entry whose skuPartNumber matches your target (e.g. SPE_E5, DEVELOPERPACK_E5). Note the skuId GUID.

Get the group id:

GET https://graph.microsoft.com/v1.0/groups?$filter=displayName eq 'Beta Users'&$select=id,displayName

Get the directory role id (activate the template first if not already active):

GET https://graph.microsoft.com/v1.0/directoryRoles

Find the entry with displayName: "User Administrator" and note its id.

2. Create each user

POST https://graph.microsoft.com/v1.0/users
Content-Type: application/json

{
  "accountEnabled": true,
  "displayName": "Alice Smith",
  "givenName": "Alice",
  "surname": "Smith",
  "mailNickname": "alice.smith",
  "userPrincipalName": "alice.smith@contoso.onmicrosoft.com",
  "department": "Beta Users",
  "usageLocation": "US",
  "passwordProfile": {
    "forceChangePasswordNextSignIn": true,
    "password": "<randomly generated 16-char password>"
  }
}

Response 201 Created returns the new user's id (GUID). Capture it for the next steps.

3. Assign a license

POST https://graph.microsoft.com/v1.0/users/{userId}/assignLicense
Content-Type: application/json

{
  "addLicenses": [ { "skuId": "{skuId}" } ],
  "removeLicenses": []
}

4. Add to group

POST https://graph.microsoft.com/v1.0/groups/{groupId}/members/$ref
Content-Type: application/json

{
  "@odata.id": "https://graph.microsoft.com/v1.0/users/{userId}"
}

5. Assign directory role (optional)

POST https://graph.microsoft.com/v1.0/directoryRoles/{roleId}/members/$ref
Content-Type: application/json

{
  "@odata.id": "https://graph.microsoft.com/v1.0/users/{userId}"
}

6. Build the credentials CSV

As you iterate, append displayName,userPrincipalName,password to an in-memory buffer, then write the buffer to a .csv file at the end of the batch. Do not persist passwords anywhere else.

Throttling: Graph rate limits apply. For batches over ~20 users, add a small delay (200–500 ms) between requests, or use $batch with a batch size of 4–5 create operations.

PowerShell: end-to-end bulk onboarding

The Microsoft.Graph PowerShell SDK provides typed cmdlets for all the Graph calls above. The downloadable script below accepts a CSV of users, a license SKU part number, a target group, and an optional directory role, then emits a credentials CSV.

Prerequisites

• PowerShell 7+ (recommended) or Windows PowerShell 5.1
• Modules: Microsoft.Graph.Users, Microsoft.Graph.Groups, Microsoft.Graph.Identity.DirectoryManagement

  Install-Module Microsoft.Graph -Scope CurrentUser

• A Global Administrator or User Administrator + License Administrator + Groups Administrator account

Input CSV format (users.csv)

DisplayName,GivenName,Surname,MailNickname,UserPrincipalName
Alice Smith,Alice,Smith,alice.smith,alice.smith@contoso.onmicrosoft.com
Bob Jones,Bob,Jones,bob.jones,bob.jones@contoso.onmicrosoft.com

Run

.\New-BulkM365Users.ps1 `
  -InputCsv .\users.csv `
  -LicenseSkuPartNumber 'SPE_E5' `
  -GroupName 'Beta Users' `
  -Department 'Beta Users' `
  -UsageLocation 'US' `
  -DirectoryRoleName 'User Administrator' `
  -OutputCsv .\credentials.csv

What the script does

1. Connects to Graph with the required scopes
2. Resolves the SKU id, group id, and (optionally) activates and resolves the directory role
3. For each input row:
   • Generates a cryptographically random 16-character password
   • Creates the user with forceChangePasswordNextSignIn = $true
   • Assigns the license
   • Adds the user to the group
   • Assigns the directory role (if specified)
   • Appends Name,Email,InitialPassword to the output CSV
4. Writes a summary and the path to the credentials CSV

Errors on individual users are caught and logged; the script continues with the remaining users rather than failing the whole batch.