Create a New Entra ID User and Email Temporary Credentials

Why this recipe exists

New-hire and contractor onboarding frequently requires a bare Entra ID identity before licensing, group membership, or manager assignment is finalized. A common pattern is to create an enabled account with a one-time password, force a password change at first sign-in, and hand the temporary credentials off to a hiring manager, IT coordinator, or the user's personal email so they can complete self-onboarding.

This recipe covers that exact workflow: verify the UPN is free, generate a strong temporary password, create the user with forceChangePasswordNextSignIn = true, and surface the credentials to a trusted recipient — all without assigning a license.

When to use it

• Day-zero onboarding when licensing decisions are still pending
• Creating accounts for contractors or external staff who do not need a mailbox
• Pre-provisioning identities for downstream automation (group sync, SCIM, HRIS)

What you'll have when done

• A new enabled Entra ID user at {user_upn} with display name {display_name}
• A 16-character cryptographically-random temporary password
• forceChangePasswordNextSignIn set to true so the user must rotate the password on first login
• No licenses assigned (no mailbox, no SharePoint, no Teams) — ready for selective license assignment later
• The temporary credentials delivered to the designated recipient (manager, IT coordinator, or personal email)

Warnings & gotchas

• Credentials in email are sensitive. Never send the password and the UPN in the same message to an untrusted channel. Prefer a password manager share, an ephemeral secrets tool, or an out-of-band channel (SMS for the password, email for the UPN).
• No license = no mailbox. The user cannot receive mail at {user_upn} until a license with Exchange Online is assigned. Don't send onboarding mail to the new UPN — it will bounce.
• UPN collisions. Always run the existence check first. Graph returns 404 for a free UPN and 200 for an existing one; creating over an existing user fails with 400.
• Password policy. Tenants with custom banned-password lists or length requirements may reject weak generators. Use at least 14 characters and include mixed case, digits, and symbols.
• Audit trail. User creation is logged in the Entra ID audit log. Document the business justification in your ticketing system before creating the account.
• Conditional Access. If CA policies require MFA at first sign-in, ensure the user has a way to register an authenticator (TAP, phone, etc.) — a forced password change alone will not satisfy MFA gates.