Create a New Entra ID User and Email Temporary Credentials

Create the user in the Microsoft Entra admin center

1. Sign in to the Microsoft Entra admin center at https://entra.microsoft.com as a User Administrator or Global Administrator.
2. Navigate to:

   Identity → Users → All users → + New user → Create new user

3. On the Basics tab, fill in:
   • User principal name: {mail_nickname} (select the verified domain, e.g. @{tenant_domain})
   • Display name: {display_name}
   • Password: choose Auto-generate password or Let me create the password and paste a 16-character random string
   • Check Account enabled
   • Check Require this user to change their password when they first sign in
4. Skip the Properties, Assignments, and Review + create steps for license/group assignment (leave empty for an unlicensed account).
5. Click Review + create, then Create.
6. Copy the generated password from the confirmation screen — it will not be shown again.
7. Deliver the credentials to {recipient_email}. Preferred: share the password via a password-manager secure link or a one-time secret service, and send the UPN separately by email.

Verify: Return to All users and confirm {user_upn} appears with Account enabled = Yes and Licenses = None.

Create the user via Microsoft Graph

Step 1 — Check if the UPN is already in use

GET https://graph.microsoft.com/v1.0/users/{user_upn}

A 404 Request_ResourceNotFound confirms the UPN is free. A 200 OK means the user already exists — stop and reconcile.

Step 2 — Create the user

POST https://graph.microsoft.com/v1.0/users
Content-Type: application/json

{
  "accountEnabled": true,
  "displayName": "{display_name}",
  "mailNickname": "{mail_nickname}",
  "userPrincipalName": "{user_upn}",
  "passwordProfile": {
    "forceChangePasswordNextSignIn": true,
    "password": "{temporary_password}"
  }
}

Expected response (201 Created)

{
  "id": "7cceb772-cbef-4cc1-886b-30487f371ecd",
  "displayName": "{display_name}",
  "userPrincipalName": "{user_upn}",
  "mail": null
}

mail is null because no Exchange Online license is assigned — expected behavior.

Step 3 — (Optional) Send credentials via Graph sendMail

POST https://graph.microsoft.com/v1.0/users/{sender_id}/sendMail
Content-Type: application/json

{
  "message": {
    "subject": "New account created: {display_name}",
    "body": {
      "contentType": "Text",
      "content": "UPN: {user_upn}\nTemp password: {temporary_password}\nUser must change password at first sign-in."
    },
    "toRecipients": [
      { "emailAddress": { "address": "{recipient_email}" } }
    ]
  }
}

Security note: consider sending only the UPN via email and distributing the password via a secure secret-sharing channel.

Create the user with Microsoft Graph PowerShell

Use the Microsoft.Graph PowerShell SDK. The script generates a cryptographically-random password, creates the account, and optionally emails the credentials.

Prerequisites

• Install-Module Microsoft.Graph -Scope CurrentUser
• Sign-in scopes: User.ReadWrite.All (plus Mail.Send if emailing from a service account)

Connect and run

Connect-MgGraph -Scopes "User.ReadWrite.All","Mail.Send"

# Check for existing user
$existing = Get-MgUser -Filter "userPrincipalName eq '$UserPrincipalName'" -ErrorAction SilentlyContinue
if ($existing) { throw "User already exists." }

# Generate a 16-char secure password
$chars = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz23456789!@#$%'.ToCharArray()
$rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
$bytes = New-Object byte[] 16
$rng.GetBytes($bytes)
$password = -join ($bytes | ForEach-Object { $chars[$_ % $chars.Length] })

Create the user

$params = @{
    AccountEnabled    = $true
    DisplayName       = $DisplayName
    MailNickname      = $MailNickname
    UserPrincipalName = $UserPrincipalName
    PasswordProfile   = @{
        ForceChangePasswordNextSignIn = $true
        Password                      = $password
    }
}
$newUser = New-MgUser -BodyParameter $params

After creation, hand the credentials to the recipient via your preferred secure channel. The downloadable script below automates the full flow, including optional email delivery.