Create an Entra ID User, Assign an E5 License, and Grant Global Administrator Role

Create the User in Microsoft 365 Admin Center

1. Sign in to the Microsoft 365 Admin Center as a Global Administrator or User Administrator.
2. Navigate to Users → Active users → Add a user.
3. Fill in the Basics tab:
   • First name: {first_name}
   • Last name: {last_name}
   • Display name: {display_name}
   • Username: {mail_nickname} @ select your verified domain
4. Choose Automatically create a password (or set one manually) and check Require this user to change their password when they first sign in.
5. Check Send the password in email upon completion only if your security policy permits it — otherwise deliver the password out-of-band.
6. Click Next.

Assign the E5 License

1. On the Product licenses tab, set the Location to the user's country (e.g., United States).
2. Toggle Microsoft 365 E5 (or Microsoft 365 E5 Developer) to On.
3. Review the included apps and services — leave defaults unless you need to carve out specific service plans.
4. Click Next.

Grant the Global Administrator Role

1. On the Optional settings tab, expand Roles.
2. Select Admin center access, then check Global administrator.
3. Enter an alternate email address for password recovery (required for admin roles).
4. Click Next, review the summary, and click Finish adding.

Verify Provisioning

1. Navigate to Users → Active users → {display_name} and confirm the license shows as assigned and the mailbox status shows as provisioned (may take 5–15 minutes).
2. In the Entra admin center, navigate to Roles & admins → Global Administrator and confirm the user appears as an active assignment.
3. Immediately either enable Security Defaults or apply a Conditional Access policy requiring MFA for this user.

Graph API Workflow

This workflow requires four sequential calls: resolve the domain, create the user, assign the license, and add the role member. All calls target https://graph.microsoft.com.

Step 1 — Resolve the Default Verified Domain

GET /v1.0/domains?$select=id,isDefault,isVerified

Find the entry where isDefault: true and isVerified: true. Use its id as the UPN suffix.

Step 2 — Enumerate Subscribed SKUs

GET /v1.0/subscribedSkus?$select=skuId,skuPartNumber,capabilityStatus,consumedUnits,prepaidUnits

Locate the SKU with skuPartNumber of SPE_E5 (production) or DEVELOPERPACK_E5 (dev tenant). Confirm prepaidUnits.enabled - consumedUnits > 0. Record the skuId.

Step 3 — Resolve the Global Administrator Role ID

GET /v1.0/directoryRoles?$filter=displayName eq 'Global Administrator'

If the role is not returned, it has not been activated in the tenant yet. Activate it with POST /v1.0/directoryRoles using the template ID 62e90394-69f5-4237-9190-012177145e10.

Step 4 — Create the User

POST /v1.0/users
Content-Type: application/json

{
  "accountEnabled": true,
  "displayName": "{display_name}",
  "givenName": "{first_name}",
  "surname": "{last_name}",
  "mailNickname": "{mail_nickname}",
  "userPrincipalName": "{mail_nickname}@{verified_domain}",
  "usageLocation": "US",
  "passwordProfile": {
    "forceChangePasswordNextSignIn": true,
    "password": "{generated_password}"
  }
}

Response 201 Created returns the new user's id (GUID). Capture it for subsequent calls.

Step 5 — Assign the E5 License

POST /v1.0/users/{user_id}/assignLicense
Content-Type: application/json

{
  "addLicenses": [{ "skuId": "{e5_sku_id}" }],
  "removeLicenses": []
}

Response 200 OK. The Exchange Online mailbox begins provisioning immediately — the mail property will populate within a few minutes.

Step 6 — Add User to Global Administrator Role

POST /v1.0/directoryRoles/{role_id}/members/$ref
Content-Type: application/json

{
  "@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/{user_id}"
}

Response 204 No Content.

Step 7 — Verification

GET /v1.0/users/{user_id}?$select=id,displayName,userPrincipalName,mail,accountEnabled,usageLocation
GET /v1.0/users/{user_id}/licenseDetails
GET /v1.0/directoryRoles/{role_id}/members?$select=id,displayName,userPrincipalName

Automate With Microsoft Graph PowerShell

The script below uses the Microsoft.Graph PowerShell SDK to perform the full provisioning flow, generate a secure password, and return a structured result object. It handles the common ordering pitfall (usageLocation must precede license assignment) and activates the Global Administrator role template if the role is not yet instantiated.

Prerequisites

• PowerShell 7+ recommended
• Microsoft Graph PowerShell SDK: Install-Module Microsoft.Graph -Scope CurrentUser
• Sign in with an account holding User Administrator + Privileged Role Administrator (or Global Administrator)

Usage

# Dot-source or run directly:
.\New-EntraAdminUser.ps1 -FirstName 'Janna' -LastName 'Pak' -MailNickname 'janna.pak' -LicenseSkuPartNumber 'SPE_E5'

What the Script Does

1. Connects to Graph with the minimum required scopes.
2. Resolves the default verified domain for the UPN suffix.
3. Validates the target SKU exists and has available units.
4. Checks for existing users matching the UPN (fails fast on duplicates).
5. Generates a 16-character cryptographically random password.
6. Creates the user with usageLocation set.
7. Assigns the E5 license.
8. Activates the Global Administrator role template if needed, then adds the user as a member.
9. Verifies and returns a summary object including the initial password.