Managing Users & Groups
Create users and groups, manage custom security attributes, and automate bulk operations with PowerShell — the daily bread of identity administration.
Users and groups — the building blocks
Users are people. Groups are teams. Together they’re how you organise who gets what.
Imagine a school. Every student (user) has a name, a class, and a locker. Instead of assigning textbooks to each student individually, the teacher gives them to a class (group) — everyone in Class 3B gets the science textbook automatically.
Entra ID works the same way. Create users, put them in groups, then assign licences, apps, and policies to the groups. When someone joins or leaves, just update the group — everything else follows.
User management essentials
Creating users
Two paths to create a user:
- Entra admin center → Users → New user → fill in properties
- PowerShell →
New-MgUsercommand (for automation)
Key user properties:
| Property | Required? | Example |
|---|---|---|
| User principal name (UPN) | Yes | jake@coastlinecreative.co.nz |
| Display name | Yes | Jake Torres |
| Password | Yes (initial) | Auto-generated or manually set |
| Job title | No | IT Administrator |
| Department | No | Technology |
| Usage location | Yes (for licensing) | NZ, US, AU |
| Account enabled | Yes | True / False |
Exam tip: usage location is mandatory for licensing
You cannot assign a licence to a user without a usage location set. This catches many admins off-guard — they create users, try to assign M365 licences, and get an error.
Why? Microsoft needs to know the user’s country for legal and service availability reasons (some features aren’t available in all regions).
User types
| Type | Source | Managed Where | Example |
|---|---|---|---|
| Cloud user | Created in Entra ID | Entra admin center | New hire at cloud-only org |
| Synced user | Created in on-prem AD | On-prem AD (changes sync up) | Employee at hybrid org |
| Guest user | Invited via B2B | External (home tenant) | Contractor from another company |
Group types — security vs M365
| Feature | Security Group | Microsoft 365 Group |
|---|---|---|
| Primary purpose | Control access to resources | Collaboration (mailbox, SharePoint, Teams) |
| Members | Users, devices, service principals, other groups | Users only |
| Shared mailbox | ||
| SharePoint site | ||
| Teams team | Can be Teams-enabled | |
| Can assign licences | ||
| Can scope CA policies | ||
| Dynamic membership | ||
| Nesting (groups in groups) |
Membership types
| Type | How Members Are Added | Best For |
|---|---|---|
| Assigned | Manually add/remove members | Small, stable groups |
| Dynamic user | Automatic based on user attribute rules | Department-based groups (e.g., all Finance users) |
| Dynamic device | Automatic based on device attributes | Device management groups (e.g., all Windows 11 devices) |
Dynamic membership rule example:
user.department -eq "Finance" -and user.country -eq "NZ"
This automatically adds all NZ-based Finance users to the group. When someone transfers out of Finance, they’re automatically removed.
Custom security attributes
Custom security attributes are business-specific metadata you attach to users and applications. They’re like custom columns you add to a spreadsheet.
Why they matter:
- Tag users with business-relevant data (project codes, clearance levels, cost centres)
- Use attributes in Conditional Access policies or entitlement management
- Data is stored securely — only users with the Attribute Assignment Administrator role can read/write them
Structure:
- Attribute set = a category (e.g., “HR” or “Security”)
- Attribute definition = a specific attribute within the set (e.g., “ClearanceLevel”)
- Attribute value = the value assigned to a user (e.g., “Top Secret”)
Scenario: Priya tags clinical staff at Meridian Health
Priya creates a custom security attribute set called “Clinical” with attributes:
- ClearanceLevel: “Standard”, “Elevated”, “Critical”
- Ward: “Emergency”, “Paediatrics”, “Surgery”, etc.
She then creates a Conditional Access policy: IF user’s ClearanceLevel is NOT “Critical” → THEN block access to the patient records app from unmanaged devices.
Why not use groups? Groups are binary (you’re in or out). Custom attributes are multi-valued and more flexible — a user can have ClearanceLevel=Elevated AND Ward=Emergency simultaneously, enabling fine-grained access control.
Bulk operations — don’t click 500 times
When you need to create, invite, or delete many users at once, use bulk operations.
Entra admin center approach:
- Download the CSV template from Users → Bulk operations
- Fill in user details (one row per user)
- Upload the CSV → Entra processes it
PowerShell approach (more powerful):
# Bulk create users from CSV
$users = Import-Csv -Path "NewHires.csv"
foreach ($user in $users) {
New-MgUser -DisplayName $user.Name `
-UserPrincipalName $user.UPN `
-PasswordProfile @{ Password = $user.TempPassword } `
-UsageLocation $user.Location `
-AccountEnabled
}Exam tip: bulk operation types
The Entra admin center supports these bulk operations via CSV:
- Bulk create — create new users
- Bulk invite — invite external/guest users
- Bulk delete — delete users
- Download users — export user list
PowerShell (Microsoft Graph PowerShell SDK) is more flexible — you can bulk-update properties, assign licences, add to groups, and chain operations together.
🎬 Video walkthrough
Flashcards
Knowledge Check
Jake needs to create 30 new user accounts for a batch of freelancers joining Coastline Creative next month. He wants to do this quickly without clicking through the Entra admin center 30 times. What's the most efficient approach?
Priya wants to automatically group all Meridian Health employees in the Surgery department into a security group for targeted Conditional Access policies. Which membership type should she use?
Anika's client wants to use custom security attributes to tag users with a 'ProjectCode' and then use that attribute in Conditional Access policies. What must they do first?
Next up: Device Registration & Licensing — manage how devices join your tenant and assign the right licences to the right people.