How to Perform Bulk User Creation in Microsoft Entra ID

1. Overview of Bulk User Creation

Microsoft Entra ID supports bulk creation of internal member accounts through a CSV upload in the Microsoft Entra admin center. Administrators download the current template, add one user per row, upload the file, validate it, and submit the bulk job.

For repeatable or automated workflows, Microsoft Graph PowerShell provides a programmatic approach using the New-MgUser cmdlet. Choose the method that matches the size of the task, operational controls, and your organization’s automation standards.

2. Prerequisites and Permissions

• An active Microsoft Entra tenant.
• Access to the Microsoft Entra admin center.
• At least the User Administrator role to bulk create users in the admin center.
• Verified tenant domain and a naming convention for user principal names (UPNs).
• An approved user list containing names, UPNs, and initial password handling instructions.
• For PowerShell, Microsoft Graph PowerShell and an account with the required user-creation permission.

Use a dedicated administrative account and follow Privileged Identity Management (PIM) or just-in-time elevation policies where your organization has them enabled.

3. Plan the User List Before Import

Before creating accounts, confirm the business owner has approved the identities and access requirements. Define the user’s display name, sign-in name, department, usage location (if needed), and intended group membership.

Check for duplicate UPNs, spelling errors, incorrect tenant domains, and users who already exist. Keep the approved source list separate from the import file and retain an audit record of the request.

4. Download and Prepare the Official CSV Template

Illustrative CSV structure

The following is a simplified example of the three required fields. For an actual portal upload, use the exact full header row and any version/example rows from the template downloaded from your tenant.

Name [displayName] Required,User name [userPrincipalName] Required,Initial password [passwordProfile] Required
Alex Morgan,alex.morgan@contoso.com,REPLACE_WITH_SECURE_INITIAL_PASSWORD
Jamie Lee,jamie.lee@contoso.com,REPLACE_WITH_SECURE_INITIAL_PASSWORD
Taylor Smith,taylor.smith@contoso.com,REPLACE_WITH_SECURE_INITIAL_PASSWORD

Do not use the placeholder password literally. Replace it through your organization’s approved credential-generation and delivery process.

5. Create Users in the Microsoft Entra Admin Center

6. Review Bulk Operation Results

Open the bulk operation results area in the Entra admin center and locate the submitted job. Review its status and download the results file if the operation reports errors.

• Confirm the job completed rather than remaining pending or failed.
• Review each failed row and the reason returned by the service.
• Correct only the affected records and resubmit them as a controlled new batch.
• Do not blindly re-upload the entire original file, because some accounts may already have been created.

Microsoft notes that large bulk operations can encounter time-related limitations. If a job does not complete within the service window, divide the records into smaller batches and retry after reviewing the job outcome.

7. Bulk User Creation with Microsoft Graph PowerShell

Microsoft Graph PowerShell is useful when provisioning must be repeatable, logged, or integrated into an administrative workflow. This example reads a CSV with administrator-defined columns and creates users one at a time.

7.1 Install Microsoft Graph PowerShell

Install-Module Microsoft.Graph -Scope CurrentUser

7.2 Connect with the required permission

Import-Module Microsoft.Graph.Users
Connect-MgGraph -Scopes "User.ReadWrite.All"
Get-MgContext

Use an account authorized to consent to or use the requested permission under your tenant’s consent policies. Grant only the permissions required for the task.

7.3 Prepare a PowerShell-specific CSV

This is a separate input format for the script below; it is not the portal’s downloaded CSV template. Save it as entra-users-graph.csv with these columns:

DisplayName,UserPrincipalName,MailNickname,GivenName,Surname,Department,UsageLocation,InitialPassword
Alex Morgan,alex.morgan@contoso.com,alex.morgan,Alex,Morgan,IT Operations,PK,REPLACE_WITH_SECURE_PASSWORD
Jamie Lee,jamie.lee@contoso.com,jamie.lee,Jamie,Lee,Finance,PK,REPLACE_WITH_SECURE_PASSWORD

7.4 Run the user-creation script

$CsvPath = ".\entra-users-graph.csv"
$Users = Import-Csv -Path $CsvPath

$Results = foreach ($User in $Users) {
    try {
        if ([string]::IsNullOrWhiteSpace($User.UserPrincipalName)) {
            throw "UserPrincipalName is empty."
        }

        $Existing = Get-MgUser -Filter "userPrincipalName eq '$($User.UserPrincipalName)'" -ErrorAction SilentlyContinue

        if ($Existing) {
            [pscustomobject]@{
                UserPrincipalName = $User.UserPrincipalName
                Status = "Skipped"
                Details = "A user with this UPN already exists."
            }
            continue
        }

        $PasswordProfile = @{
            Password = $User.InitialPassword
            ForceChangePasswordNextSignIn = $true
        }

        $Parameters = @{
            DisplayName       = $User.DisplayName
            UserPrincipalName = $User.UserPrincipalName
            MailNickname      = $User.MailNickname
            AccountEnabled    = $true
            PasswordProfile   = $PasswordProfile
        }

        if ($User.GivenName)     { $Parameters.GivenName = $User.GivenName }
        if ($User.Surname)       { $Parameters.Surname = $User.Surname }
        if ($User.Department)    { $Parameters.Department = $User.Department }
        if ($User.UsageLocation) { $Parameters.UsageLocation = $User.UsageLocation }

        $Created = New-MgUser @Parameters -ErrorAction Stop

        [pscustomobject]@{
            UserPrincipalName = $User.UserPrincipalName
            Status = "Created"
            Details = $Created.Id
        }
    }
    catch {
        [pscustomobject]@{
            UserPrincipalName = $User.UserPrincipalName
            Status = "Failed"
            Details = $_.Exception.Message
        }
    }
}

$Results | Export-Csv ".\entra-user-creation-results.csv" -NoTypeInformation
$Results | Format-Table -AutoSize

The script checks for an existing UPN, creates the account, sets the password-change-at-next-sign-in flag, and writes a result for each row. Review the script in a test tenant before production use. Password complexity, banned-password, authentication, licensing, and tenant policies still apply.

7.5 Disconnect the Graph session

Disconnect-MgGraph

8. Verify the Created Users

After the bulk job completes, verify the accounts in the admin center and, if appropriate, with Microsoft Graph PowerShell.

Verify in the admin center

1. Open Entra ID → Users → All users.
2. Search for several UPNs from the import list.
3. Open each account and verify display name, UPN, account status, and expected profile properties.
4. Compare the created accounts with the approved request list.

Verify with PowerShell

Connect-MgGraph -Scopes "User.Read.All"

Get-MgUser -Filter "UserType eq 'Member'" `
  -Property Id,DisplayName,UserPrincipalName,AccountEnabled |
  Select-Object DisplayName,UserPrincipalName,AccountEnabled,Id

Disconnect-MgGraph

For a targeted check, replace the filter with a specific UPN filter or query the user by ID. Avoid relying only on a total user count; confirm the expected identities and properties.

9. Add Newly Created Users to Groups

Creating users and assigning group membership are separate administrative actions. After verifying the accounts, add them to the correct security or Microsoft 365 groups according to your access model.

For a detailed walkthrough of group creation and membership management, see our related tutorial:

Use role-appropriate groups and avoid granting broad access simply to make onboarding easier. Where possible, use group-based licensing and access assignments with documented ownership.

10. Troubleshooting Common Bulk User Creation Errors

CSV upload or validation fails

Download a fresh template and preserve its headers and any version row exactly. Confirm the file is saved with a .csv extension and contains no unexpected spaces or malformed rows.

Duplicate user principal name

Search the tenant for the UPN before resubmitting. Choose a unique, approved sign-in name rather than changing names arbitrarily.

Initial password rejected

Use a password that meets the tenant’s active password policy. Avoid reusing a shared password across many users; use an approved per-user credential process.

Bulk operation reports partial failures

Download the results file, identify failed rows, and correct only those entries. Some users may already have been created successfully.

PowerShell reports insufficient privileges

Check the signed-in identity, Graph scopes, tenant consent, and assigned directory role. Reconnect after permission changes and test with a limited account set.

Graph script skips or fails a user

Inspect the exported results CSV, verify the UPN and required fields, and confirm the account does not already exist. Review the returned error before retrying.

11. Security and Operational Best Practices

• Use the least-privileged role that supports the task; the portal workflow requires at least User Administrator.
• Obtain approval for the user list and intended access before provisioning.
• Use unique initial passwords and require a password change at first sign-in where appropriate.
• Deliver credentials through an approved secure channel, never in the same email as the account list.
• Protect CSV files and PowerShell input files because they may contain credentials and personal information.
• Test with a small batch before importing a large population.
• Keep the bulk job result and a reconciliation record for audit purposes.
• Verify accounts, group membership, usage location, and licensing separately.
• Disable or remove accounts promptly when a provisioning request is cancelled or incorrect.
• Use a controlled change window for large imports and split batches if service limits or timeouts occur.