Every tenant eventually meets its first mass-onboarding moment — a merger, a new site opening, a term of student accounts, a contractor wave. The New user wizard in Microsoft Entra ID was built for one person at a time. Bulk create was built for the other case: dozens, hundreds, or thousands of identities provisioned from a single file.

This piece walks through what bulk creation actually does under the hood, the two practical ways to run it — the built-in CSV pipeline and Microsoft Graph PowerShell — where each one breaks, and a full step-by-step tutorial to run your own bulk import safely, on the first attempt.

01Why Bulk Creation Earns Its Place

Manually creating accounts scales linearly with tedium: each user is a form, a password, a set of attributes, a license assignment, a group membership. At any real headcount, that process becomes the bottleneck for onboarding day one — badges are printed, desks are assigned, but sign-in still isn’t ready.

Bulk creation collapses that into a single reviewable artifact: a spreadsheet. It’s auditable before submission, repeatable across environments, and — critically — it’s the same shape of file whether five people are onboarding or five hundred.

02Two Roads In

Both paths land in the same place — new objects in the directory — but they suit different operators and different scales.

For most IT teams, the decision comes down to volume and repeatability. A one-time batch of forty seasonal staff is a portal job. A recurring quarterly intake tied to an HR export belongs in a script that can be scheduled, logged, and re-run.

03Reading the CSV Template

The template downloaded from the portal isn’t an ordinary spreadsheet — its structure is load-bearing. Row one carries a version tag such as version:v1.0, and the column header row encodes both the human-readable label and the underlying property name, like Name [displayName] Required. Neither row should be touched.

Only the first four columns are mandatory. Everything else can stay blank in the template and be enriched later — through a second bulk update, a HR sync, or manually.

A bulk import is only as trustworthy as the row you didn’t check.

04What Bulk Create Doesn’t Do

• No invitation email. Bulk create provisions internal member accounts with the password you specify — nothing is sent to the user. Credentials have to reach them through your own onboarding channel.
• No license assignment. The CSV creates the identity, not the seat. Licensing is a separate step — group-based licensing tied to a security group is the least painful way to attach it at scale.
• No group membership. Same story — accounts land with no group ties unless a dynamic group rule picks them up based on an attribute like department.
• No large-batch guarantee. Jobs that don’t complete within the service’s processing window can partially fail. Splitting a very large population into smaller batches is safer than submitting one enormous file.

05When to Reach for PowerShell Instead

The portal CSV flow is deliberately narrow — it creates accounts and nothing more. The moment a batch needs conditional logic (different usage locations per office, license group assignment in the same run, custom attribute mapping from an HR export), Microsoft Graph PowerShell earns its complexity. The same source CSV can drive it — only the execution engine changes.

# Connect with the minimum scope this task needs
Connect-MgGraph -Scopes "User.ReadWrite.All"

# Source rows — same shape as the portal template
$users = Import-Csv -Path "C:\Import\NewUsers.csv"

foreach ($u in $users) {
    $passwordProfile = @{
        Password                      = $u.InitialPassword
        ForceChangePasswordNextSignIn = $true
    }

    New-MgUser `
        -DisplayName $u.DisplayName `
        -UserPrincipalName $u.UserPrincipalName `
        -MailNickname ($u.UserPrincipalName -split "@")[0] `
        -AccountEnabled `
        -PasswordProfile $passwordProfile `
        -UsageLocation $u.UsageLocation `
        -JobTitle $u.JobTitle `
        -Department $u.Department

    Write-Host "Created:" $u.UserPrincipalName
}

The trade is explicit: the portal path needs zero setup and produces a built-in results file; the scripted path needs Graph module installation and delegated permissions, but earns per-row error handling, inline license assignment, and something the portal doesn’t give you at all — a re-runnable, source-controlled onboarding pipeline.

06Before You Submit — A Short Checklist

• Re-download the template if it’s more than a few weeks old — column definitions do change between versions.
• Confirm every userPrincipalName is unique and matches a verified domain on the tenant.
• Set Usage location on every row you intend to license — it can’t be added retroactively through the same bulk job.
• Test with a three-to-five row batch before submitting the full population. It’s cheaper to fix a bad password policy on five accounts than five hundred.
• Keep the signed-in account at least User Administrator — lower roles can’t reach the Bulk create page at all.