6.2 Bulk User Management with Graph & Entra PowerShell

Microsoft 365 Administrator Expert MS-102

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 MS-102 Exam Facts & Blueprint 1.2 Registration, Retake & Renewal 1.3 Study Strategy & Using This Guide

2 Tenant Setup, Domains & Org Settings

2.1 Creating a Microsoft 365 Tenant 2.2 Implementing and Managing Domains 2.3 Configuring Org Settings: Security, Privacy & Profile

3 Service Health, Network & Software Updates

3.1 Monitoring Service Health & Notifications 3.2 Network Connectivity Insights 3.3 Configuring & Monitoring Software Updates

4 Adoption, Usage & Microsoft 365 Backup

4.1 Monitoring Adoption & Usage 4.2 Configuring & Managing Microsoft 365 Backup

5 Users, Contacts, Groups & Shared Mailboxes

5.1 Creating & Managing Users Including External Users 5.2 Creating & Managing Contacts 5.3 Managing Microsoft 365 Groups & Shared Mailboxes

6 Licensing & Bulk User Management

6.1 Managing & Monitoring Microsoft 365 Licenses 6.2 Bulk User Management with Graph & Entra PowerShell

7 Roles, Admin Units & Privileged Identity Management

7.1 Implementing & Managing Roles in M365 & Entra ID 7.2 Managing Permissions for Defender XDR, Purview & Workloads 7.3 Managing Delegation with Administrative Units 7.4 Managing Entra ID Roles in PIM

8 Identity Synchronization with Entra Connect

8.1 Preparing for Identity Synchronization & IdFix 8.2 Directory Sync with Entra Connect Sync & Cloud Sync 8.3 Monitoring Sync with Entra Connect Health 8.4 Troubleshooting Synchronization

9 Authentication, SSPR & Password Protection

9.1 Implementing & Managing Authentication Methods 9.2 Self-Service Password Reset (SSPR) 9.3 Microsoft Entra Password Protection 9.4 Investigating & Resolving Authentication Issues

10 Identity Protection, Conditional Access & MFA

10.1 Planning for Identity Protection 10.2 Implementing Entra Identity Protection 10.3 Planning & Implementing Conditional Access Policies 10.4 Managing MFA with Conditional Access

11 Defender XDR Posture, Incidents & Threat Intelligence

11.1 Security Exposure Management & Secure Score 11.2 Incidents, Alerts & Advanced Hunting 11.3 Reviewing Defender XDR Reports 11.4 Defender Threat Intelligence

12 Defender for Office 365: Policies, Alerts & Investigation

12.1 Threat Policies & Rules in Defender for Office 365 12.2 Configuring Alert Policies 12.3 Investigating & Responding to Email Threats

13 Attack Simulation & Restricted Entities

13.1 Managing Attack Simulations & Training 13.2 Managing Restricted Entities & Blocked Users

14 Defender for Endpoint

14.1 Onboarding Devices to Defender for Endpoint 14.2 Configuring Endpoint Settings 14.3 Defender Vulnerability Management Dashboard

15 Defender for Cloud Apps

15.1 Configuring the App Connector for Microsoft 365 15.2 Defender for Cloud Apps Policies & Alerts 15.3 Interpreting the Activity Log 15.4 Cloud App Discovery

16 Purview Information Protection & Data Lifecycle

16.1 Sensitive Information Types 16.2 Retention Labels & Policies 16.3 Sensitivity Labels & Policies 16.4 Monitoring Label Usage: Content & Activity Explorer

17 Purview Data Loss Prevention

17.1 DLP Policies for Microsoft 365 Workloads 17.2 Configuring Endpoint DLP 17.3 Reviewing & Responding to DLP Alerts, Events & Reports

18 Final Review & Exam Strategy

18.1 Exam-Day Strategy & Question Handling 18.2 Final Review Checklist & Next Steps

6.2 Bulk User Management with Graph & Entra PowerShell

Key Takeaways Explain This Topic AI

The legacy MSOnline and AzureAD PowerShell modules are deprecated and retired; administrators must use Microsoft Graph PowerShell or the newer Microsoft Entra PowerShell module instead

Microsoft Graph PowerShell connects with Connect-MgGraph using consented scopes such as User.ReadWrite.All and Group.ReadWrite.All, and exposes cmdlets like Get-MgUser, New-MgUser, Update-MgUser, and Set-MgUserLicense

Microsoft Entra PowerShell is the newer Microsoft.Entra module that replaces MSOnline and AzureAD cmdlet patterns with cmdlets like Connect-Entra, Get-EntraUser, and New-EntraUser

The Microsoft 365 admin center supports bulk operations including bulk add users from CSV, bulk invite guest users, bulk restore deleted users, and export users to CSV

A typical bulk provisioning flow reads a CSV, creates users with New-MgUser, assigns licenses with Set-MgUserLicense, and adds them to groups with New-MgGroupMember, all driven by group-based licensing where possible

Last updated: August 2026

Bulk User Management with Graph & Entra PowerShell

Quick Answer: The MSOnline and AzureAD PowerShell modules are deprecated and retired — use Microsoft Graph PowerShell ( Microsoft.Graph ) or the newer Microsoft Entra PowerShell ( Microsoft.Entra ) module instead. The Microsoft 365 admin center also supports bulk CSV operations for add, invite, restore, and export.

MS-102 expects you to know both the GUI bulk tools and the PowerShell automation path, and critically, to know which PowerShell modules are current. Getting this wrong in production breaks automation; getting it wrong on the exam loses easy points.

Admin-Center Bulk Operations

The Microsoft 365 admin center provides point-and-click bulk tools under Users → Active users and Users → Deleted users :

Bulk add users — download the CSV template, fill in display name, user principal name, first name, last name, usage location, assigned licenses, and other columns, then upload to create many users at once.

Bulk invite guest users — invite external collaborators in bulk from a CSV of email addresses.

Bulk restore deleted users — select multiple deleted users and restore them within the 30-day soft-delete window.

Export users — export the active user list to CSV for reporting or offline editing.

These GUI tools are fine for one-off migrations, but repeatable operations belong in PowerShell. That is where the deprecation story matters.

The MSOnline / AzureAD Deprecation

The older MSOnline ( Connect-MsolService , Get-MsolUser ) and AzureAD ( Connect-AzureAD , Get-AzureADUser ) modules are deprecated . Microsoft has retired them and removed support; they no longer receive feature updates and will fail against the current service endpoints. The two supported replacement paths are:

Microsoft Graph PowerShell — the Microsoft.Graph module, the primary automation surface for Microsoft 365 and Entra ID.

Microsoft Entra PowerShell — the newer Microsoft.Entra module, designed as a closer cmdlet-name successor to MSOnline/AzureAD for Entra ID-specific operations.

Any new automation, runbook, or exam answer must use one of these. Do not write or recommend Connect-MsolService or Connect-AzureAD .

• Microsoft Graph PowerShell
• Install the module and connect with the required scopes: Install-Module Microsoft.Graph -Scope CurrentUser
• Connect-MgGraph -Scopes "User.ReadWrite.All", "Group.ReadWrite.All", "Directory.ReadWrite.All"

Connect-MgGraph triggers a device-code or interactive browser sign-in and consents to the listed scopes. Scopes map to Microsoft Graph permissions; for user and license management you typically need User.ReadWrite.All , Group.ReadWrite.All , and Directory.ReadWrite.All .

Key cmdlets for user and group management:

• Cmdlet Purpose
• Get-MgUser List or retrieve users; supports -Filter , -Search , -All
• New-MgUser Create a user; requires userPrincipalName , DisplayName , MailNickname , and PasswordProfile
• Update-MgUser Update user properties including usage location
• Remove-MgUser Delete a user (soft-deleted for 30 days)
• Get-MgGroup / Get-MgGroupMember Retrieve groups and memberships
• New-MgGroupMember Add a user to a group (drives group-based licensing)
• Set-MgUserLicense Assign or remove a license SKU on a user, with optional disabledPlans

License assignment via Graph PowerShell uses Set-MgUserLicense , which takes the user, an AddLicenses array of SKU IDs, a RemoveLicenses array, and optionally disabled service plan IDs within AddLicenses .

Microsoft Entra PowerShell

The Microsoft Entra PowerShell module ( Microsoft.Entra ) is the newer Entra ID-focused module that mirrors the old MSOnline/AzureAD cmdlet verbs more closely, easing migration: Install-Module Microsoft.Entra -Scope CurrentUser

Connect-Entra -Scopes "User.ReadWrite.All", "Group.ReadWrite.All"

Key cmdlets include Get-EntraUser , New-EntraUser , Set-EntraUser , Remove-EntraUser , Get-EntraGroup , and New-EntraGroupMember . For license assignment, Entra PowerShell wraps the same Graph license APIs. Use Entra PowerShell when an organization is migrating existing MSOnline/AzureAD scripts and wants minimal cmdlet-name churn; use Graph PowerShell when you need the broadest Microsoft 365 workload coverage in one module.

A Realistic Bulk Provisioning Flow

A common onboarding flow reads a CSV of new hires, creates each user, sets usage location, assigns a license, and adds them to groups that drive group-based licensing and app access. The PowerShell below is illustrative — it shows the cmdlet pattern, not a production-hardened script: # Assumes Connect-MgGraph with User.ReadWrite.All, Group.ReadWrite.All already consented

• $users = Import-Csv "C:\Onboarding\NewHires.csv"
• $e3Sku = Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "ENTERPRISEPACK"

• foreach ($u in $users) {
• $newUser = New-MgUser -DisplayName $u.DisplayName `
• UserPrincipalName $u.UPN -MailNickname $u.MailNickname `

-UsageLocation $u.UsageLocation -PasswordProfile @{ Password=$u.TempPassword; ForceChangePasswordNextSignIn=$true } `

-AccountEnabled

Set-MgUserLicense -UserId $newUser.Id -AddLicenses @{ SkuId = $e3Sku.SkuId } -RemoveLicenses @()

• # Add to a group that grants app access (group-based licensing can also be used here instead)
• New-MgGroupMember -GroupId $u.GroupId -DirectoryObjectId $newUser.Id
• }

When group-based licensing is in place, the Set-MgUserLicense call can be omitted entirely and the New-MgGroupMember step alone provisions the license — a cleaner pattern that keeps licensing tied to group membership.

Common Bulk Scenarios

Bulk create — read a CSV, loop New-MgUser with mandatory properties, then enable accounts.

Bulk license assignment — either via group membership ( New-MgGroupMember ) or a loop of Set-MgUserLicense for direct assignment; prefer the group path for maintainability.

Bulk group membership — enumerate a CSV of user UPNs and group IDs, resolve each to an object ID, and call New-MgGroupMember .

Bulk offboarding — disable accounts ( Update-MgUser -AccountEnabled:$false ), remove from licensing groups (or call Set-MgUserLicense with RemoveLicenses ), and optionally Remove-MgUser to soft-delete; sign-out sessions via Revoke-MgUserSignInSession to cut active tokens immediately.

Bulk restore — within the 30-day window, Restore-MgUser -UserId <id> reactivates a soft-deleted user with properties and group memberships intact.

Choosing the Right Tool

• Need Use
• One-off CSV import, no scripting skills Admin center Bulk add users
• Repeatable user provisioning Microsoft Graph PowerShell ( Microsoft.Graph )
• Migrating legacy MSOnline/AzureAD scripts Microsoft Entra PowerShell ( Microsoft.Entra )
• License assignment at scale Group-based licensing, optionally driven by Graph PowerShell group membership
• Offboarding automation Graph PowerShell Update-MgUser , Set-MgUserLicense , Remove-MgUser