5.1 Creating & Managing Users Including External Users

Microsoft 365 Administrator Expert MS-102

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 MS-102 Exam Facts & Blueprint 1.2 Registration, Retake & Renewal 1.3 Study Strategy & Using This Guide

2 Tenant Setup, Domains & Org Settings

2.1 Creating a Microsoft 365 Tenant 2.2 Implementing and Managing Domains 2.3 Configuring Org Settings: Security, Privacy & Profile

3 Service Health, Network & Software Updates

3.1 Monitoring Service Health & Notifications 3.2 Network Connectivity Insights 3.3 Configuring & Monitoring Software Updates

4 Adoption, Usage & Microsoft 365 Backup

4.1 Monitoring Adoption & Usage 4.2 Configuring & Managing Microsoft 365 Backup

5 Users, Contacts, Groups & Shared Mailboxes

5.1 Creating & Managing Users Including External Users 5.2 Creating & Managing Contacts 5.3 Managing Microsoft 365 Groups & Shared Mailboxes

6 Licensing & Bulk User Management

6.1 Managing & Monitoring Microsoft 365 Licenses 6.2 Bulk User Management with Graph & Entra PowerShell

7 Roles, Admin Units & Privileged Identity Management

7.1 Implementing & Managing Roles in M365 & Entra ID 7.2 Managing Permissions for Defender XDR, Purview & Workloads 7.3 Managing Delegation with Administrative Units 7.4 Managing Entra ID Roles in PIM

8 Identity Synchronization with Entra Connect

8.1 Preparing for Identity Synchronization & IdFix 8.2 Directory Sync with Entra Connect Sync & Cloud Sync 8.3 Monitoring Sync with Entra Connect Health 8.4 Troubleshooting Synchronization

9 Authentication, SSPR & Password Protection

9.1 Implementing & Managing Authentication Methods 9.2 Self-Service Password Reset (SSPR) 9.3 Microsoft Entra Password Protection 9.4 Investigating & Resolving Authentication Issues

10 Identity Protection, Conditional Access & MFA

10.1 Planning for Identity Protection 10.2 Implementing Entra Identity Protection 10.3 Planning & Implementing Conditional Access Policies 10.4 Managing MFA with Conditional Access

11 Defender XDR Posture, Incidents & Threat Intelligence

11.1 Security Exposure Management & Secure Score 11.2 Incidents, Alerts & Advanced Hunting 11.3 Reviewing Defender XDR Reports 11.4 Defender Threat Intelligence

12 Defender for Office 365: Policies, Alerts & Investigation

12.1 Threat Policies & Rules in Defender for Office 365 12.2 Configuring Alert Policies 12.3 Investigating & Responding to Email Threats

13 Attack Simulation & Restricted Entities

13.1 Managing Attack Simulations & Training 13.2 Managing Restricted Entities & Blocked Users

14 Defender for Endpoint

14.1 Onboarding Devices to Defender for Endpoint 14.2 Configuring Endpoint Settings 14.3 Defender Vulnerability Management Dashboard

15 Defender for Cloud Apps

15.1 Configuring the App Connector for Microsoft 365 15.2 Defender for Cloud Apps Policies & Alerts 15.3 Interpreting the Activity Log 15.4 Cloud App Discovery

16 Purview Information Protection & Data Lifecycle

16.1 Sensitive Information Types 16.2 Retention Labels & Policies 16.3 Sensitivity Labels & Policies 16.4 Monitoring Label Usage: Content & Activity Explorer

17 Purview Data Loss Prevention

17.1 DLP Policies for Microsoft 365 Workloads 17.2 Configuring Endpoint DLP 17.3 Reviewing & Responding to DLP Alerts, Events & Reports

18 Final Review & Exam Strategy

18.1 Exam-Day Strategy & Question Handling 18.2 Final Review Checklist & Next Steps

5.1 Creating & Managing Users Including External Users

Key Takeaways Explain This Topic AI

A user's Usage Location must be set before any Microsoft 365 license can be assigned — license assignment fails silently without it

Deleted user accounts in Microsoft Entra ID are recoverable for 30 days from the Deleted users blade before permanent hard deletion

Entra B2B guest users receive a UPN with the #EXT# suffix (e.g., user_gmail.com#EXT#@contoso.onmicrosoft.com) to namespace them inside the host tenant

Guest users have a restricted default permission set — they cannot browse the directory, enumerate other users, or invite additional guests unless an admin grants those rights

B2B direct connect is a trust-based, no-invitation flow used with Teams shared channels between two Entra tenants that both enable the feature

Last updated: August 2026

Creating Users in Microsoft 365

Every identity in Microsoft 365 is rooted in Microsoft Entra ID (formerly Azure AD). You can create users from two admin surfaces that write to the same directory:

Microsoft 365 admin center → Users → Active users → Add a user (streamlined wizard for cloud-only users, license assignment, and roles)

Microsoft Entra admin center → Identity → Users → All users → New user (full directory surface — also handles B2B guests, external identities, and PowerShell/API-driven provisioning)

Required Properties

Property Purpose Notes
Display name Shown in GAL, Teams, SharePoint Free text, appears on sent mail

User principal name (UPN) Sign-in identifier Format user@contoso.com ; must resolve to a verified custom domain or the default *.onmicrosoft.com tenant domain

Password Initial credential Auto-generate (12-char, temporary) or set manually; can require change at first sign-in

Usage location Country/region for license compliance Required before license assignment — a license cannot be assigned if usage location is blank

First/Last name, Job title, Department Profile metadata Optional but surfaced in profile cards and Entra reports

Exam trap: The Usage Location field is a country code (e.g., US ), not a free-text location. If license assignment fails with a compliance error, usage location is missing or set to a country where the service SKU is unavailable.

First Sign-In Behavior

When you check Require password change at first sign-in , the user must reset on initial logon — the temporary password you typed is single-use. With Entra Password Protection enabled, banned-password lists and smart lockout apply to that first reset too. Disabling the checkbox is appropriate for service accounts and break-glass administrators whose password rotation is handled out-of-band.

User Account States and the 30-Day Restore Window

A user object in Entra ID moves through three lifecycle states:

State Sign-in Mail delivery Recoverable
Active Permitted Permitted n/a
Suspended (Blocked sign-in) Blocked Permitted (mailbox kept) Restore by unblocking
Deleted Blocked Stopped Yes — for 30 days

Deleting a user from either admin center moves them to the Deleted users blade in the Entra admin center (Identity → Users → Deleted users). For 30 days the object — including its UPN, group memberships, licenses, and Exchange mailbox (Disconnected state) — can be restored in full. After 30 days the object is hard-deleted and only a support ticket within the mailbox's retained period can recover mail data.

Practical rule: When an employee leaves, block sign-in first , then remove licenses (to free the seat), and only delete the account after confirming mailbox/data export is done. Block-then-delete avoids an accidental 30-day countdown while you decide whether to keep the mailbox as a shared mailbox.

External Users: Entra B2B Collaboration

Entra B2B collaboration lets a host tenant invite external identities to collaborate as guest users without creating a new credential for them in the host directory. The guest signs in with their own home identity (work/school account, personal Microsoft account, Google, or email one-time passcode) and is issued a guest object in the host tenant.

The #EXT# UPN Convention

A guest's UPN in the host tenant is namespaced with #EXT# so it cannot collide with a native member's UPN: Original email: alice@gmail.com

Host tenant: contoso.onmicrosoft.com
Guest UPN: alice_gmail.com#EXT#@contoso.onmicrosoft.com

The guest still signs in with alice@gmail.com — the #EXT# UPN is an internal directory identifier, not a sign-in string. Redemption happens on first sign-in: the guest is redirected to their identity provider, consents, and a refresh token is stored in the host tenant.

Member vs Guest

Capability Member Guest
Default directory read Full directory read (within tenant scope) Restricted — own profile only
Invite other guests No (non-admin) No (unless GuestInviter role granted)
Browse all users / groups Yes No
Can be assigned admin roles Yes Limited — only certain roles

Licenses consumed Typically consumes a tenant license Generally does not consume a host M365 license for basic collaboration; consumption-based services still bill the host

User type attribute Member Guest
Guest Access Restrictions

External Collaboration Policy in Entra ID controls who can invite guests and which domains are allowed/blocked. Tenant restrictions and B2B allow/block lists let you whitelist or deny invitations by domain (e.g., allow partner.com , block gmail.com ). At the group level, M365 Group guest access is a separate toggle per group classification.

B2B Direct Connect (Teams Shared Channels)

B2B direct connect is a different trust model: no invitation, no guest object in the host. Two Entra tenants establish a cross-tenant access policy that trusts each other's users for Teams shared channels only. The visiting user stays in their home tenant for authentication and appears in Teams via the shared channel — no #EXT# UPN, no redemption step. This is the mechanism that powers Teams Connect shared channels and is configured under Entra ID → External Identities → Cross-tenant access settings.

Managing Profile Properties, Sign-In Blocks, and License Reassignment

Profile properties (job title, department, manager, contact info) are edited from the user's flyout in either admin center or via Microsoft Graph ( PATCH /users/{id} ). Manager is a navigation property — setting it surfaces org chart data in Delve and Teams.

Block sign-in is a one-click toggle under the user's account. It invalidates existing refresh tokens and stops new sign-ins while preserving the mailbox and group memberships — the recommended first step for offboarding.

Reassigning licenses : Remove a license from one user and assign it to another in a single operation from Licenses → Bulk assign/unassign. Usage location on the destination user must already be set; otherwise the assignment silently fails.

Sign-in logs (Entra admin center → Monitoring → Sign-in logs) show the conditional access policies evaluated, the authentication method used, and the client app — essential when a user reports 'I can't sign in.'