Microsoft 365 Users

Microsoft 365 User Management

Overview

Users in Microsoft 365 (Entra ID) are the central identity object for your tenant. Every licensed service — Exchange, Teams, OneDrive, SharePoint — flows through the user object. For MSPs, user management spans onboarding new staff, offboarding leavers, license optimization, and security posture checks across customer tenants.

Anti-triggers

• Counting, listing, or auditing users without changing them — a read-only question is cheaper and safer through the vetted query catalogue; use the microsoft-graph plugin's microsoft-graph-querying skill.
• Offboarding as one packaged action, or any user work across more than one tenant — the multi-step sequence below is a CIPP primitive with its own audit record; use the cipp plugin (cipp-users).
• "User" meaning a PSA contact or an MSP technician — an Entra user is neither. The customer's billing/ticket contact lives in the PSA (connectwise, halopsa, kaseya/autotask); the technician being scored on a CSAT survey is a crewhu user.

User Object Key Properties

Account Status Values

License Assignment Model

M365 licenses are assigned as SKU objects. Users need a usageLocation set before any license can be assigned.

Common MSP License SKUs

Graph API Patterns

List All Users

GET /v1.0/users?$select=id,displayName,userPrincipalName,accountEnabled,assignedLicenses,signInActivity&$top=100

Note: signInActivity requires Entra ID P1 or P2.

Get a Specific User

GET /v1.0/users/{id or userPrincipalName}?$select=id,displayName,userPrincipalName,accountEnabled,jobTitle,department,assignedLicenses,usageLocation

Search Users by Name

GET /v1.0/users?$filter=startswith(displayName,'John')&$select=id,displayName,userPrincipalName,accountEnabled

Disable a User Account

PATCH /v1.0/users/{id}
Content-Type: application/json

{
  "accountEnabled": false
}

Create a New User

POST /v1.0/users
Content-Type: application/json

{
  "accountEnabled": true,
  "displayName": "Jane Smith",
  "mailNickname": "jsmith",
  "userPrincipalName": "jsmith@contoso.com",
  "usageLocation": "US",
  "passwordProfile": {
    "forceChangePasswordNextSignIn": true,
    "password": "TempP@ss123!"
  }
}

Assign a License

POST /v1.0/users/{id}/assignLicense
Content-Type: application/json

{
  "addLicenses": [
    { "skuId": "<sku-guid>", "disabledPlans": [] }
  ],
  "removeLicenses": []
}

Get User's Group Memberships

GET /v1.0/users/{id}/memberOf?$select=id,displayName,groupTypes

Revoke All Sign-In Sessions

POST /v1.0/users/{id}/revokeSignInSessions

MFA Status Checking

The Softeria MCP server wraps Graph API calls. To check MFA status:

GET /v1.0/users/{id}/authentication/methods

Response includes registered methods:

• #microsoft.graph.microsoftAuthenticatorAuthenticationMethod — Authenticator app
• #microsoft.graph.phoneAuthenticationMethod — SMS/phone
• #microsoft.graph.fido2AuthenticationMethod — Hardware key
• #microsoft.graph.windowsHelloForBusinessAuthenticationMethod — WHfB
• #microsoft.graph.passwordAuthenticationMethod — Password only (no MFA!)

Users with only passwordAuthenticationMethod have NO MFA enrolled.

Common MSP Workflows

New User Onboarding

1. Create user with temp password (forceChangePasswordNextSignIn: true)
2. Set usageLocation
3. Assign license SKU
4. Add to required security groups
5. Create mailbox (auto-provisioned on Exchange license)
6. Communicate credentials to manager

User Offboarding

1. Revoke all sign-in sessions immediately
2. Disable account (accountEnabled: false)
3. Reset password (removes existing sessions)
4. Remove licenses (preserves data, frees seat)
5. Convert mailbox to shared or set auto-forward
6. Remove from Teams/groups
7. Transfer OneDrive ownership to manager
8. Schedule hard delete after data retention period

Inactive User Detection

Users with no sign-in for 90+ days are candidates for license reclamation:

GET /v1.0/users?$filter=accountEnabled eq true&$select=id,displayName,userPrincipalName,signInActivity&$top=999

Filter results where signInActivity.lastSignInDateTime is older than 90 days, or null (never logged in).

Error Handling

Permissions Required

Related Skills

• M365 Mailboxes - Exchange mailbox management
• M365 Licensing - License inventory and optimization
• M365 Security - MFA, sign-in risk, conditional access
• M365 API Patterns - Auth, pagination, throttling