Users & licences · Microsoft 365

Create a Microsoft 365 user and assign a licence

Written November 12, 2026

A new starter needs two things before their first morning: an account they can sign in with, and a licence on it. The account alone is not enough — without a licence there is no working mailbox and no desktop apps, and an unlicensed mailbox is disabled after a 30-day grace period. This runbook creates both, in the admin centre first and then in Microsoft Graph PowerShell.

What you need

• An admin account with the right role. A User Administrator can create users; assigning licences also needs the Licence Administrator role. A Global Administrator can do both, but use the narrower role when you have it.
• A spare licence of the plan you intend to assign. Check under Billing > Licences in the admin centre. You can still create the user if none are spare, but their mailbox will sit in its grace period until one is assigned.
• The person's name, the username you will give them, and their usage location. The username becomes the sign-in ID and the start of the email address, so settle its spelling now — changing it later is possible but messy. The usage location (the country where they will use the services) is not optional detail: a licence cannot be assigned to a user who has none set.

Route 1: the admin centre

1. Open the user form. Sign in to the Microsoft 365 admin centre and go to Users > Active users, then select Add a user.
2. Set up the basics. Enter the first and last name, and check the display name it builds. Fill in the username and pick the right domain after the @ if your tenant has more than one.
3. Decide the password handling. Let the wizard generate a password, or set one yourself. Leave Require this user to change their password when they first sign in turned on, and choose how the password reaches the person — never in the same message as the username if you can avoid it.
4. Assign the licence. On the Assign product licenses page, select the user's location first, then the licence. Expand the licence if you need to switch off individual apps — turning off a service here is how you give someone mail and Office apps without, say, Teams.
5. Leave the optional settings alone unless you mean it. The role defaults to plain User, which is right for almost everyone. Skip the profile information fields; the user can fill them in later.
6. Review and finish. Check the summary page — username spelling above all — and select Finish adding. The user appears in Active users within moments, and mailbox provisioning starts once the licence lands.

Route 2: Microsoft Graph PowerShell

The same job from a prompt, using the Microsoft Graph PowerShell SDK. Install the module once with Install-Module Microsoft.Graph -Scope CurrentUser, then connect with the scopes the job needs:

Connect-MgGraph -Scopes "User.ReadWrite.All", "Organization.Read.All"

$PasswordProfile = @{
    Password                      = "Set-a-real-one-4821"
    ForceChangePasswordNextSignIn = $true
}

New-MgUser -DisplayName "Priya Nair" `
    -UserPrincipalName "[email protected]" `
    -MailNickname "priya" `
    -UsageLocation "CA" `
    -AccountEnabled `
    -PasswordProfile $PasswordProfile

Note the -UsageLocation in the create call — setting it now is what makes the licence assignment below work first time. Next, find the SKU of the plan you own and put it on the user. Get-MgSubscribedSku lists every plan in the tenant with how many licences are purchased and consumed:

$Sku = Get-MgSubscribedSku -All |
    Where-Object SkuPartNumber -eq "SPB"

Set-MgUserLicense -UserId "[email protected]" `
    -AddLicenses @(@{ SkuId = $Sku.SkuId }) `
    -RemoveLicenses @()

Replace SPB with the part number of the plan you actually assign — the SkuPartNumber column of your own Get-MgSubscribedSku output is the list to pick from. To confirm the licence took, run Get-MgUserLicenseDetail -UserId "[email protected]".

End state

• The user is listed in Users > Active users with the correct name and username.
• Opening the user shows the licence you assigned, with the apps you expect switched on.
• The person can sign in at office.com with the temporary password and is immediately asked to set their own.
• Within a short while, Outlook on the web opens for them — a mailbox that errors here usually means the licence step, not the user step, went wrong.

When it goes wrong

• "License cannot be assigned" errors in PowerShell. Almost always a missing usage location. Set one with Update-MgUser -UserId "[email protected]" -UsageLocation "CA" and assign again.
• The licence page shows nothing to assign. The tenant has no spare licences of that plan. Buy or free one first; the user you already created will wait, but their mailbox grace period is ticking.
• The username is already taken. Check Deleted users as well as Active users — a recently deleted account holds its username until it is permanently removed or restored.
• The new user can sign in but has no mailbox hours later. Confirm the licence really includes Exchange Online and is not toggled off under the licence's app list.