Microsoft 365 User Management

Overview

Users in Microsoft 365 (Entra ID) are the central identity object for your tenant. Every licensed service — Exchange, Teams, OneDrive, SharePoint — flows through the user object. For MSPs, user management spans onboarding new staff, offboarding leavers, license optimization, and security posture checks across customer tenants.

User Object Key Properties

Account Status Values

License Assignment Model

M365 licenses are assigned as SKU objects. Users need a usageLocation set before any license can be assigned.

Common MSP License SKUs

Graph API Patterns

List All Users

GET /v1.0/users?$select=id,displayName,userPrincipalName,accountEnabled,assignedLicenses,signInActivity&$top=100

Note: signInActivity requires Entra ID P1 or P2.

Get a Specific User

GET /v1.0/users/{id or userPrincipalName}?$select=id,displayName,userPrincipalName,accountEnabled,jobTitle,department,assignedLicenses,usageLocation

Search Users by Name

GET /v1.0/users?$filter=startswith(displayName,'John')&$select=id,displayName,userPrincipalName,accountEnabled

Disable a User Account

PATCH /v1.0/users/{id}
Content-Type: application/json

{
  "accountEnabled": false
}

Create a New User

POST /v1.0/users
Content-Type: application/json

{
  "accountEnabled": true,
  "displayName": "Jane Smith",
  "mailNickname": "jsmith",
  "userPrincipalName": "[email protected]",
  "usageLocation": "US",
  "passwordProfile": {
    "forceChangePasswordNextSignIn": true,
    "password": "TempP@ss123!"
  }
}

Assign a License

POST /v1.0/users/{id}/assignLicense
Content-Type: application/json

{
  "addLicenses": [
    { "skuId": "<sku-guid>", "disabledPlans": [] }
  ],
  "removeLicenses": []
}

Get User's Group Memberships

GET /v1.0/users/{id}/memberOf?$select=id,displayName,groupTypes

Revoke All Sign-In Sessions

POST /v1.0/users/{id}/revokeSignInSessions

MFA Status Checking

The Softeria MCP server wraps Graph API calls. To check MFA status:

GET /v1.0/users/{id}/authentication/methods

Response includes registered methods:

• #microsoft.graph.microsoftAuthenticatorAuthenticationMethod — Authenticator app
• #microsoft.graph.phoneAuthenticationMethod — SMS/phone
• #microsoft.graph.fido2AuthenticationMethod — Hardware key
• #microsoft.graph.windowsHelloForBusinessAuthenticationMethod — WHfB
• #microsoft.graph.passwordAuthenticationMethod — Password only (no MFA!)

Users with only `passwordAuthenticationMethod` have NO MFA enrolled.

Common MSP Workflows

New User Onboarding

1. Create user with temp password (forceChangePasswordNextSignIn: true)
2. Set usageLocation
3. Assign license SKU
4. Add to required security groups
5. Create mailbox (auto-provisioned on Exchange license)
6. Communicate credentials to manager

User Offboarding

1. Revoke all sign-in sessions immediately
2. Disable account (accountEnabled: false)
3. Reset password (removes existing sessions)
4. Remove licenses (preserves data, frees seat)
5. Convert mailbox to shared or set auto-forward
6. Remove from Teams/groups
7. Transfer OneDrive ownership to manager
8. Schedule hard delete after data retention period

Inactive User Detection

Users with no sign-in for 90+ days are candidates for license reclamation:

GET /v1.0/users?$filter=accountEnabled eq true&$select=id,displayName,userPrincipalName,signInActivity&$top=999

Filter results where signInActivity.lastSignInDateTime is older than 90 days, or null (never logged in).

Error Handling

Permissions Required

Related Skills

• M365 Mailboxes - Exchange mailbox management
• M365 Licensing - License inventory and optimization
• M365 Security - MFA, sign-in risk, conditional access
• M365 API Patterns - Auth, pagination, throttling