Creating and managing Microsoft Entra users and groups

Dujardin Glassworks hires in waves, fifteen extra people every September to cover the year-end production rush. Until recently, the IT team created every account by hand in the Azure portal, copying the same template from a three-year-old Word document. Two accounts ended up with a misspelled display name, a third one had no usage location set, which blocked license assignment for a full week.

Creating an account, portal or command line

A Microsoft Entra account can be created from the portal or from the command line, but the command line skips retyping and replays identically for each hiring wave.

The --user-principal-name parameter expects a full value, something like first.last@dujardinglass.onmicrosoft.com, never a plain local identifier. That is usually where the typo that breaks a looped provisioning script sneaks in.

Groups instead of standalone accounts

Assigning a role or a license user by user works while headcount stays small. Once Dujardin Glassworks passes a dozen accounts per department, the right move is to create a group and assign rights and licenses to it once.

az ad group create --display-name "Production-Season" --mail-nickname "ProductionSeason" creates the group; az ad group member add --group Production-Season --member-id <object-id> adds each new hire to it. In PowerShell, New-AzADGroup -DisplayName "Production-Season" -MailNickname "ProductionSeason" -SecurityEnabled does the same thing. One point deserves attention: --member-id expects the member's object ID, never their display name or email address, and a badly copied value fails silently on the next run if the script ignores the return code.

What to remember from this lesson:

• an account is created and updated the same way in the portal and on the command line, but only the command replays without a retyping mistake;
• --user-principal-name expects a full value, never a plain identifier;
• groups replace repeated assignment once a department passes a handful of accounts;
• --member-id takes an object ID, not a display name.

The next lesson covers what happens once the account exists: license, external guest, a forgotten password on a Monday morning.

*Checked on September 27, 2026 against the Microsoft Learn command reference (az ad, az role, az policy, az lock, az tag, az group, az account management-group, az consumption budget, and the Az and Microsoft.Graph PowerShell modules) and the AZ-104 study guide, skills outline effective April 17, 2026.*