Licenses, external guests, and self-service password reset

Sarrazin Clinic brings in a part-time cardiologist two days a week without creating a permanent account, and assigns a Microsoft 365 license to every resident on staff. The medical secretary, handling both tasks, hit an unclear error trying to assign a license to a newly created resident account, then discovered the account had no usage location set.

A license that refuses to attach

A Microsoft Entra account must carry a usageLocation property (the country tied to the work location) before a license can be assigned to it. It is a silent prerequisite: the license command fails without the error message always spelling out the cause.

The point that trips up a rushed candidate most often: Set-MgUserLicense belongs to the Microsoft.Graph.Users.Actions module, not the Az.Resources module that manages the rest of Azure's resources. The connection happens through Connect-Graph -Scopes User.ReadWrite.All, Organization.Read.All, a separate session from Connect-AzAccount.

Inviting an outside practitioner without a permanent account

For the part-time cardiologist, a permanent account would be overkill. New-MgInvitation sends an invitation that creates a Guest account in the directory, with no local password to manage: New-MgInvitation -InvitedUserEmailAddress "doctor@outside-practice.fr" -InviteRedirectUrl "https://myapplications.microsoft.com" -SendInvitationMessage:$true. The -InvitedUserType parameter defaults to Guest; setting it to Member would create a full internal-privilege account, rarely what a part-time practitioner needs.

The forgotten password on a Monday morning

Self-service password reset (SSPR) has neither an az command nor a dedicated PowerShell cmdlet: it is configured entirely in the Microsoft Entra admin center, under authentication methods policies. That is where the number of registration methods required, the allowed methods (phone, authenticator app, security questions), registration enforcement for a group of users, and for a hybrid setup, password writeback to the on-premises directory through Microsoft Entra Connect Cloud Sync, all get set.

A candidate looking for a command to "enable SSPR" is looking for something that does not exist in the command-line tooling; it is a portal setting, full stop.

What to check before closing this chapter:

• usageLocation is set before any license assignment attempt;
• Set-MgUserLicense comes from the Graph module, a Connect-Graph session separate from Connect-AzAccount;
• an external invitation creates a Guest account by default, never a Member account without explicitly asking for it;
• SSPR is set from the portal, no command configures it.

The next lesson leaves the account itself behind to focus on what it is allowed to do once signed in: built-in roles and the scope of an assignment.

*Checked on September 27, 2026 against the Microsoft Learn documentation (Microsoft.Graph.Users.Actions module, Microsoft.Graph.Identity.SignIns module, Microsoft Entra admin center) and the AZ-104 study guide, skills outline effective April 17, 2026.*