How to Bulk Import Users into Microsoft 365 with PowerShell and CSV

First, install the Microsoft Graph PowerShell SDK, which replaced the deprecated MSOnline and AzureAD modules. Open PowerShell 7+ as administrator and run the installation command.

Install-Module Microsoft.Graph -Force -AllowClobber -Scope CurrentUser
Import-Module Microsoft.Graph.Users

The installation downloads the latest version (2.21.1 as of March 2026) with enhanced bulk operation support and improved throttling handling.

Get-Module Microsoft.Graph -ListAvailable | Select-Object Name, Version

You should see version 2.21.1 or later listed.

Create a properly formatted CSV file with UTF-8 encoding. The file must include specific headers that match Microsoft Graph user parameters. Save this as users.csv:

UserPrincipalName,DisplayName,MailNickname,GivenName,Surname,PasswordProfile,UsageLocation,City,Department
user1@contoso.com,"John Smith","jsmith","John","Smith","TempPass123!","US","Seattle","IT"
user2@contoso.com,"Jane Doe","jdoe","Jane","Doe","TempPass123!","US","New York","HR"
user3@contoso.com,"Mike Johnson","mjohnson","Mike","Johnson","TempPass123!","US","Chicago","Finance"

Required columns include UserPrincipalName, DisplayName, MailNickname, and PasswordProfile. Optional fields like UsageLocation are crucial for license assignment later.

Establish a connection to Microsoft Graph with the necessary permissions for user management. Run this command and complete the interactive authentication:

Connect-MgGraph -Scopes "User.ReadWrite.All"

This opens a browser window for authentication. Sign in with your Global Administrator or User Administrator account. The User.ReadWrite.All scope grants permission to create and modify users.

For automated scripts without interactive authentication, use certificate-based authentication:

# For automation (requires app registration)
Connect-MgGraph -ClientId "your-app-id" -TenantId "your-tenant-id" -CertificateThumbprint "your-cert-thumbprint"

Get-MgContext | Select-Object Scopes, Account, TenantId

Load the CSV file and validate that all required fields are present. This step prevents errors during the bulk import process:

# Load CSV data
$userData = Import-Csv -Path "C:\temp\users.csv" -Encoding UTF8

# Validate required fields
$requiredFields = @('UserPrincipalName', 'DisplayName', 'MailNickname', 'PasswordProfile')
foreach ($field in $requiredFields) {
    if ($field -notin ($userData[0].PSObject.Properties.Name)) {
        Write-Error "Missing required field: $field"
        exit 1
    }
}

Write-Host "Loaded $($userData.Count) users for import" -ForegroundColor Green

Next, check for existing users to prevent conflicts:

# Check for existing users
$conflicts = @()
foreach ($user in $userData) {
    try {
        $existingUser = Get-MgUser -Filter "userPrincipalName eq '$($user.UserPrincipalName)'" -ErrorAction SilentlyContinue
        if ($existingUser) {
            $conflicts += $user.UserPrincipalName
        }
    } catch {
        # User doesn't exist, continue
    }
}

if ($conflicts.Count -gt 0) {
    Write-Warning "Found $($conflicts.Count) existing users: $($conflicts -join ', ')"
}

Run the bulk import process with comprehensive error handling and progress tracking. This script creates users one by one with detailed logging:

# Initialize tracking variables
$results = @()
$successCount = 0
$errorCount = 0

# Process each user
foreach ($user in $userData) {
    try {
        # Prepare password profile
        $passwordProfile = @{
            Password = $user.PasswordProfile
            ForceChangePasswordNextSignIn = $true
        }
        
        # Prepare user parameters
        $userParams = @{
            DisplayName = $user.DisplayName
            UserPrincipalName = $user.UserPrincipalName
            MailNickname = $user.MailNickname
            GivenName = $user.GivenName
            Surname = $user.Surname
            UsageLocation = $user.UsageLocation
            City = $user.City
            Department = $user.Department
            PasswordProfile = $passwordProfile
            AccountEnabled = $true
        }
        
        # Create the user
        $newUser = New-MgUser @userParams
        
        # Log success
        $results += [PSCustomObject]@{
            UPN = $user.UserPrincipalName
            Status = "Success"
            Id = $newUser.Id
            Error = ""
        }
        $successCount++
        Write-Host "✓ Created: $($user.DisplayName)" -ForegroundColor Green
        
        # Throttling delay to avoid API limits
        Start-Sleep -Seconds 2
        
    } catch {
        # Log failure
        $results += [PSCustomObject]@{
            UPN = $user.UserPrincipalName
            Status = "Failed"
            Id = ""
            Error = $_.Exception.Message
        }
        $errorCount++
        Write-Host "✗ Failed: $($user.UserPrincipalName) - $($_.Exception.Message)" -ForegroundColor Red
    }
}

# Export results
$results | Export-Csv -Path "C:\temp\import_results.csv" -NoTypeInformation
Write-Host "\nImport Summary: Success: $successCount | Failed: $errorCount" -ForegroundColor Cyan

After creating users, assign licenses to enable Microsoft 365 services. First, identify available license SKUs in your tenant:

# Get available licenses
$availableLicenses = Get-MgSubscribedSku | Select-Object SkuPartNumber, SkuId, ConsumedUnits, PrepaidUnits
$availableLicenses | Format-Table

# Get Microsoft 365 E3 license (example)
$e3Sku = (Get-MgSubscribedSku | Where-Object SkuPartNumber -eq "ENTERPRISEPACK").SkuId

Now assign licenses to successfully created users:

# Assign licenses to successful users
$successfulUsers = $results | Where-Object Status -eq "Success"
$licenseSuccessCount = 0
$licenseErrorCount = 0

foreach ($user in $successfulUsers) {
    try {
        # Assign license
        Set-MgUserLicense -UserId $user.Id -AddLicenses @(@{SkuId = $e3Sku}) -RemoveLicenses @()
        
        Write-Host "✓ Licensed: $($user.UPN)" -ForegroundColor Green
        $licenseSuccessCount++
        
        # Small delay to avoid throttling
        Start-Sleep -Seconds 1
        
    } catch {
        Write-Host "✗ License failed: $($user.UPN) - $($_.Exception.Message)" -ForegroundColor Red
        $licenseErrorCount++
    }
}

Write-Host "\nLicense Summary: Success: $licenseSuccessCount | Failed: $licenseErrorCount" -ForegroundColor Cyan

Get-MgUser -UserId "user@contoso.com" | Select-Object DisplayName, AssignedLicenses

Perform final verification of the import process and clean up the PowerShell session. First, verify a sample of created users:

# Verify random sample of created users
$sampleUsers = $results | Where-Object Status -eq "Success" | Get-Random -Count 3

foreach ($user in $sampleUsers) {
    $verifyUser = Get-MgUser -UserId $user.Id | Select-Object DisplayName, UserPrincipalName, AccountEnabled, AssignedLicenses
    Write-Host "Verified: $($verifyUser.DisplayName) - Enabled: $($verifyUser.AccountEnabled)" -ForegroundColor Green
}

Generate a comprehensive summary report:

# Generate final report
$report = @{
    TotalProcessed = $userData.Count
    SuccessfulCreations = $successCount
    FailedCreations = $errorCount
    SuccessfulLicensing = $licenseSuccessCount
    FailedLicensing = $licenseErrorCount
    Timestamp = Get-Date
}

$report | ConvertTo-Json | Out-File "C:\temp\import_summary.json"
Write-Host "\n=== FINAL IMPORT SUMMARY ===" -ForegroundColor Yellow
$report | Format-List

Clean up the PowerShell session:

# Disconnect from Microsoft Graph
Disconnect-MgGraph
Write-Host "Disconnected from Microsoft Graph" -ForegroundColor Green