Users

Interact with Microsoft 365 users.

The Users page lists the users in the selected tenant and is the starting point for day to day account management. It covers the same ground as Microsoft 365 admin center > Active Users, and extends it with actions that would otherwise need the Microsoft Entra admin center, Exchange Online PowerShell or the SharePoint admin center.

Action Buttons

Add User

Creates a single user in the selected tenant. Create User submits the form, and once a user has been created the button changes to Create Another User so the drawer can be reused.

A user can only be created in one tenant at a time. With All Tenants selected, Create User is greyed out and a warning explains that a specific tenant must be chosen from the tenant selector first.

Starting point

Field	Description
Copy properties from another user	Pre-fills the form from an existing user's name, job, address and contact details. Licences and group memberships are not copied by this selector.
User Template (optional)	Applies a saved user template, filling in the properties, licences, groups and shared access it defines. Templates are managed on the User Templates page.

Identity

Field	Description
First Name	The user's given name.
Last Name	The user's surname.
Display Name	The name shown throughout Microsoft 365. Built from the first and last name until it is edited manually.
Username	The part before the @ symbol. Limited to 64 characters, and may contain letters, numbers and the characters ' . - _ ! # ^ ~.
Primary Domain name	The domain used after the @ symbol, chosen from the tenant's verified domains.
Add Aliases	Additional addresses, one per line, entered without the domain.

If the username and Primary Domain name together match an existing account's user principal name or one of its email aliases, a warning appears below the domain selector naming that account. It does not block creation, and it is checked against the user list already loaded for the tenant, so a match can go unreported. No warning is not confirmation that the address is free.

Settings

Setting	Description
Create password manually	When off, CIPP generates a password and returns it in the result. When on, a Password field appears for a password of your own.
Require password change at next logon	Forces the user to set a new password the first time they sign in.
Enforce Per-User MFA	When enabled, sets the per-user MFA state to Enforced after the account is created. This is for tenants without Conditional Access; do not combine with CA-based MFA policies.
Usage Location	The country the account is licensed in. Required before licences can be assigned, and defaults to the usage location set in your preferences.
Licenses	The licences to assign. Each option shows how many units are currently available.
Remove all licenses	Strips every licence from the account, which is mainly useful when a template or a copied user has brought licences in that are not wanted.

When the Sherweb integration is enabled and a selected licence shows (0 available), a Purchase new licence? switch appears along with a Sherweb License selector. Choosing this purchases a new licence under your terms with Sherweb and assigns it to the user once it becomes available.

Contact and organisation

Field	Description
Job Title, Department, Company Name	Organisational details written to the directory and shown in the address list.
Street, City, State/Province, Postal Code, Country	The user's postal address.
Mobile #, Business #	Contact numbers.
Alternate Email Addresses	Secondary addresses, separated by commas.
Set Manager	The user recorded as this account's manager.
Set Sponsor	The user recorded as this account's sponsor. Only shown when sponsor has been added to the attribute list in your preferences.
Copy groups from user	Adds the new account to the same groups as the chosen user.
Add to Groups	Adds the new account to specific groups chosen from the tenant.

Extra directory attributes can be added to this form under User Preferences. The list offers consentProvidedForMinor, employeeId, employeeHireDate, employeeLeaveDateTime, employeeType, faxNumber, legalAgeGroupClassification, officeLocation, otherMails, showInAddressList and sponsor, and each selection adds its own field to the form. Every attribute except sponsor appears as a plain text field; sponsor appears as the Set Sponsor user selector.

Shared mailboxes, calendars and sites

Field	Description
Shared Mailboxes	The shared mailboxes the new user should be given access to. Only shared mailboxes in the tenant can be selected.
Shared Mailbox Permissions	Any combination of Full Access, Full Access (no Automapping), Send As and Send on Behalf. Defaults to Full Access, which also automaps the mailbox so Outlook adds it on its own; the no-automapping variant grants the same access but leaves adding the mailbox to the user.
Shared Calendars	The shared mailboxes whose calendar the user should be given access to.
Shared Calendar Permission	The access level granted on those calendars: Editor, Reviewer, Limited Details or Availability Only. Defaults to Editor.
SharePoint Sites	The SharePoint sites the new user should be added to. Several can be selected.
SharePoint Site Role	The access the user is given on those sites: Members, Owners or Visitors. Defaults to Members.

Exchange cannot add a calendar to someone's Outlook directly, so CIPP grants calendar access with a sharing invitation, which the user accepts by clicking the link in the email they receive. Mailbox access needs no invitation: with Full Access, automapping adds the mailbox to Outlook by itself, unless the no-automapping variant was chosen. Only the permission levels listed above are offered for calendars, as those are the ones Exchange sends an invitation for.

A newly created user is not a usable Exchange recipient for the first few minutes, and takes a similar time to reach SharePoint, so the mailbox, calendar and site grants are all queued as scheduled tasks that run 15 minutes after creation. Their progress, and any failure, can be followed on the Schedulerpage.

Scheduling and notifications

Setting	Description
Schedule user creation	Defers creation to a chosen date instead of running it immediately.
Scheduled creation Date	The date the creation task should run.
Send results to Webhook / E-mail / PSA	Delivers the outcome of the scheduled task to the notification channels configured for the tenant.
Push notification to my devices	Sends the outcome as a push notification to the devices you registered under User Preferences. Only you receive it, and it needs at least one device registered there.
HaloPSA Ticket	An existing HaloPSA ticket to add the results to as a note, instead of raising a new ticket. Only shown once Send results to PSA is on and the HaloPSA integration is enabled.
Reference	Free text added to the notification title so the task can be recognised later.

Bulk Add Users

Creates several users at once from a CSV file or from rows entered by hand.

Set the Usage Location and any licences under Assign License first, as these apply to every user in the batch. Download Example CSV produces a file with the expected column headers: givenName, surName, displayName, mailNickName, domain, JobTitle, streetAddress, PostalCode, City, State, Department, MobilePhone and businessPhones, plus any extra attributes added in your preferences. Upload the completed file, or use Add User Manually to add rows individually.

Every row appears in the User Preview table, where it can be checked and removed before submitting. Create Users submits the batch.

As with a single user, the whole batch goes to one tenant. With All Tenants selected, Create Users is greyed out and a warning explains that a specific tenant must be chosen from the tenant selector first.

Invite Guest

Invites a single external user as a guest in the tenant.

Field	Description
Display Name	The name the guest appears under in the directory.
E-mail Address	The address the invitation is sent to and the account is based on.
Redirect URL	Where the guest lands after redeeming the invitation. Defaults to https://myapps.microsoft.com when left blank.
Custom invite message	Optional text included in the invitation email.
Send invite via e-mail	Controls whether Microsoft sends the standard guest invitation email. When off, the guest account is created but no email goes out.

Bulk Invite Guests

Invites several guests at once.

Send invite via e-mail and Custom invite message apply to the whole batch. Download Example CSV produces a file with the columns displayName, mail and redirectUri. Upload the completed file, or use Add Guest Manually to add rows individually. Rows appear in the Guest Preview table for checking before the invitations are sent.

View Logs

Opens a flyout showing the CIPP log entries recorded for user actions in this tenant. Entries written by scheduled tasks are excluded, so this shows the actions taken from the interface.

Filters

Filter	Shows
Account Enabled	Accounts that are able to sign in.
Account Disabled	Accounts that have been blocked from signing in.
Guest Accounts	Accounts with a user type of Guest.

Table Details

The properties returned are for the Graph resource type user. For more information on the properties please see the Graph documentation.

Table Actions

Bulk Action Available

Action	Description	Bulk Action Available
View User	Opens the View Individual User page for the selected user.
Edit User	Opens the Edit User page, where properties, licences and group memberships can be changed.
View in Entra	Opens the user in the Microsoft Entra admin center in a new tab.
Create Template from User	Creates a reusable user template from this account, copying its job title, department, location, licences and group memberships. Prompts for a template name and whether the template becomes the default for the tenant.
BEC Remediation	Queues a Business Email Compromise investigation for each selected user. Each run is kept as a case and appears on the Business Email Compromise page as it finishes. Greyed out for guest accounts.
Create Temporary Access Pass	Issues a time limited passcode the user can sign in with, typically to enrol a passwordless method. The lifetime is validated against the tenant's policy, one-time use can be requested, and the pass can be set to become valid at a future date and time. Generate PwPush link returns a single-use Password Pusher link in place of the pass, so it can be handed to the user securely. It needs the Password Pusher integration to be enabled, and the plain pass is returned instead if no link can be created.
Re-require MFA registration	Clears the user's registered multi-factor methods so they must register again.
Send MFA Push	Opens a dialog showing the user's registered MFA methods and sends a push notification to Microsoft Authenticator on confirm. If Authenticator push is not registered but a code-based method is, asks for a typed OTP code to verify instead. Confirm is disabled if neither is registered.
Set Per-User MFA	Sets the legacy per-user MFA state to Enforced, Enabled or Disabled, independently of any Conditional Access policy.
Convert Mailbox	Converts the mailbox to a User, Shared, Room or Equipment mailbox, keeping its existing content. Picking Shared warns when the mailbox or its archive is over 50 GB, or it is on litigation hold, as it then needs to keep a licence.
Enable Online Archive	Turns on the archive mailbox so older mail can be moved out of the primary mailbox.
Set Out of Office	Sets automatic replies to Enabled, Disabled or Scheduled, with separate internal and external messages. When scheduled, the period can also block the user's calendar, decline new invitations, and decline and cancel meetings already booked. Selecting a single user pre-fills the form with their current settings; with several selected, it starts blank.
Add to Group	Adds the user to one or more groups in the tenant.
Manage Licenses	Adds, removes or replaces licences on the account, with the option to remove or replace everything currently assigned.
Disable Email Forwarding	Clears any forwarding set on the mailbox, both internal and external.
Pre-provision OneDrive	Creates the user's OneDrive ahead of their first sign-in, so it is ready when they need it.
Set OneDrive External Sharing	Sets how far the user's OneDrive can be shared outside the organisation: no external sharing, signed-in guests only, anyone links, or existing guests only.
Add OneDrive Shortcut	Adds a shortcut to a chosen SharePoint site into the user's OneDrive, either at the OneDrive root or inside the Shortcuts folder used by Microsoft's own OneDrive and SharePoint interfaces. An optional shortcut name replaces the default library or site name, and with several users selected the same site, location and name apply to all of them. Every user is attempted, and any that fail, for example because the shortcut already exists, are listed in the results alongside a count of how many succeeded.
Migrate OneDrive Shortcuts	Moves every shortcut currently sitting in the user's OneDrive root into the Shortcuts folder.
Set Sign In State	Blocks or restores the account's ability to sign in. The current state is pre-selected, and submitting an unchanged state is rejected.
Reset Password	Sets a new random password and returns it in the result, optionally requiring a change at the next sign-in.
Require Password Change at Next Logon	Requires the user to change their password at next sign-in without resetting it. Not supported for directory-synced accounts.
Set Password Expiration	Enables or disables password expiry for the account. With expiry enabled, a password older than the organisation's expiry period prompts the user to change it at their next sign-in.
Clear On-Premises Attributes	Clears the on-premises attributes left behind after a tenant moves from directory sync to cloud-only: immutable ID, distinguished name, domain name, SAM account name, security identifier, on-premises UPN and object identifier. The dialog opens with all of them selected; untick any to keep. Greyed out unless the account is no longer synchronised and still carries at least one of these values. The previous values are recorded in the log entry so they can be restored if needed.
Set Source of Authority	Switches the account between Cloud Managed and On-Premises Managed. A move back to on-premises takes until the next sync cycle to appear. Greyed out for cloud-native accounts that have never been synchronised.
Reprocess License Assignments	Asks Entra to re-evaluate the group-based licences that apply to the user, adding or removing licences as the group membership dictates.
Revoke all user sessions	Invalidates the account's refresh tokens so every device has to sign in again.
Delete User	Deletes the account. Deleted accounts remain recoverable from Deleted Items for 30 days.
Edit Properties	Opens the patch-wizard.md with the selected users loaded, for changing the same properties across all of them.
More Info	Opens the Extended Info flyout with the full details for the selected row.

Most of these actions present a confirmation dialog before anything is sent, and any options the action needs are set in that dialog.

Actions you do not have permission for stay in the menu but are greyed out. Convert Mailbox, Enable Online Archive, Set Out of Office and Disable Email Forwarding need Exchange mailbox write access, Add to Group needs group write access, and most of the rest need user write access. Send MFA Push, BEC Remediation and Set Source of Authority carry no permission condition of their own.

Temporary Access Pass must be enabled in the tenant's authentication method policy before a pass can be created, otherwise the action fails. CIPP checks the policy when the dialog opens and warns you if it is not enabled. See Configure Temporary Access Pass to register passwordless authentication methods for the tenant side of the configuration.

The standalone Add User page at /identity/administration/users/add, reached by URL only, and its support for pre-filling the form from URL query string parameters (including the AutoTask LiveLink pattern this page used to document) have been removed. User creation from the Users page now opens the Add User drawer described above, which does not read query string parameters. A PSA or documentation system linking to that URL to launch a pre-filled user creation will need a different integration approach.

---

Feature Requests / Ideas

We value your feedback and ideas. Please raise any feature requests on GitHub.