Bulk Create Active Directory Users and License Them in Microsoft 365 by Group

# Bulk Create Active Directory Users and License Them in Microsoft 365 by Group

**Watch the 2-minute video:**

Every semester at the college, a new batch of students arrives. Each one needs an Active Directory account and a Microsoft 365 license. Doing that by hand, one user at a time, takes a whole day and invites typos.

This is the method I use in real life. It turns that day into a few minutes:

1. One security group per semester.

2. A CSV file with the new students.

3. A PowerShell script that creates the users and adds them to the group.

4. A delta sync to Microsoft Entra ID.

5. One license assignment, to the group.

## How it fits together

“`

students.csv ──> Import-Students.ps1 ──> AD users in OU=Fall2026

└─> member of Students-Fall2026

│ (Entra Connect sync)

▼

Microsoft 365 admin center: license assigned to Students-Fall2026

│

▼

every member gets the license automatically

“`

## Step 1: Create one group per semester

Create an OU for the semester (for example `OU=Fall2026,OU=Students,DC=college,DC=local`) and a **security group** in it, like `Students-Fall2026`.

The group is the key. In step 5 you give the license to the group, not to people, and the licenses follow group membership. The script below also creates the group if it doesn’t exist yet.

Make sure the OU is in the **sync scope** of Entra Connect. Otherwise, the users and the group never reach the cloud.

## Step 2: Prepare the CSV

Three columns are enough:

“`csv

FirstName,LastName,StudentID

Abd Almouhimen,Shamout,s2026001

Abd,Shamout,s2026002

Mouhimen,Dev,s2026003

“`

If you get the list from Excel, use **File > Save As > CSV UTF-8**, so names with accents or Arabic letters stay correct.

## Step 3: Run the PowerShell script

Run it on a domain-joined server with the ActiveDirectory module (RSAT), as an account that can create users in the target OU.

```powershell
<#
  Import-Students.ps1
  Bulk-create new students in Active Directory and add them to the semester group.
  Microsoft 365 licenses then follow the group (group-based licensing).
  CSV columns: FirstName,LastName,StudentID
#>
param(
    [string]$CsvPath   = ".\students.csv",
    [string]$OU        = "OU=Fall2026,OU=Students,DC=college,DC=local",
    [string]$Group     = "Students-Fall2026",
    [string]$UpnSuffix = "college.edu",          # must be a verified domain in Microsoft 365
    [string]$OutFile   = ".\new-students-passwords.csv"
)

Import-Module ActiveDirectory

# One random temporary password per student (12 chars, mixed)
function New-TempPassword {
    $chars = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789!@#$%'
    -join (1..12 | ForEach-Object { $chars[(Get-Random -Maximum $chars.Length)] })
}

# Create the semester group once, if it doesn't exist yet
if (-not (Get-ADGroup -Filter "Name -eq '$Group'")) {
    New-ADGroup -Name $Group -GroupScope Global -GroupCategory Security `
        -Path $OU -Description "New students - licensed in Microsoft 365"
}

$results = foreach ($s in Import-Csv $CsvPath) {
    $sam = $s.StudentID.Trim()
    $upn = "$sam@$UpnSuffix"

    if (Get-ADUser -Filter "SamAccountName -eq '$sam'") {
        Write-Warning "$sam already exists - skipped"
        continue
    }

    $temp = New-TempPassword
    New-ADUser -Name "$($s.FirstName) $($s.LastName)" `
        -GivenName $s.FirstName -Surname $s.LastName -DisplayName "$($s.FirstName) $($s.LastName)" `
        -SamAccountName $sam -UserPrincipalName $upn -EmailAddress $upn `
        -Path $OU -AccountPassword (ConvertTo-SecureString $temp -AsPlainText -Force) `
        -ChangePasswordAtLogon $true -Enabled $true

    Add-ADGroupMember -Identity $Group -Members $sam
    Write-Host "Created $upn and added to $Group" -ForegroundColor Green

    [pscustomobject]@{ Name = "$($s.FirstName) $($s.LastName)"; UPN = $upn; TempPassword = $temp }
}

# Hand-out list for the IT office. Store it safely and delete it after use.
$results | Export-Csv $OutFile -NoTypeInformation
```

Run it like this:

```powershell
.\Import-Students.ps1 -CsvPath .\students.csv -Group "Students-Fall2026"
```

What it does for every row:

– **Skips** a student whose ID already exists, so it’s safe to run twice.

– Creates the user in the semester OU with a UPN on your Microsoft 365 domain.

– Sets a **random temporary password** and forces a change at first sign-in.

– Adds the user to the semester group.

– Saves a hand-out list of temporary passwords. Treat that file as sensitive and delete it once the passwords are handed out.

> **Tip:** test with a CSV of two rows first, and add `-WhatIf` to `New-ADUser` and `Add-ADGroupMember` for a dry run.

## Step 4: Sync to the cloud

Your users live on premises, so they must reach **Microsoft Entra ID** before you can license them. Entra Connect syncs every 30 minutes by default. To push them now, run this on the Entra Connect server:

```powershell
Start-ADSyncSyncCycle -PolicyType Delta
```

When it finishes, the users and the `Students-Fall2026` group appear in the Microsoft 365 admin center.

## Step 5: Assign the license to the group

1. Open the **Microsoft 365 admin center**.

2. Go to **Billing > Licenses** and select your plan (for example, *Microsoft 365 A3 for students*).

3. Open the **Groups** tab and choose **Assign licenses**.

4. Pick `Students-Fall2026` and confirm.

That’s it. Every member gets the license, and anyone you add to the group later is licensed automatically. Remove a student from the group and the license is freed.

## Check it

Open any student in the admin center (**Users > Active users**) and look at **Licenses and apps**. The license shows as assigned from the group, not directly.

## Things to know before you start

– **License requirement:** group-based licensing needs Microsoft Entra ID P1 (or higher) or Office 365 E3 (or higher), paid or trial. Check that your education plan includes it.

– **Enough licenses:** you need a license for every member of a licensed group. If the plan runs out, some students are left in an error state. Check the group’s license errors in the Microsoft Entra admin center.

– **Usage location:** with group-based licensing, users without a usage location inherit the tenant’s location. If you have students in several countries, set it as part of user creation.

– **No nested groups:** only direct members of the licensed group get the license. Don’t put one group inside another.

– **Processing time:** big groups can take a while to process, especially in large tenants.

– **Password change at sign-in:** the forced password change happens on premises. If students first sign in to Microsoft 365 in the cloud, check whether your Entra Connect setup syncs that requirement.

## Sources

– Microsoft Learn: [Assign licenses to a group](https://learn.microsoft.com/en-us/entra/identity/users/licensing-groups-assign)

– Microsoft Learn: [Group-based licensing additional scenarios](https://learn.microsoft.com/en-us/entra/identity/users/licensing-group-advanced)

– Microsoft Learn: [Manage licenses (requirements)](https://learn.microsoft.com/en-us/training/modules/create-configure-manage-identities/8-manage-licenses)

– Microsoft Learn: [Entra Connect Sync scheduler](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-feature-scheduler)

—

**Watch the video:**

*Abd Almouhimen Shamout, Take away support: IT fixes, delivered in under two minutes. More at mouhimen.dev.*