Summary and recommendation
Microsoft 365 user management can be run manually, but complexity usually increases with role models, licensing gates, and offboarding dependencies. This guide gives the exact mechanics and where automation has the biggest impact.
Microsoft 365 user management runs through the Microsoft 365 Admin Center at admin.microsoft.com, backed by Microsoft Entra ID as the identity backbone. Over 60 built-in admin roles scope permissions to specific services - Exchange, Teams, SharePoint, Security, and more - so access can be tightly controlled without granting Global Admin to every app owner.
Custom roles and group-based license assignment require Entra ID P1 or P2, which is included in Business Premium but must be added separately on Basic or Standard plans.
Quick facts
| Admin console path | Microsoft 365 Admin Center > Users > Active Users |
| Admin console URL | Official docs |
| SCIM available | Yes |
| SCIM tier required | Business Basic+ (SSO), P1/P2 (SCIM) |
| SSO prerequisite | Yes |
User types and roles
| Role | Permissions | Cannot do | Plan required | Seat cost | Watch out for |
|---|---|---|---|---|---|
| Global Administrator | Full access to all administrative features across all Microsoft 365 services. Can manage users, licenses, billing, security, and compliance settings. | Cannot reduce their own Global Admin role without another Global Admin present. Microsoft recommends limiting to fewer than 5 Global Admins per tenant. | Any Microsoft 365 plan | Included in any licensed seat | Global Admins have access to all data and settings; Microsoft recommends using least-privilege roles instead for day-to-day tasks. |
| User Administrator | Can create and manage users and groups, reset passwords for non-admins, manage user licenses, and create/manage support requests. | Cannot manage users with admin roles (except Help Desk Admin, Guest Inviter, and Directory Reader roles). Cannot manage billing or tenant-wide security settings. | Any Microsoft 365 plan | Included in any licensed seat | Cannot reset passwords or manage accounts of Global Admins or other privileged admins. |
| Billing Administrator | Can make purchases, manage subscriptions, manage support tickets, and monitor service health. | Cannot manage users, groups, or security settings outside of billing scope. | Any Microsoft 365 plan | Included in any licensed seat | Does not have access to assign or remove licenses from users; that requires User Administrator or License Administrator role. |
| License Administrator | Can assign, remove, and update license assignments for users and groups. | Cannot create or delete users, manage groups beyond license assignment, or access billing. | Any Microsoft 365 plan | Included in any licensed seat | Group-based license assignment requires Entra ID P1 or P2. |
| Help Desk Administrator (Password Administrator) | Can reset passwords and manage service requests for non-admin users. | Cannot reset passwords for users with admin roles (except other Help Desk Admins). Cannot manage licenses or user accounts beyond password resets. | Any Microsoft 365 plan | Included in any licensed seat | Scope is limited to non-privileged users only. |
| Standard User (no admin role) | Access to assigned Microsoft 365 apps and services (e.g., Outlook, Teams, SharePoint) based on license. Can manage their own profile and password (if self-service password reset is enabled). | Cannot access Microsoft 365 Admin Center. Cannot manage other users, licenses, or tenant settings. | Any Microsoft 365 plan | Requires a paid license seat (e.g., Business Basic at $6/user/month) | Users without a license assigned cannot access any Microsoft 365 services even if the account exists in the directory. |
| Guest User | Limited access to specific Teams, SharePoint sites, or other resources they are explicitly invited to. Cannot access the admin center or tenant-wide resources. | Cannot access resources not explicitly shared with them. Cannot be assigned Microsoft 365 admin roles by default. | Guest access is included; external users do not consume a paid Microsoft 365 seat for basic collaboration. Some features require the host tenant to have appropriate licensing. | No Microsoft 365 seat cost for the guest; governed by Entra External ID pricing for certain scenarios. | Guest users are subject to the tenant's external collaboration settings in Entra ID. SharePoint external sharing must be enabled separately. |
Permission model
- Model type: role-based
- Description: Microsoft 365 uses a role-based access control (RBAC) model built on Microsoft Entra ID (formerly Azure AD). Over 60 built-in admin roles are available, each scoping permissions to specific services (e.g., Exchange Administrator, SharePoint Administrator, Teams Administrator). Roles are assigned per user in the admin center or via Entra ID. Custom roles are available at the Entra ID layer for directory-level permissions.
- Custom roles: Yes
- Custom roles plan: Microsoft Entra ID P1 or P2 (included in Microsoft 365 Business Premium, E3, E5, or as a standalone add-on)
- Granularity: Role assignments are per-user or per-group. Built-in roles cover service-specific administration (Exchange, Teams, SharePoint, Security, Compliance, etc.). Custom roles in Entra ID allow scoping of directory permissions but do not extend to all Microsoft 365 workload-specific permissions. Administrative Units allow scoping admin roles to subsets of users or groups.
How to add users
- Sign in to the Microsoft 365 Admin Center at https://admin.microsoft.com
- Navigate to Users > Active Users
- Click 'Add a user'
- Enter the user's first name, last name, display name, and username (which sets their email address)
- Choose whether to auto-generate a password or create one manually; optionally require the user to change password on first sign-in
- Select the user's location (country/region) - required for license assignment
- Assign a product license from the available licenses in your subscription
- Optionally assign admin roles under the 'Optional settings' step
- Review and click 'Finish adding' to create the account
- Share login credentials with the user via email or manually
Required fields: First name, Last name, Display name, Username (sets primary email/UPN), Location (country/region), Password (auto-generated or manual)
Watch out for:
- A user's location must be set before a license can be assigned; this cannot be skipped.
- The username domain must match a verified domain in the tenant or the default onmicrosoft.com domain.
- Newly created users may take a few minutes to appear across all Microsoft 365 services.
- Assigning a license is done during user creation but can also be done afterward; without a license, the user cannot access any Microsoft 365 apps.
- If your tenant uses Entra ID Connect (hybrid), users should be created in on-premises Active Directory and synced, not created directly in the cloud admin center, to avoid sync conflicts.
- Multi-factor authentication (MFA) enrollment is not automatically triggered at account creation unless Conditional Access or Security Defaults are configured.
| Bulk option | Availability | Notes |
|---|---|---|
| CSV import | Yes | Microsoft 365 Admin Center > Users > Active Users > Add multiple users (CSV upload). Template downloadable from the same page. |
| Domain whitelisting | No | Automatic domain-based user add |
| IdP provisioning | Yes | Microsoft Entra ID P1 or P2 required for automatic SCIM provisioning to/from third-party apps. Entra ID Connect (free) handles on-premises AD sync. Group-based provisioning requires P1 or P2. |
How to remove or deactivate users
- Can delete users: Yes
- Delete/deactivate behavior: Microsoft 365 supports both blocking sign-in (soft deactivation) and full account deletion. Blocking sign-in immediately prevents the user from accessing any Microsoft 365 services while preserving the account, mailbox, and data. Deleting a user moves the account to a 'Deleted users' recycle bin for 30 days, during which it can be restored. After 30 days, the account and associated data are permanently deleted. The license is freed immediately upon deletion (or can be unassigned separately when blocking sign-in).
- Sign in to the Microsoft 365 Admin Center at https://admin.microsoft.com
- Navigate to Users > Active Users
- Select the user to deactivate
- Click 'Block sign-in' from the user detail panel or the action menu
- Confirm the block; the user is immediately prevented from signing in
- Optionally, unassign the license from the user to free the seat while keeping the account and mailbox intact
- To fully delete: return to Active Users, select the user, and choose 'Delete user'; confirm deletion
- Deleted users appear in Users > Deleted Users for 30 days and can be restored during that window
| Data impact | Behavior |
|---|---|
| Owned records | When a user is deleted, their OneDrive files are retained for the tenant's configured retention period before permanent deletion. Admins can access and transfer OneDrive content during that window. Exchange mailbox data is retained for 30 days after account deletion before permanent removal, unless a litigation hold or retention policy is applied. |
| Shared content | SharePoint files the user contributed remain in place and are not deleted when the user is removed. Teams messages sent by the deleted user remain visible in conversation history. Shared calendars and contacts may lose the owner reference. |
| Integrations | Deleting a user revokes all active OAuth tokens and app permissions granted by that user. Third-party app integrations authenticated under that user account will break and require re-authentication under a different account. |
| License freed | The license is freed immediately upon user deletion and becomes available for reassignment. Blocking sign-in alone does not free the license; the license must be manually unassigned to reclaim the seat. |
Watch out for:
- Blocking sign-in does not free the license; you must manually unassign the license to reclaim the seat for billing purposes.
- Deleted users are permanently removed after 30 days with no recovery option; ensure data backup or transfer before this window closes.
- If the user is the sole owner of a Microsoft 365 Group or Team, ownership must be transferred before or immediately after deletion to prevent orphaned groups.
- Exchange mailboxes can be converted to a shared mailbox before deletion to retain email access without consuming a paid license (shared mailboxes up to 50 GB require no additional license).
- If Entra ID Connect sync is active (hybrid environment), deleting the user in the cloud admin center may cause sync conflicts; deletion should be performed in on-premises Active Directory.
- Litigation holds and retention policies override the standard deletion window and can retain mailbox data longer per compliance policy settings.
- Revoking active sessions after blocking sign-in may take up to an hour unless the admin also revokes all refresh tokens via Entra ID.
License and seat management
| Seat type | Includes | Cost |
|---|---|---|
| Microsoft 365 Business Basic | Web and mobile versions of Office apps, Exchange Online (50 GB mailbox), Teams, SharePoint, OneDrive (1 TB). No desktop Office app installs. | $6/user/month (annual commitment); increasing to $7/user/month in July 2026 |
| Microsoft 365 Business Standard | Everything in Business Basic plus desktop Office app installs (Word, Excel, PowerPoint, Outlook, etc.) on up to 5 devices per user, webinar hosting, and additional Teams features. | $12.50/user/month (annual commitment); increasing to $14/user/month in July 2026 |
| Microsoft 365 Business Premium | Everything in Business Standard plus Microsoft Entra ID P1, Intune device management, Microsoft Defender for Business, Azure Information Protection P1, and advanced security features. | $22/user/month (annual commitment); no price increase announced for July 2026 |
| Microsoft 365 Apps for Business | Desktop Office app installs only (Word, Excel, PowerPoint, Outlook, etc.) plus OneDrive (1 TB). No Exchange Online or Teams included. | $8.25/user/month (annual commitment) |
| Exchange Online Plan 1 | Exchange Online mailbox (50 GB) only. No other Microsoft 365 apps. | $4/user/month (annual commitment) |
| Microsoft Entra ID P1 (standalone add-on) | Conditional Access, group-based licensing, self-service password reset, hybrid identity, and SCIM provisioning to third-party SaaS apps. | $6/user/month (annual commitment) |
| Microsoft Entra ID P2 (standalone add-on) | Everything in P1 plus Privileged Identity Management (PIM), Identity Protection, and access reviews. | $9/user/month (annual commitment) |
- Where to check usage: Microsoft 365 Admin Center > Billing > Licenses (shows total purchased vs. assigned per license type). Also available at: https://admin.microsoft.com/Adminportal/Home#/licenses
- How to identify unused seats: Navigate to Microsoft 365 Admin Center > Reports > Usage to view per-user activity reports across Exchange, Teams, SharePoint, and OneDrive. Users with no activity in the selected period (7, 30, 90, or 180 days) can be identified for license reclamation. The 'Microsoft 365 active users' report at https://admin.microsoft.com/Adminportal/Home#/reportsUsage/MailboxUsage shows last activity dates per mailbox.
- Billing notes: Licenses are billed per assigned seat per month. Removing a license assignment mid-cycle does not generate a prorated credit for annual subscriptions; the seat remains paid through the end of the billing period. Monthly subscriptions allow mid-cycle license removal with prorated credit. Business plans are capped at 300 seats; organizations above 300 users must use Microsoft 365 Enterprise plans (E1, E3, E5). A 5% price increase for annual-commitment plans paid monthly took effect in April 2025.
The cost of manual management
License management is the highest-friction manual task in Microsoft 365. Licenses must be assigned per user, and a user's country/region (usageLocation) must be set before any license assignment will succeed - a step that is easy to miss and produces a non-obvious error.
Blocking sign-in does not free the license seat; admins must manually unassign the license to stop billing, and in annual subscriptions there is no prorated credit for mid-cycle removal.
Pricing adds a second layer of complexity. Business Basic runs $6/user/month (rising to $7 in July 2026); Business Standard is $12.50/user/month (rising to $14); Business Premium holds at $22/user/month. SCIM provisioning to third-party apps requires Entra ID P1 ($6/user/month standalone) or P2 ($9/user/month), which surprises teams expecting full provisioning features at the base tier.
Hybrid environments using Entra ID Connect add a third constraint: users must be created and managed in on-premises Active Directory, not in the cloud admin center. Admins expecting a fully cloud-native workflow across every app in their stack will hit sync conflicts if they bypass this.
What IT admins are saying
The most consistent complaint across admin communities is the cost and complexity of Entra ID P1/P2 licensing.
Features that feel foundational - SCIM outbound provisioning, group-based license assignment, Conditional Access - are gated behind a plan tier that many SMB teams do not initially budget for.
A second recurring issue is the 30-day deleted-user retention window. Compliance-sensitive organizations frequently flag this as too short, particularly when litigation holds or audit requirements extend well beyond that period.
Admins also report that the distinction between blocking sign-in (which preserves the license) and deleting a user (which soft-deletes the account) is not surfaced clearly enough in the UI, leading to billing surprises for departed employees.
Common complaints:
- P1/P2 licensing adds significant cost for full provisioning features such as SCIM to third-party apps and group-based license assignment
- Pricing complexity with modular features - many admins report confusion about which features require Entra ID P1 vs P2 vs Business Premium
- Enterprise Mobility Suite (EMS) bundling can be confusing when comparing standalone vs. bundled Entra ID pricing
- The 30-day deleted user retention window is considered too short by some admins managing compliance-sensitive environments
- Blocking sign-in does not automatically free the license, leading to unexpected billing for departed employees if admins forget to manually unassign
- Hybrid environments using Entra ID Connect require user management in on-premises AD rather than the cloud admin center, which surprises admins expecting a fully cloud-native workflow
- The Business plan 300-seat cap forces mid-size organizations into Enterprise plans with significantly higher complexity and cost
- July 2026 price increases (Business Basic $6→$7, Business Standard $12.50→$14) have generated complaints about value relative to competitors
- Admin role granularity for workload-specific permissions (e.g., Teams vs. Exchange) requires assigning multiple roles, which some admins find cumbersome compared to a single unified admin role
The decision
Manual management in the Microsoft 365 Admin Center is workable for teams under roughly 50 users with stable headcount and a single-tenant, cloud-only setup. The built-in role model is granular enough to delegate provisioning without exposing billing or security settings, and the 30-day soft-delete window provides a reasonable safety net for accidental deletions.
The model breaks down at scale or in hybrid environments. Every app a user needs access to requires a correctly assigned license, a set usageLocation, and - if SCIM is involved - an Entra ID P1 or P2 seat.
Teams managing frequent onboarding and offboarding cycles will find the manual license unassignment step (required to reclaim billing) to be a persistent operational gap.
Bottom line
Microsoft 365 manual administration is well-structured for cloud-only tenants with moderate user volume, but the operational burden scales poorly.
License assignment requires a country/region field that blocks provisioning if missed, sign-in blocks do not reclaim seats automatically, and full provisioning features require an Entra ID P1 or P2 add-on that adds meaningful per-user cost on Basic and Standard plans.
Hybrid environments using Entra ID Connect effectively remove the cloud admin center as a user creation tool, requiring on-premises AD as the source of truth.
Teams that need reliable, auditable lifecycle management across every app in their stack will find the manual surface area - license tracking, role assignment, offboarding steps - difficult to sustain without tooling on top of it.
Automate Microsoft 365 workflows without one-off scripts
Stitchflow builds and maintains end-to-end IT automation across your SaaS stack, including apps without APIs. Built for exactly how your company works, with human approvals where they matter.
