Week 1, Day 3 — Populating Lakeview Logistics — users, licensing & bulk provisioning

Day 2 review & domain health check

Quick confirmation that every student's domain is healthy before building user accounts on top of it. Anyone with unresolved DNS issues resolves them now.

• Ask: "What is your tenant's primary domain right now — what do new user email addresses end in?"
• Anyone with DNS health warnings: open MXToolbox and the admin centre DNS health view side by side and troubleshoot before proceeding
• Frame the context: Lakeview Logistics has a live domain but zero employees — nobody can log in, nobody has email. Today that changes.
• Briefly introduce the Lakeview Logistics org: 10 employees across IT, Operations, Finance, HR, Sales, and Logistics — students will provision all of them using three different methods today

Users, licences & identity in Microsoft 365

The concepts admins need before touching the portal — not just how to navigate screens, but what M365 is doing underneath and why the decisions made here matter long-term.

• The Microsoft Entra ID user object Entra ID — every M365 user is an identity object in Microsoft Entra ID. The M365 admin centre is a simplified view of that object. Key attributes: UPN (the login identity), display name, department, job title, usage location. Usage location determines licence eligibility by country — it is required and must be set correctly at creation. The Entra admin centre at entra.microsoft.com exposes the full object.
• Entra ID vs the M365 admin centre Entra ID — both surfaces manage the same underlying identity objects. The M365 admin centre is streamlined for day-to-day tasks. The Entra admin centre exposes the full depth of the identity platform — roles, app registrations, conditional access, identity governance. Admins need to be comfortable in both.
• UPN vs email address vs display name — three separate attributes that often match but don't have to. The UPN is the authentication credential used to sign in. The primary SMTP address is the mail address. Understanding the distinction prevents misdiagnosis when troubleshooting login failures or mail delivery issues.
• How licensing works — a licence assigned to a user triggers service provisioning in Entra ID. Without one, the user object exists but the person can access nothing. Exchange mailbox creation runs asynchronously after licence assignment — it takes a few minutes. Licence assignment is per-user, not per-device.
• Three provisioning methods — and when to use each — manual (one user, learning the object model), CSV bulk import (batch onboarding, HR data integration), PowerShell via Microsoft Graph (automation, scripting, operations beyond what the UI supports). Real environments use all three.
• CSV import gotchas — the M365 CSV format has specific required columns and encoding expectations. Excel silently reformats fields and can inject BOM characters that break the parser. Always validate in a plain text editor before uploading.
• Least privilege from day one — new users get no admin role by default. That is correct. Admin roles are additive and assigned only when a specific need exists. This principle becomes central in Week 2 when Entra ID roles and Privileged Identity Management are introduced.

Lab 1-C: Creating and managing Lakeview Logistics users

Students provision the full Lakeview Logistics workforce using three methods — two users manually, eight via CSV bulk import, and one via PowerShell — then verify identity objects and licence state in both the M365 admin centre and the Entra admin centre.

• Step 1 — Create two users manually (15 min)
  In the M365 admin centre: Users → Active users → Add a user. Create the following, assigning a Business Standard licence and setting usage location to Canada for each.
  
  User 1: Sarah Chen · IT Manager · IT · UPN: s.chen@[yoursubdomain]
  User 2: Marcus Webb · Operations Director · Operations · UPN: m.webb@[yoursubdomain]
  
  Record both UPNs and temporary passwords in your Lab Journal immediately.
• Step 2 — Explore the user object in both admin surfaces (10 min) Entra ID
  Click into Sarah Chen's profile in the M365 admin centre — explore every tab: Account, Devices, Licences, Mail, OneDrive. Then open entra.microsoft.com → Users → All users → Sarah Chen. Compare what each surface exposes. In your Lab Journal, note two properties visible in the Entra admin centre that are absent from the M365 admin centre view.
• Step 3 — Bulk import 8 users via CSV (20 min)
  Download the Lakeview Logistics CSV from the shared course folder. Open it first in a plain text editor — Notepad or VS Code, not Excel. Verify structure and encoding. Then in the M365 admin centre: Users → Active users → Add multiple users. Upload the CSV, review the validation summary, complete the import. Record the result in your Lab Journal.

• Step 4 — Create one user via Microsoft Graph PowerShell (15 min)
  Open PowerShell and connect to Microsoft Graph:
  Connect-MgGraph -Scopes "User.ReadWrite.All"
  
  Create Dev Sharma:
  New-MgUser -DisplayName "Dev Sharma" -UserPrincipalName "d.sharma@[subdomain]" -MailNickname "d.sharma" -AccountEnabled -PasswordProfile @{Password="TempPass1!"; ForceChangePasswordNextSignIn=$true} -UsageLocation "CA" -Department "IT" -JobTitle "IT Support Technician"
  
  Verify Dev appears in Active users in the M365 admin centre and in entra.microsoft.com → Users → All users. Assign a Business Standard licence via the M365 admin centre. Record the command output in your Lab Journal.
• Step 5 — Verify licence and mailbox provisioning (10 min)
  Go to Billing → Licences → Microsoft 365 Business Standard — confirm all 10 users are assigned. Then click into Sarah Chen's profile and check her Mail tab. Confirm her Exchange Online mailbox is provisioned. If pending, wait 2–3 minutes and refresh. Record the mailbox status in your Lab Journal.

Reflection & preview

• Ask: "You have 10 users and 25 trial licences. The CEO needs 20 more staff added immediately. What's the problem and what are your options?"
• Ask: "Why did we use PowerShell for Dev Sharma rather than the admin centre?" — establish PowerShell as an automation and scale tool, not just an alternative UI path
• Ask: "Dev's UPN is d.sharma@[subdomain]. His manager says Dev can't log in but his email works fine. What's the first thing you check?" — reinforce UPN vs email distinction
• Ask: "You managed users today from two different portals. What's the difference between the M365 admin centre and the Entra admin centre?" — lock in the dual-surface mental model
• Collect exit ticket: what three attributes are required to create a valid M365 user, and why is usage location mandatory?
• Preview Day 4: with 10 users live, the next task is organising them — security groups, Microsoft 365 Groups, and distribution lists, and how group membership drives access across the platform