MS-102 Exam Alignment
MS-102

Manage users and groups (user accounts): create, edit, and delete user accounts; manage sign-in status; perform bulk user operations; understand soft-delete and the 30-day recovery window; revoke active sessions.

• Create user accounts via the Add a user wizard — know the Usage Location requirement
• Block user sign-in and understand that existing sessions persist for up to 1 hour
• Revoke active sessions immediately using Revoke-MgUserSignInSession
• Know the 30-day soft-delete window and how to restore deleted users
• Perform bulk user creation using the CSV template

Exam Tip: Two of the most-tested User Management facts on MS-102 are: (1) deleted users remain recoverable for exactly 30 days in the Deleted users bin, and (2) blocking sign-in alone does not immediately terminate active sessions — you must also run Revoke-MgUserSignInSession.

👤 Active Users — The User List

M365 Admin Center › Users › Active users

Microsoft 365 admin center
|
Users › Active users

Users

👤 Active users

🗑 Deleted users

🌐 Guest users

Active users

+ Add a user ①

⋮

🔍Search by name or email address

Display name	Username	Licenses	Status
JDJohn Doe	jdoe@contoso.com	Microsoft 365 E3	Active
PKPriya Kumar	pkumar@contoso.com	Microsoft 365 E5	Active
MSMark Stevens	mstevens@contoso.com	—	Blocked

Showing 3 of 247 users

➕ Creating a New User

The Add a user wizard collects all key fields before the account is created, across four steps:

1. 1
   Basics — First name, last name, display name, username (UPN), and whether to auto-generate or manually set the initial password. Enable "Require this user to change their password when they first sign in" for security.
2. 2
   Product licenses — Select the usage location (country — required for licensing compliance) and assign one or more available product licenses.
3. 3
   Optional settings — Set job title, department, office, manager, and phone numbers. Optionally assign an admin role. All fields are editable later.
4. 4
   Review and finish — Confirm all settings. Option to email the new credentials to a specified address for secure handoff to the user.

✏️ Editing User Properties

Click any user in the Active users list to open their side panel. Key tabs:

🔑 Resetting a Password

M365 Admin Center › Users › Active users › [user] › Reset password

1. 1
   In Active users, click on the user whose password needs resetting
2. 2
   In their properties panel, click Reset password
3. 3
   Choose to auto-generate the password or set a custom one
4. 4
   Enable "Require this user to change their password when they first sign in" — always recommended
5. 5
   Optionally email the temporary credentials to yourself for secure handoff

🚫 Blocking a User's Sign-In

Blocking sign-in prevents the user from authenticating to any Microsoft 365 service, without deleting the account. This is the correct first action when an employee is terminated:

1. 1
   In Active users, click the user and open the Account tab
2. 2
   Under Sign-in status, click Edit → select Block this user from signing in
3. 3
   Save the change — the user is blocked from all new authentications immediately

🗑 Deleting and Restoring Users

To restore: go to Users → Deleted users, select the account, click Restore user. If the original license was released during deletion, you must reassign it after restoration.

📋 Bulk User Operations

Access bulk operations via the ⋯ (more actions) menu in Active users:

• Add multiple users — Download the CSV template, complete required columns (DisplayName, UserName, Initial Password, etc.), upload the file. M365 validates the CSV before creating any accounts
• Export users to CSV — Download the full user list with all properties for auditing or reporting purposes
• Bulk delete — Upload a CSV of UPNs to delete multiple accounts at once

⚡ PowerShell — User Management

Connect-MgGraph -Scopes "User.ReadWrite.All"

# List all users
Get-MgUser -All | Select DisplayName, UserPrincipalName, AccountEnabled

# Create a new user
$PasswordProfile = @{ Password = "Temp@12345"; ForceChangePasswordNextSignIn = $true }
New-MgUser -DisplayName "Jane Smith" -UserPrincipalName "jsmith@contoso.com" -AccountEnabled $true -PasswordProfile $PasswordProfile -MailNickname "jsmith"

# Block sign-in
Update-MgUser -UserId "jdoe@contoso.com" -AccountEnabled $false

# Revoke all active sessions immediately
Revoke-MgUserSignInSession -UserId "jdoe@contoso.com"

# Soft-delete a user (30-day recovery window)
Remove-MgUser -UserId "jdoe@contoso.com"

# Restore a deleted user
Restore-MgDirectoryDeletedItem -DirectoryObjectId "[object-id]"

🎓 Interview Q&A

Next Module →Module 3: Group Management→