Creating a Microsoft Entra ID Tenant and User Accounts –

This article explains how to create a new Microsoft Entra ID tenant and how to create user accounts inside an existing tenant, using the Microsoft Entra admin center (https://entra.microsoft.com).

Which procedure do I need?

• Procedure 1 (new tenant): you need a brand-new, separate directory, for example for a new organization, a test/dev environment, or a lab.
• Procedure 2 (new user): you need an account for a person in a directory that already exists. This is the most common request.

Note: Microsoft renamed parts of the portal navigation. Older screenshots and articles show “Identity > Overview” or “Azure Active Directory”; current menus show “Entra ID”. The steps are the same.

Prerequisites

Confirm the role and licensing requirements below before starting; most failures come from missing permissions.

Also have ready:

• An admin account protected with multi-factor authentication (MFA).
• The organization name, preferred initial domain name, and country/region (for a new tenant).
• The new user’s full name, sign-in name, department/job title, manager, required groups, and required licenses (for a new user). Attach the approved access request ticket number if your process requires one.

Procedure 1: Create a new Entra ID tenant

The person who creates the tenant becomes its first user and is automatically assigned Global Administrator.

1. Sign in to the admin center.
   • Go to https://entra.microsoft.com (or https://portal.azure.com) and sign in with an account that has at least the Tenant Creator role.
   • [Screenshot 1.1: Entra admin center home page after sign-in]
2. Open Manage tenants.
   • In the left menu, select Entra ID > Overview.
   • Select the Manage tenants tab at the top of the Overview page.
   • [Screenshot 1.2: Overview page with the Manage tenants tab highlighted]
3. Start tenant creation.
   • Select + Create.
   • [Screenshot 1.3: Manage tenants list with the Create button highlighted]
4. Choose the tenant type (Basics tab).
   • Select Microsoft Entra ID for a workforce tenant (employees, internal apps).
   • Select Microsoft Entra ID (B2C) or External only for customer-facing sign-in scenarios.
   • Select Next: Configuration.
   • [Screenshot 1.4: Basics tab showing tenant type options]
5. Enter tenant details (Configuration tab).
   • Organization name: the display name of the tenant, for example Contoso Ltd.
   • Initial domain name: the prefix of yourname.onmicrosoft.com. This is permanent and cannot be changed later; follow your naming standard.
   • Country/Region: determines where directory data is stored. This also cannot be changed later.
   • Select Next: Review + create.
   • [Screenshot 1.5: Configuration tab with fields completed]
6. Review and create.
   • Confirm the details, then select Create.
   • Complete the verification (CAPTCHA) prompt if shown.
   • Creation usually takes a few minutes and can take up to 30 minutes. Track progress in the Notifications bell, top right.
   • [Screenshot 1.6: Review + create page and the completion notification]
7. Switch to the new tenant.
   • Select the Settings (gear) icon or your account name > Switch directory, then select the new tenant.
   • [Screenshot 1.7: Directories + subscriptions page listing the new tenant]
8. Verify the tenant.
   • Go to Entra ID > Overview and record the Tenant name, Tenant ID, and Primary domain in your CMDB or documentation.
   • Go to Entra ID > Users and confirm your account appears with the Global Administrator role.
   • [Screenshot 1.8: Overview page showing Tenant ID and Primary domain]

Procedure 2: Create a new user in Entra ID

Use this procedure to create a cloud-only member account. For guests from another organization, choose Invite external user in step 3 instead.

Hybrid environments: if users sync from on-premises Active Directory via Entra Connect / Cloud Sync, create the account in on-premises AD instead. Accounts created directly in Entra will not sync back.

1. Sign in.
   • Go to https://entra.microsoft.com and sign in with at least the User Administrator role.
   • Confirm the correct tenant is shown under your account name, top right.
   • [Screenshot 2.1: Admin center with tenant name visible]
2. Open the user list.
   • Select Entra ID > Users > All users.
   • [Screenshot 2.2: All users page]
3. Start a new user.
   • Select + New user > Create new user.
   • [Screenshot 2.3: New user dropdown showing Create new user and Invite external user]
4. Complete the Basics tab.
   • User principal name: the sign-in name, for example jsmith@contoso.com. Pick the domain from the dropdown.
   • Mail nickname: leave “Derive from user principal name” checked unless your standard says otherwise.
   • Display name: First Last, per your naming standard.
   • Password: keep Auto-generate password or enter one that meets policy. Copy it now.
   • Account enabled: leave checked.
   • [Screenshot 2.4: Basics tab completed]
5. Complete the Properties tab.
   • Identity: First name, Last name, User type (Member).
   • Job information: Job title, Company name, Department, Employee ID, Manager.
   • Contact information: Office location, phone, email.
   • Settings: Usage location is required before a license can be assigned.
   • [Screenshot 2.5: Properties tab with Usage location highlighted]
6. Complete the Assignments tab (optional).
   • Select + Add group to add security or Microsoft 365 groups. Group-based licensing will apply licenses automatically.
   • Select + Add role only if the user needs an admin role. Prefer Privileged Identity Management (PIM) for eligible roles over permanent assignment.
   • [Screenshot 2.6: Assignments tab]
7. Review and create.
   • On Review + create, check every value, then select Create.
   • The user appears in All users within a minute.
   • [Screenshot 2.7: Review + create summary]
8. Assign licenses (if not group-based).
   • Open the user > Licenses > + Assignments, select the products, and select Save.
   • Alternatively, use the Microsoft 365 admin center > Users > Active users.
   • [Screenshot 2.8: Licenses blade for the user]
9. Hand off credentials securely.
   • Send the UPN and temporary password through separate, approved channels (never in the same email).
   • The user must change the password and register MFA at first sign-in at https://aka.ms/mysecurityinfo.
   • Update and close the request ticket.

Post-creation checklist

Complete these items before marking the request done.

New tenant

• Enable MFA on the Global Administrator account.
• Create a second Global Administrator and two cloud-only emergency access (break-glass) accounts, excluded from Conditional Access and monitored.
• Keep Global Administrators to fewer than five accounts.
• Turn on Security defaults, or configure Conditional Access policies if you have Entra ID P1/P2.
• Add and verify your custom domain (Entra ID > Domain names > Add custom domain).
• Restrict tenant creation and app registration by non-admins under User settings, if your policy requires it.
• Record Tenant ID, primary domain, and admin accounts in documentation.

New user

• User signs in, changes the temporary password, and registers MFA.
• Licenses show as assigned with no errors.
• Group memberships and app access match the approved request.
• No admin role was assigned unless approved; any role uses PIM where available.
• Ticket updated with UPN and creation date.

Troubleshooting