Automating M365 Onboarding with Graph API

Manual employee onboarding is a major bottleneck for operations. An administrator has to create the user account in Microsoft Entra, assign licenses, provision the Exchange mailbox, add them to distribution groups, create a OneDrive directory, and set up initial credentials.

This tutorial outlines how to automate the entire workflow using PowerShell, Azure Functions, and the Microsoft Graph API.

The Microsoft Graph API Advantage

Traditionally, admins used legacy MSOnline or AzureAD PowerShell modules. These are deprecated. The modern standard is the Microsoft Graph SDK, which interactively connects to the Microsoft Graph API.

Workflow Overview

When a new employee is hired, an HR record is created (e.g. in BambooHR or a SharePoint list). This triggers an Azure Function:

[HR Intake] ──> [Azure Function] ──> [Microsoft Graph API] ──> [Account & Groups Configured]

Step 1: Authentication using Managed Identity

To run this securely in the background without hardcoding credentials:

Enable a System-Assigned Managed Identity on your Azure Function.
Grant the Managed Identity the necessary Graph API permissions: User.ReadWrite.All, Directory.ReadWrite.All, and GroupMember.ReadWrite.All.

Step 2: The Onboarding Script

Here is the core PowerShell script to provision the account, set initial parameters, and assign them to their department's security groups:

# Authenticate using Azure Managed Identity
Connect-MgGraph -Identity

# Define user attributes
$PasswordProfile = @{
    Password = "TemporaryPassword123!"
    ForceChangePasswordNextSignIn = $true
}

$NewUser = @{
    AccountEnabled = $true
    DisplayName = "Jane Doe"
    MailNickname = "jdoe"
    UserPrincipalName = "jdoe@yourdomain.com"
    PasswordProfile = $PasswordProfile
    UsageLocation = "US"
}

# Create the user account
$User = New-MgUser @NewUser

# Assign licensing (e.g. Microsoft 365 Business Premium)
$SkuId = "CBDC14AB-AE9E-47C0-B9E7-2D92D2ED1696" # Replace with actual SKU
Set-MgUserLicense -UserId $User.Id -AddLicenses @{SkuId = $SkuId} -RemoveLicenses @()

# Add to departmental group
$GroupId = "DE5C508A-33D4-48E0-9E1D-A142999059F2"
New-MgGroupMember -GroupId $GroupId -DirectoryObjectId $User.Id

The Results