The New User form creates an on-premises Active Directory account and, optionally, a Microsoft 365 cloud account in the same step. When both are created with a matching user principal name (UPN), Entra Connect soft-matches them so the on-prem account and the cloud account link up on the next sync, instead of creating a duplicate.
Go to Tools > New User to open the form. It has four tabs: Basics, Properties, Groups, and Microsoft 365.
Before you start
- To create the Microsoft 365 user, a tenant must be connected first. See Connect Microsoft 365 Tenant. If no tenant is connected, the Microsoft 365 tab shows a notice and the cloud account is skipped.
- For the accounts to soft-match, the user's UPN suffix must be a verified domain in the Microsoft 365 tenant. The form checks this before it creates anything.
Step 1: Basics
- Enter the user's First name, Last name, and Display name.
- User logon name (UPN): enter the logon prefix and pick the suffix from the dropdown. The suffix list comes from your forest's UPN suffixes plus the domain's DNS name. This value is the user's UPN, and it is what Microsoft 365 matches on, so choose it deliberately.
- To control how the logon and display names are built, select Select Name Format and choose a format. This is optional; the defaults work for most organizations.
- Location: choose the organizational unit (OU) the account is created in.
- Password: choose Generate password to have the app create a strong one, or
Enter password to set your own.
- A generated password is shown once in the progress dialog at the end, with a copy button. Copy it then; it is not stored or shown again.
- Options: set account flags such as User must change password at next logon as needed.
Step 2: Properties (optional)
Fill in any directory attributes you want on the account: job information, contact details, address, profile paths, proxy addresses, and extension attributes.
Mail and proxy addresses: if you leave these blank and you are also creating a Microsoft 365 user, the app fills them in from the UPN so mail routing and the soft-match line up. If you enter them yourself, they must match the UPN; the form blocks a mismatch rather than silently changing what you typed.
Step 3: Groups (optional)
Add the user to any security or distribution groups. Search for a group and select it to add it to the list.
Step 4: Microsoft 365
This tab is always visible. If no tenant is connected it shows a notice and nothing else.
- Turn on Also create a Microsoft 365 user. Everything below becomes active.
- User principal name: shown as a read-only value, mirrored from the UPN you set on the Basics tab. This is deliberate. The cloud UPN must match the on-prem UPN for the accounts to soft-match, so it cannot be edited here. To change it, change the logon name on Basics.
- Usage location: required for license assignment. Set the user's country.
- Licenses: the left pane lists the licenses available in the tenant, with how many seats are free. Select the licenses to assign.
- Apps: with a license selected, the right pane lists the service plans (apps) in that license. Turn individual apps on or off if you do not want to assign the whole license.
- Block sign-in to the cloud account: optionally create the account with sign-in blocked, for example when you are staging an account ahead of a start date.
Step 5: Create
- Select Create user.
- A progress dialog opens and shows each step as it runs: the on-prem account, the password, group membership, and the Microsoft 365 account and licensing.
- Before anything is created, the form validates:
- No existing account already uses the same logon name or UPN.
- Any mail and proxy addresses you entered match the UPN.
- The UPN suffix is a verified domain in the tenant (only when creating a 365 user). If a check fails, the dialog shows the error and stops. Nothing is partially created on the cloud side because of a bad UPN suffix.
- If a generated password was used, it is displayed in the dialog with a copy button. Copy it before closing. The dialog stays open until you close it, so you do not lose the password or an error message.
How the soft-match works
Entra Connect matches an on-prem account to an existing cloud account by primary SMTP address first, then by UPN, as long as the cloud account does not already have an immutable ID set. Because the form uses the same UPN for both accounts and fills the mail and proxy addresses from that UPN, the two accounts link on the next Entra Connect sync instead of becoming duplicates.
This is why the cloud UPN is locked to the on-prem UPN, and why a mismatched mail or proxy address is blocked rather than quietly corrected.
Troubleshooting
- Microsoft 365 tab shows "No Microsoft 365 connection": no tenant is connected. Connect one under Settings > Connections > Microsoft 365.
- "The domain ... is not a verified domain in the Microsoft 365 tenant": the UPN suffix is not verified in the tenant. Verify the domain in Entra, choose a verified suffix, or turn off Also create a Microsoft 365 user.
- A mail or proxy address you entered is rejected: it does not match the UPN. Clear it to let the app fill it from the UPN, or change it to match.
- Licenses cannot be selected: set a Usage location; a license cannot be assigned without one. If a license shows no free seats, buy or free up a seat in the tenant.