Create New User Accounts

This guide shows you how to create new Active Directory and 365 user accounts using the AD pro Toolkit.

Go to Tools > Users > New user to open the form. It has four tabs: Basics, Properties, Groups, and Microsoft 365. The Create user bar at the bottom stays in view on every tab and says what is still needed before you can create the account.

If you create the same kind of account often, for example every new starter in Sales, save the settings as a template and pick it next time. A template fills in everything except the person.

Before you start

To create the Microsoft 365 user, a tenant must be connected first. See Connect Microsoft 365. If no tenant is connected, the Microsoft 365 tab shows a notice and the cloud account is skipped.
For the accounts to soft-match, the user's UPN suffix must be a verified domain in the Microsoft 365 tenant. The form checks this before it creates anything.

Step 1: Basics

Start from a template or another user (optional):
- Template: pick a template to fill in the location, groups, properties, account options and Microsoft 365 settings it holds. See Templates.
- Copy from user: search for an existing user to make the new account like theirs. This copies their OU, groups, job details (title, department, company, division, office, employee type, description), address, and profile and home folder settings. It does not copy anything that identifies the person, such as names, logon name, email, phone numbers or employee ID.
Name: enter the user's First name and Last name. The Display name and logon names are built from them as you type. Enter Initials if your name format uses a middle initial.
Logon: check the Logon name (pre-2000) and User logon name, and pick the UPN suffix from the dropdown. The suffix list comes from your forest's UPN suffixes plus the domain's DNS name. The line under the field shows the full UPN that will be created. This is what Microsoft 365 matches on, so choose it deliberately.
To change how the names are built, select Select Name Format and choose a format. See Name formats.
Location: choose the organizational unit (OU) the account is created in. This is required.
Password: choose Generate password to have the app create a strong one, or Enter password to set your own. A generated password is shown once in the results window at the end, with a copy button. Copy it then; it is not stored or shown again.
Options: choose whether the account is enabled, whether the user must change the password at next logon, whether the password never expires, and whether the account expires on a date.

Step 2: Properties (optional)

Fill in any directory attributes you want on the account: job information, manager, contact details, address, profile paths, proxy addresses, and extension attributes.

Mail and proxy addresses: if you leave these blank and you are also creating a Microsoft 365 user, the app fills them in from the UPN so mail routing and the soft-match line up. If you enter them yourself, they must match the UPN; the form blocks a mismatch rather than silently changing what you typed.

Step 3: Groups (optional)

Type in the search box to find groups, and tick a group to add it. The selected groups are listed below the search, and the tab shows how many there are. Remove one with its X, or use Clear all. With no groups selected, the account is created with its primary group only (usually Domain Users).

Step 4: Microsoft 365

This tab is always visible. If no tenant is connected it shows a notice and a link to Connections.

Turn on Also create a Microsoft 365 user.
User principal name: shown as a read-only value, mirrored from the UPN on the Basics tab. This is deliberate. The cloud UPN must match the on-prem UPN for the accounts to soft-match, so it can't be edited here. To change it, change the logon name on Basics.
Usage location: the user's country. It defaults to the tenant's country and is required for license assignment.
Licenses: lists the licenses in the tenant, with how many seats are free. Tick the licenses to assign. A license with no free seats can't be ticked.
Apps: for a ticked license, select Configure apps to turn individual apps (service plans) on or off, if you don't want to assign the whole license. The button shows how many apps are enabled.
Microsoft 365 groups: select Add groups to add the user to cloud groups, such as Microsoft 365 groups, security groups and distribution lists. These are added after the user is created.

Step 5: Create

Select Create user.
Before anything is created, the form checks that:
- No existing account already uses the same logon name or UPN.
- Any mail and proxy addresses you entered match the UPN.
- The UPN suffix is a verified domain in the tenant (only when creating a 365 user).
If a check fails, the results window shows the error and stops. Nothing is created in the cloud with a bad UPN suffix.
A results window opens and shows each step as it runs: the on-prem account, the password, group membership, and the Microsoft 365 account, licenses and groups.
If a generated password was used, it is shown in the window with a copy button. Copy it before closing. The window stays open until you close it, so you don't lose the password or an error message.

After the account is created, the form clears the person's details (names, logon names, email and password) but keeps everything else. If you are creating several people for the same role, enter the next person's name and create again.

Templates

A template is a saved New User form without the person in it. It holds the settings that are the same for everyone in a role, so creating the next account only needs a name.

What a template holds

Naming: the logon name format, display name format and UPN suffix.
Location: the OU.
Password and account options: generate or enter, enabled, must change at next logon, password never expires.
Groups.
Properties: job details, telephone, address, description, profile and home folder settings, proxy addresses and extension attributes.
Microsoft 365: whether to also create a cloud user, the usage location, the licenses with any apps turned off, and the Microsoft 365 groups.

A template never holds names, logon names, the manager, or a password, because those belong to the person. Templates are kept per domain.

Create a template

There are two ways:

From the form: fill in the New User form the way you want accounts for that role, then select Save as template at the top right of the tabs and give it a name. You can do this before or after creating an account.
From the Templates page: select Manage templates on the New User form, then New template. The same form opens in template mode. A banner at the top says you are editing a template, and nothing on it creates an account. Enter a Template name, set the naming formats and anything else, and select Save template.

Use a template

On the Basics tab, pick it from the Template dropdown. The form fills in from the template. Everything it sets stays visible and can be changed before you create the account. Choose No template to go back to the defaults.

Licenses and groups are checked when the template is used, not when it is saved. A template saves which licenses to assign, not seats. If a license is no longer in the tenant, or a group has been deleted, it is left off and a warning at the top of the Microsoft 365 tab says so. If a license has no free seats, the form tells you before you create the account. If your licenses are assigned by group in Entra ID, add the licensing group to the template instead of the license.

Manage templates

The Templates page lists every template in the domain with its naming format, OU and number of groups. To open it, select Manage templates on the New User form. For each template you can:

Edit it. The form opens in template mode.
Duplicate it, as a starting point for a similar role.
Delete it.

Import brings in templates from the desktop AD Pro Toolkit. Upload its user-templates.json file. Templates with a name already in use are skipped, unless you tick Replace templates that already have the same name. Microsoft 365 settings aren't imported, since the desktop toolkit doesn't have them; add them by editing the template.

Name formats

Select Name Format on the Basics tab sets how the logon names and display name are built from the first name, last name and initials. In template mode, the formats are set directly on the Basics tab. Using John M. Smith as an example:

Format	Example	Logon name	Display name
First Initial + Last Name	jsmith	Yes	Yes
First Name . Last Name	john.smith	Yes	Yes
First Name + Last Name	johnsmith	Yes	Yes
First Name + Last Initial	johns	Yes	Yes
Last Name + First Initial	smithj	Yes	Yes
Last Name . First Name	smith.john	Yes	Yes
First Initial . Last Name	j.smith	Yes	Yes
First Name . Middle Initial . Last Name	john.m.smith	Yes	Yes
First + Middle Initial + Last Name	jmsmith	Yes	Yes
Last Name, First Name	Smith, John	No	Yes

The generated names can always be edited on the form before you create the account.

How the soft-match works

Entra Connect matches an on-prem account to an existing cloud account by primary SMTP address first, then by UPN, as long as the cloud account does not already have an immutable ID set. Because the form uses the same UPN for both accounts and fills the mail and proxy addresses from that UPN, the two accounts link on the next Entra Connect sync instead of becoming duplicates.

This is why the cloud UPN is locked to the on-prem UPN, and why a mismatched mail or proxy address is blocked rather than quietly corrected.

Troubleshooting

Microsoft 365 tab shows "No Microsoft 365 connection": no tenant is connected. Connect one under Settings > Connections > Microsoft 365.
"The domain ... is not a verified domain in the Microsoft 365 tenant": the UPN suffix is not verified in the tenant. Verify the domain in Entra, choose a verified suffix, or turn off Also create a Microsoft 365 user.
A mail or proxy address you entered is rejected: it does not match the UPN. Clear it to let the app fill it from the UPN, or change it to match.
A license can't be ticked, or shows "None available": the tenant has no free seats for it. Buy or free up a seat in Microsoft 365, or untick it. A license also needs a Usage location.
A warning says a template's license or group was left off: the license is no longer in the tenant, or the group was deleted. Edit the template and save it again to clear the warning.
"A template with that name already exists in this domain": template names must be unique in each domain. Choose another name, or edit the existing template.