A Microsoft 365 and Entra ID administration project for user onboarding, offboarding, license management, compliance auditing, remediation, and reporting.
Microsoft 365 User Lifecycle Management is a cloud administration and automation project built around common IT Support, Service Desk, Microsoft 365 Administrator, and Junior SysAdmin workflows.
The project combines Microsoft 365 Admin Center tasks with PowerShell automation through Microsoft Graph. It demonstrates how user lifecycle work can be handled from beginning to end: onboarding users, assigning licenses, managing groups, exporting inventory, offboarding users, auditing lifecycle compliance, remediating mismatches, and generating HTML dashboards.
This project was built around a demo tenant environment named MO's Demo LAB and uses fictional lab users such as Barry Allen, Diana Prince, Hal Jordan, Victor Stone, Tony Stark, and Bruce Wayne.
The goal was not only to create scripts. The goal was to show an operational support process:
Define standards, automate repeatable user actions, audit the tenant, preview remediation safely, apply fixes, and report the results clearly.
| Use Case | What This Project Demonstrates |
|---|---|
| IT Support / Help Desk | Password resets, sign-in blocking, account recovery, license checks, and user lookup workflows. |
| Microsoft 365 Administration | User creation, profile updates, license assignment, group membership, and tenant inventory. |
| Identity & Access Management | Lifecycle standards based on department, account status, groups, licenses, and usage location. |
| Offboarding / Access Revocation | Block sign-in, remove licenses, remove group memberships, and document offboarding results. |
| Compliance Auditing | Compare users against expected lifecycle standards and identify mismatches. |
| Safe Remediation | Preview remediation actions before applying changes to users, groups, licenses, or sign-in status. |
| Reporting & Documentation | Generate CSV, log, and HTML summaries for review and operational handoff. |
- ✅ Manual Microsoft 365 Admin Center password reset workflow.
- ✅ Manual block sign-in and unblock account workflow.
- ✅ User license review from the Microsoft 365 Admin Center.
- ✅ Bulk user onboarding from CSV.
- ✅ User profile enrichment with department, title, location, phones, and usage location.
- ✅ License assignment using Microsoft Graph PowerShell.
- ✅ Group membership assignment using Microsoft Graph PowerShell.
- ✅ User inventory export with license and group information.
- ✅ Bulk offboarding with sign-in blocking, license removal, and group removal.
- ✅ Lifecycle standards defined through CSV.
- ✅ Read-only lifecycle audit to detect mismatches.
- ✅ Remediation script with PreviewMode for safe dry runs.
- ✅ Final remediation run to fix audit findings.
- ✅ Master dashboard that consolidates onboarding, offboarding, audit, and remediation output.
- ✅ HTML summaries and CSV reports for clean documentation.
| Layer | Technology |
|---|---|
| Cloud Platform | Microsoft 365 |
| Identity Platform | Microsoft Entra ID |
| Admin Portal | Microsoft 365 Admin Center |
| Automation | PowerShell 7 |
| API / SDK | Microsoft Graph PowerShell |
| Input Format | CSV |
| Output Format | CSV, LOG, HTML |
| Reporting | HTML / CSS dashboards |
| Documentation | Markdown + Screenshots |
CSV Inputs
├── NewUsers.csv
├── OffboardingUsers.csv
└── M365-LifecycleStandards.csv
│
▼
PowerShell Automation
├── Onboarding-New-M365Users.ps1
├── Export-M365Users.ps1
├── Offboarding-M365Users.ps1
├── Audit-M365LifecycleCompliance.ps1
├── Remediate-M365LifecycleFindings.ps1
└── Build-M365LifecycleMasterDashboard.ps1
│
▼
Generated Evidence
├── CSV reports
├── timestamped logs
├── HTML summaries
└── master lifecycle dashboard
| Phase | Purpose |
|---|---|
| Onboarding | Create or reconcile users, assign profile details, licenses, and groups. |
| Export | Build a tenant inventory with user, license, group, and status details. |
| Offboarding | Revoke access by blocking sign-in, removing licenses, and removing group memberships. |
| Audit | Compare users against department lifecycle standards. |
| Remediation Preview | Show what would be changed before making updates. |
| Remediation Apply | Fix confirmed lifecycle mismatches. |
| Master Dashboard | Consolidate the latest results into one executive-style view. |
Microsoft-365-User-Lifecycle-Management/
│
├── README.md
├── LICENSE
├── .gitignore
│
├── scripts/
│ ├── Onboarding-New-M365Users.ps1
│ ├── Export-M365Users.ps1
│ ├── Offboarding-M365Users.ps1
│ ├── Audit-M365LifecycleCompliance.ps1
│ ├── Remediate-M365LifecycleFindings.ps1
│ └── Build-M365LifecycleMasterDashboard.ps1
│
├── inputs/
│ ├── NewUsers.csv
│ ├── OffboardingUsers.csv
│ └── M365-LifecycleStandards.csv
│
├── screenshots/
│ ├── 01-admin-center-user-profile-before-reset.png
│ ├── 02-admin-center-password-reset-window.png
│ ├── 03-admin-center-password-reset-confirmation.png
│ ├── 04-admin-center-block-sign-in-action.png
│ ├── 05-admin-center-blocked-sign-in-status.png
│ ├── 06-admin-center-unblocked-account.png
│ ├── 07-admin-center-license-tab.png
│ ├── 08-users-assigned-licenses.png
│ ├── 09-bulk-onboarding-summary.png
│ ├── 10-lifecycle-master-dashboard.png
│ ├── 11-lifecycle-remediation-summary-fixed.png
│ ├── 12-lifecycle-audit-summary-after-fixes.png
│ ├── 13-lifecycle-audit-summary-before-fixes.png
│ ├── 14-remediation-powershell-output-fixed.png
│ └── 15-remediation-summary-preview-mode.png
│
├── summary/
│ └── Sample HTML summary outputs
│
├── reports/
│ └── Generated CSV reports at runtime
│
├── logs/
│ └── Generated logs at runtime
│
├── assets/
│ └── Microsoft365 & Entra ID Demo Video.mp4
│
└── docs/
└── screenshot-checklist.md
| Script | Purpose |
|---|---|
Onboarding-New-M365Users.ps1 |
Bulk creates or reconciles users from CSV, applies profile details, assigns licenses, and adds group memberships. |
Export-M365Users.ps1 |
Exports Microsoft 365 users with account status, department, licenses, groups, phones, and location details. |
Offboarding-M365Users.ps1 |
Blocks sign-in, removes licenses, removes group memberships, and generates offboarding evidence. |
Audit-M365LifecycleCompliance.ps1 |
Performs a read-only audit against lifecycle standards defined in CSV. |
Remediate-M365LifecycleFindings.ps1 |
Applies remediation for audit findings and supports -PreviewMode for safe review before changes. |
Build-M365LifecycleMasterDashboard.ps1 |
Builds a master dashboard from the latest onboarding, offboarding, audit, and remediation outputs. |
| Workflow | Example Scopes |
|---|---|
| Read-only export / audit | User.Read.All, Group.Read.All, Directory.Read.All, Organization.Read.All |
| Onboarding / offboarding | User.ReadWrite.All, GroupMember.ReadWrite.All, Directory.ReadWrite.All, Organization.Read.All |
| Remediation | User.ReadWrite.All, Group.ReadWrite.All, Directory.ReadWrite.All, Organization.Read.All |
git clone https://github.com/MoustafaObari/Microsoft-365-User-Lifecycle-Management.git
cd Microsoft-365-User-Lifecycle-ManagementInstall-Module Microsoft.Graph -Scope CurrentUserThe project uses three CSV files:
inputs/NewUsers.csv
inputs/OffboardingUsers.csv
inputs/M365-LifecycleStandards.csv
Before running the scripts in another tenant, update:
- Tenant domain
- User names
- Departments
- Usage location
- Group names
- License SKU part numbers
- Temporary onboarding passwords
The included CSVs are lab samples only. They are not production data.
Set-ExecutionPolicy -Scope Process Bypass
.\scripts\Onboarding-New-M365Users.ps1.\scripts\Export-M365Users.ps1Optional filters:
.\scripts\Export-M365Users.ps1 -EnabledOnly
.\scripts\Export-M365Users.ps1 -LicensedOnly
.\scripts\Export-M365Users.ps1 -DepartmentFilter "IT".\scripts\Offboarding-M365Users.ps1.\scripts\Audit-M365LifecycleCompliance.ps1.\scripts\Remediate-M365LifecycleFindings.ps1 -PreviewMode.\scripts\Remediate-M365LifecycleFindings.ps1.\scripts\Build-M365LifecycleMasterDashboard.ps1Used for bulk onboarding.
| Column Examples |
|---|
| FirstName |
| LastName |
| DisplayName |
| UserName |
| Department |
| JobTitle |
| OfficeLocation |
| UsageLocation |
| LicenseSku |
| GroupName |
| Password |
Used for controlled offboarding.
| Column Examples |
|---|
| UserPrincipalName |
| DisplayName |
| BlockSignIn |
| RemoveLicenses |
| RemoveFromGroups |
| ResetPassword |
| NewPassword |
| Notes |
Used by the audit and remediation workflow.
| Column Examples |
|---|
| Department |
| RequiredGroups |
| RequiredLicenses |
| ForbiddenGroups |
| ForbiddenLicenses |
| ExpectedUsageLocation |
| ExpectedAccountEnabled |
| Notes |
A demo video is included with this repository and shows the Microsoft 365 Admin Center workflows, PowerShell automation, CSV-driven onboarding and offboarding, lifecycle auditing, remediation preview, remediation fixes, and the final master dashboard.
🎬 Watch the demo: Microsoft 365 & Entra ID Demo Video
Note: The video was compressed to remain under GitHub's regular file-size limit. GitHub may still display a large-file warning because the file is over 50 MiB, but it is below 100 MiB.
| User Profile | Password Reset | Reset Confirmation |
|---|---|---|
 |
 |
 |
| Block Sign-In | Blocked Account | Unblocked Account |
|---|---|---|
 |
 |
 |
| License Tab | Users and Assigned Licenses |
|---|---|
 |
 |
| Bulk Onboarding Summary | Master Dashboard |
|---|---|
 |
 |
| Audit Before Fixes | Remediation Preview |
|---|---|
 |
 |
| Remediation PowerShell Output | Remediation Summary After Fixes |
|---|---|
 |
 |
| Audit Summary After Fixes |
|---|
 |
| # | Screenshot | Description |
|---|---|---|
| 1 | User Profile Before Reset | Shows a user profile before the password reset workflow. |
| 2 | Password Reset Window | Shows the Microsoft 365 Admin Center password reset window. |
| 3 | Password Reset Confirmation | Confirms that the password reset action completed. |
| 4 | Block Sign-In Action | Shows the manual workflow for blocking user sign-in. |
| 5 | Blocked Account | Confirms that the account sign-in status is blocked. |
| 6 | Unblocked Account | Confirms the account was restored for sign-in. |
| 7 | License Tab | Shows license assignment visibility for a user. |
| 8 | Users and Licenses | Shows users and assigned licenses in the admin center. |
| 9 | Bulk Onboarding Summary | Shows generated HTML output from the onboarding script. |
| 10 | Master Dashboard | Shows consolidated lifecycle status across project phases. |
| 11 | Remediation Summary After Fixes | Shows remediation results after fixes were applied. |
| 12 | Audit Summary After Fixes | Shows the audit state after remediation. |
| 13 | Audit Summary Before Fixes | Shows lifecycle findings before remediation. |
| 14 | Remediation PowerShell Output | Shows terminal output from remediation execution. |
| 15 | Remediation Preview Mode | Shows safe preview output before applying changes. |
The scripts can assign users to existing groups, but the project does not blindly create new access-control groups for every CSV value.
In Microsoft 365 and Entra ID, groups often control access to Teams, SharePoint, applications, shared mailboxes, and sensitive business resources. Automatically creating or modifying access groups without review can cause:
- Naming conflicts
- Duplicate access structures
- Unauthorized access
- License or group assignment mistakes
- Confusing lifecycle ownership
- Accidental privilege escalation
For this project, the safer design was:
- ✅ Use CSV files for repeatable user lifecycle actions.
- ✅ Require known group names and expected standards.
- ✅ Skip or report missing groups instead of silently creating access structures.
- ✅ Use audit and remediation workflows to identify and fix mismatches.
- ✅ Preview remediation before applying changes.
This demonstrates a balance between automation speed and access-control judgment.
The sample CSV includes lab passwords for demo onboarding. In a production environment, initial passwords should be generated securely, delivered through an approved process, and managed according to organizational policy.
This project strengthened my understanding of:
- Microsoft 365 Admin Center user management.
- Microsoft Entra ID identity lifecycle workflows.
- Microsoft Graph PowerShell authentication and permissions.
- Bulk user onboarding and offboarding patterns.
- License assignment and removal.
- Group membership management.
- Read-only compliance auditing.
- Preview-first remediation design.
- HTML reporting for operational visibility.
- Documentation practices for IT support and administration projects.
Built a Microsoft 365 and Entra ID user lifecycle management project using PowerShell and Microsoft Graph. Automated bulk onboarding, user export, offboarding, compliance auditing, remediation, and dashboard generation using CSV inputs, generated logs, CSV reports, and HTML summaries. Practiced Microsoft 365 Admin Center workflows including password reset, block sign-in, unblock account, and license review.
| Category | Skills |
|---|---|
| Microsoft 365 Administration | User management, password reset, sign-in blocking, license review |
| Entra ID / Identity | Users, groups, account status, usage location, lifecycle standards |
| PowerShell Automation | Microsoft Graph PowerShell, CSV-driven scripts, modular reporting |
| Access Management | Group assignment, group removal, least-privilege review |
| License Management | License assignment, removal, SKU mapping |
| Compliance / Audit | Standards CSV, mismatch detection, before/after audit validation |
| Remediation | Preview mode, controlled fixes, reporting |
| Documentation | Screenshots, README, HTML summaries, demo planning |
- Add Graph API app-only authentication option for scheduled runs.
- Add Teams or email notifications after audit and remediation runs.
- Add SharePoint/OneDrive checks for offboarding completeness.
- Add manager approval fields to remediation workflows.
- Add an interactive dashboard index page for all generated summaries.
- Add GitHub Actions documentation for running validation checks.
- Extend the project with Intune device compliance checks.
Moustafa Obari
IT Support Specialist • PowerShell Automation • Microsoft 365 / Entra / Intune
📍 Toronto, Canada
© 2026 Moustafa Obari — crafted with 💙 PowerShell, Microsoft 365, Entra ID, Markdown, and strong coffee.