BULK ONBOARD — 40 users

Prereq: Connect-MgGraph -Scopes "User.ReadWrite.All","Group.ReadWrite.All","Organization.Read.All"

STEP 0 — LICENSE CHECK FIRST (this is what fails Monday morning)
  Get-MgSubscribedSku | Select SkuPartNumber,
    @{n='Available';e={$_.PrepaidUnits.Enabled - $_.ConsumedUnits}}
  40 seats must be free BEFORE the loop. A mid-run license exhaustion
  leaves you with half-provisioned accounts and no clean rollback.

STEP 1 — CSV
  UserPrincipalName,DisplayName,Department,JobTitle,ManagerUPN,UsageLocation

STEP 2 — CREATE (idempotent — safe to re-run after a partial failure)
  Import-Csv .\newhires.csv | ForEach-Object {
    if (Get-MgUser -Filter "userPrincipalName eq '$($_.UserPrincipalName)'" -EA SilentlyContinue) {
      Write-Warning "exists, skipping: $($_.UserPrincipalName)"; return
    }
    $pw = @{ ForceChangePasswordNextSignIn = $true; Password = (New-Password) }
    New-MgUser -UserPrincipalName $_.UserPrincipalName -DisplayName $_.DisplayName `
      -MailNickname ($_.UserPrincipalName -split '@')[0] -AccountEnabled `
      -UsageLocation $_.UsageLocation -PasswordProfile $pw
  }

  UsageLocation is not optional — license assignment fails without it, and
  the error message doesn't say so.

STEP 3 — LICENSE + GROUPS
  Prefer group-based licensing over per-user: add to the group, licensing
  follows, and offboarding is one removal instead of three.

STEP 4 — CONDITIONAL ACCESS
  Confirm new hires land in scope of the MFA policy. A CA policy scoped to
  a static group silently excludes everyone created after it was written.

STEP 5 — VERIFY
  Compare CSV count to Get-MgUser results; export mismatches. Don't trust
  the loop's own output — it reports what it attempted, not what stuck.

Run steps 1–2 against 2 test rows Friday. Monday is not the day to find
out about UsageLocation.