Extracted from ../entities/user.md.
- v0.1 — initial draft (Batch C2 — gap fill). Consolidates rules from business-rules.md §3.9 (BR-081, BR-084, BR-085, BR-086, BR-141), glossary §10 (User, Role) and §11 (Microsoft 365), domain-model User entry, roles-permissions.md (full capability matrix). Adds validation invariants, sync mechanics, three worked examples covering new-user sync, deactivation, and role change. Phase: Alpha. Status: 🟢 Locked.