diff --git a/docs/screenshots/azure/member-number-email.png b/docs/screenshots/azure/member-number-email.png
new file mode 100644
index 0000000..602ca3b
Binary files /dev/null and b/docs/screenshots/azure/member-number-email.png differ
diff --git a/docs/screenshots/azure/welcome-email.png b/docs/screenshots/azure/welcome-email.png
new file mode 100644
index 0000000..2f4ba1d
Binary files /dev/null and b/docs/screenshots/azure/welcome-email.png differ
diff --git a/src/azure/directory.ts b/src/azure/directory.ts
index 093c7f3..6db3c51 100644
--- a/src/azure/directory.ts
+++ b/src/azure/directory.ts
@@ -1,12 +1,22 @@
 import { logger } from "@/logger"
 import { azureCredentials } from "./config"
 import { addGroupMember, getAllGroups, removeGroupMember } from "./functions/groups"
-import { createMember, getMembers, setMemberNumber } from "./functions/members"
+import {
+  createMember,
+  findByMail,
+  findByMemberNumber,
+  getMember,
+  getMembers,
+  setMemberNumber,
+} from "./functions/members"
 import { createMockAzureDirectory } from "./mock-directory"
 import type { AzureDirectory } from "./types"
 
 const graphAzureDirectory: AzureDirectory = {
   getMembers,
+  getMember,
+  findByMemberNumber,
+  findByMail,
   setMemberNumber,
   createMember,
   getAllGroups,
diff --git a/src/azure/errors.ts b/src/azure/errors.ts
new file mode 100644
index 0000000..09e430e
--- /dev/null
+++ b/src/azure/errors.ts
@@ -0,0 +1,14 @@
+import type { MemberSummary } from "./types"
+
+export class IncompleteMemberError extends Error {
+  constructor(
+    readonly member: MemberSummary,
+    cause: unknown
+  ) {
+    super(
+      `Account ${member.mail} (${member.id}) was created, but setup and cleanup failed. Contact IT before trying again.`,
+      { cause }
+    )
+    this.name = "IncompleteMemberError"
+  }
+}
diff --git a/src/azure/functions/members.ts b/src/azure/functions/members.ts
index 41ec310..6e7536f 100644
--- a/src/azure/functions/members.ts
+++ b/src/azure/functions/members.ts
@@ -2,7 +2,9 @@ import { logger } from "@/logger"
 import { generatePassword } from "@/utils/password"
 import { withRetry } from "@/utils/wait"
 import { getAzureClient } from "../client"
-import type { CreatedMember, CreateMemberInput, ParsedUser, User } from "../types"
+import { IncompleteMemberError } from "../errors"
+import { MAIL_DOMAIN } from "../mailbox"
+import type { CreatedMember, CreateMemberInput, MemberSummary, ParsedUser, User } from "../types"
 
 const GruppoSociID = "1c68dbb8-4ac3-4569-a886-283b5a825cbd"
 const Licenses = {
@@ -13,22 +15,41 @@ const Licenses = {
 } as const
 const FlippedLicenses = Object.fromEntries(Object.entries(Licenses).map(([key, value]) => [value, key]))
 
+type Page<T> = { value: T[]; "@odata.nextLink"?: string }
+
+async function allPages<T>(client: ReturnType<typeof getAzureClient>, first: Page<T>, advanced = false): Promise<T[]> {
+  const items = [...first.value]
+  let next = first["@odata.nextLink"]
+  while (next) {
+    const request = client.api(next)
+    if (advanced) request.header("ConsistencyLevel", "eventual")
+    const page: Page<T> = await request.get()
+    items.push(...page.value)
+    next = page["@odata.nextLink"]
+  }
+  return items
+}
+
 export async function getMembers(): Promise<ParsedUser[]> {
   try {
     const client = getAzureClient()
-    const allPolinetworkUsers: User[] = await client
-      .api(`/users`)
-      .header("ConsistencyLevel", "eventual")
-      .select(["displayName", "mail", "givenName", "surname", "id", "assignedLicenses", "employeeId"])
-      .filter("endswith(mail, '@polinetwork.org')")
-      .get()
-      .then<User[]>((r) => r.value)
+    const allPolinetworkUsers = await allPages<User>(
+      client,
+      await client
+        .api(`/users`)
+        .header("ConsistencyLevel", "eventual")
+        .count(true)
+        .select(["displayName", "mail", "givenName", "surname", "id", "assignedLicenses", "employeeId"])
+        .filter("endswith(mail, '@polinetwork.org') or endswith(userPrincipalName, '@polinetwork.org')")
+        .get(),
+      true
+    )
 
-    const members: { id: string }[] = await client
-      .api(`/groups/${GruppoSociID}/members`)
-      .select(["id"])
-      .get()
-      .then((r) => r.value)
+    const members = await allPages<{ id: string }>(
+      client,
+      await client.api(`/groups/${GruppoSociID}/members`).select(["id"]).get()
+    )
+    const memberIds = new Set(members.map((member) => member.id))
 
     logger.debug({ count: members.length }, "[Azure Graph API] Get members")
 
@@ -36,16 +57,61 @@ export async function getMembers(): Promise<ParsedUser[]> {
       ({ assignedLicenses, ...u }) =>
         ({
           ...u,
-          isMember: members.findIndex((m) => m.id === u.id) !== -1,
+          isMember: memberIds.has(u.id),
           assignedLicensesIds: assignedLicenses.map((al) => (al.skuId ? FlippedLicenses[al.skuId] : "UNKNOWN")),
         }) satisfies ParsedUser
     )
   } catch (error) {
     logger.error({ error }, "[Azure Graph API] Could not get users")
-    return []
+    throw error
+  }
+}
+
+const SUMMARY_FIELDS = ["id", "displayName", "givenName", "mail", "employeeId"]
+
+function toSummary(user: Partial<MemberSummary> & { id: string }): MemberSummary {
+  return {
+    id: user.id,
+    displayName: user.displayName ?? null,
+    givenName: user.givenName ?? null,
+    mail: user.mail ?? null,
+    employeeId: user.employeeId ?? null,
+  }
+}
+
+export async function getMember(userId: string): Promise<MemberSummary | null> {
+  try {
+    const user = await getAzureClient()
+      .api(`/users/${encodeURIComponent(userId)}`)
+      .select(SUMMARY_FIELDS)
+      .get()
+    return toSummary(user)
+  } catch (error) {
+    if ((error as { statusCode?: number }).statusCode === 404) return null
+    throw error
   }
 }
 
+/** Callers pass only validated values (integers, `localPartSchema` addresses), so the filter needs no escaping. */
+async function findOne(filter: string): Promise<MemberSummary | null> {
+  const users: MemberSummary[] = await getAzureClient()
+    .api("/users")
+    .filter(filter)
+    .select(SUMMARY_FIELDS)
+    .top(1)
+    .get()
+    .then((r) => r.value)
+  return users[0] ? toSummary(users[0]) : null
+}
+
+export async function findByMemberNumber(assocNumber: number) {
+  return findOne(`employeeId eq '${assocNumber}'`)
+}
+
+export async function findByMail(mail: string) {
+  return findOne(`userPrincipalName eq '${mail}' or mail eq '${mail}'`)
+}
+
 export async function setMemberNumber(userId: string, assocNumber: number) {
   try {
     const client = getAzureClient()
@@ -58,18 +124,25 @@ export async function setMemberNumber(userId: string, assocNumber: number) {
   }
 }
 
-export async function createMember({ firstName, lastName, assocNumber }: CreateMemberInput): Promise<CreatedMember> {
+export async function createMember({
+  firstName,
+  lastName,
+  assocNumber,
+  localPart,
+}: CreateMemberInput): Promise<CreatedMember> {
   const client = getAzureClient()
-  // TODO: separate steps and add better error handling, maybe with neverthrow
   const password = generatePassword()
-  const mailNickname = `${firstName.replaceAll(" ", "")}.${lastName.replaceAll(" ", "")}`.toLowerCase()
-  const mail = `${mailNickname}@polinetwork.org`
+  const mail = `${localPart}@${MAIL_DOMAIN}`
 
   // create user
   const { id }: { id: string } = await client.api("/users").post({
     accountEnabled: true,
     displayName: `${firstName} ${lastName}`,
-    mailNickname,
+    givenName: firstName,
+    surname: lastName,
+    usageLocation: "IT",
+    employeeId: assocNumber.toString(),
+    mailNickname: localPart,
     userPrincipalName: mail,
     passwordProfile: {
       forceChangePasswordNextSignIn: true,
@@ -77,25 +150,31 @@ export async function createMember({ firstName, lastName, assocNumber }: CreateM
     },
   })
 
-  // set firstName and lastName
-  await withRetry(() =>
-    client.api(`/users/${id}`).patch({
-      givenName: firstName,
-      surname: lastName,
-      usageLocation: "IT",
-      employeeId: assocNumber.toString(),
-    })
-  )
-
-  // add to group Soci
-  await withRetry(() =>
-    client.api(`/groups/${GruppoSociID}/members/$ref`).post({
-      "@odata.id": `https://graph.microsoft.com/v1.0/directoryObjects/${id}`,
-    })
-  )
-
-  // assign licenses
-  await manageLicenses(id, ["OFFICE_365", "POWER_AUTOMATE"], [])
+  try {
+    await withRetry(() =>
+      client.api(`/groups/${GruppoSociID}/members/$ref`).post({
+        "@odata.id": `https://graph.microsoft.com/v1.0/directoryObjects/${id}`,
+      })
+    )
+    await manageLicenses(id, ["OFFICE_365", "POWER_AUTOMATE"], [])
+  } catch (error) {
+    try {
+      await withRetry(async () => {
+        try {
+          await client.api(`/users/${id}`).delete()
+        } catch (cleanupError) {
+          if ((cleanupError as { statusCode?: number }).statusCode !== 404) throw cleanupError
+        }
+      })
+    } catch (cleanupError) {
+      logger.error({ error: cleanupError, memberId: id }, "[AZURE] incomplete account cleanup failed")
+      throw new IncompleteMemberError(
+        { id, displayName: `${firstName} ${lastName}`, givenName: firstName, mail, employeeId: assocNumber.toString() },
+        error
+      )
+    }
+    throw error
+  }
 
   return {
     firstName,
@@ -135,6 +214,6 @@ export async function manageLicenses(
       })),
       removeLicenses: removeLicenses.map((l) => Licenses[l]),
     })
-  ).catch((e) => logger.error({ error: e }, "[Azure Graph API] members:manageLicenses ERROR"))
+  )
   logger.info("[Azure Graph API] members:manageLicenses OK")
 }
diff --git a/src/azure/mailbox.ts b/src/azure/mailbox.ts
new file mode 100644
index 0000000..06260b1
--- /dev/null
+++ b/src/azure/mailbox.ts
@@ -0,0 +1,35 @@
+import z from "zod"
+
+export const MAIL_DOMAIN = "polinetwork.org"
+
+const LOCAL_PART = /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/
+
+/** The part before `@polinetwork.org`: lowercase letters, digits, and single dots or hyphens between them. */
+export const localPartSchema = z
+  .string()
+  .trim()
+  .toLowerCase()
+  .max(64)
+  .regex(LOCAL_PART, "Only lowercase letters, digits, dots and hyphens")
+
+export const mailboxSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("standard") }),
+  z.object({ kind: z.literal("custom"), localPart: localPartSchema }),
+])
+
+export type MailboxChoice = z.infer<typeof mailboxSchema>
+
+/** Accents and apostrophes are dropped and spaces removed: "Niccolò", "D'Amico" -> "niccolo.damico". */
+function namePart(name: string) {
+  return name.normalize("NFD").replace(/\p{M}/gu, "").replace(/['\s]/g, "").toLowerCase()
+}
+
+/** `firstname.lastname`, or null when the name has letters an address cannot hold (e.g. "Łukasz"). */
+export function standardLocalPart(firstName: string, lastName: string): string | null {
+  const localPart = `${namePart(firstName)}.${namePart(lastName)}`
+  return LOCAL_PART.test(localPart) && localPart.length <= 64 ? localPart : null
+}
+
+export function mailboxLocalPart(firstName: string, lastName: string, mailbox: MailboxChoice) {
+  return mailbox.kind === "custom" ? mailbox.localPart : standardLocalPart(firstName, lastName)
+}
diff --git a/src/azure/mock-directory.ts b/src/azure/mock-directory.ts
index 80b4b75..75a2bb9 100644
--- a/src/azure/mock-directory.ts
+++ b/src/azure/mock-directory.ts
@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto"
 import { generatePassword } from "@/utils/password"
-import type { AzureDirectory, ParsedGroup, ParsedUser } from "./types"
+import { MAIL_DOMAIN } from "./mailbox"
+import type { AzureDirectory, MemberSummary, ParsedGroup, ParsedUser } from "./types"
 
 const ASSOCIATION_GROUP_ID = "mock-group-association-members"
 
@@ -65,6 +66,10 @@ function cloneMembers(members: ParsedUser[]): ParsedUser[] {
   return members.map((member) => ({ ...member, assignedLicensesIds: [...member.assignedLicensesIds] }))
 }
 
+function summary({ id, displayName, givenName, mail, employeeId }: ParsedUser): MemberSummary {
+  return { id, displayName, givenName, mail, employeeId }
+}
+
 function cloneGroups(groups: ParsedGroup[]): ParsedGroup[] {
   return groups.map((group) => ({ ...group, members: group.members.map((member) => ({ ...member })) }))
 }
@@ -78,6 +83,21 @@ export function createMockAzureDirectory(): AzureDirectory {
       return cloneMembers(members)
     },
 
+    async getMember(userId) {
+      const member = members.find((candidate) => candidate.id === userId)
+      return member ? summary(member) : null
+    },
+
+    async findByMemberNumber(assocNumber) {
+      const member = members.find((candidate) => candidate.employeeId === assocNumber.toString())
+      return member ? summary(member) : null
+    },
+
+    async findByMail(mail) {
+      const member = members.find((candidate) => candidate.mail === mail)
+      return member ? summary(member) : null
+    },
+
     async setMemberNumber(userId, assocNumber) {
       const member = members.find((candidate) => candidate.id === userId)
       if (!member) return { error: `Azure member ${userId} was not found in the local directory` }
@@ -86,9 +106,8 @@ export function createMockAzureDirectory(): AzureDirectory {
       return { error: null }
     },
 
-    async createMember({ firstName, lastName, assocNumber }) {
-      const mailNickname = `${firstName.replaceAll(" ", "")}.${lastName.replaceAll(" ", "")}`.toLowerCase()
-      const mail = `${mailNickname}@polinetwork.org`
+    async createMember({ firstName, lastName, assocNumber, localPart }) {
+      const mail = `${localPart}@${MAIL_DOMAIN}`
       if (members.some((member) => member.mail === mail)) {
         throw new Error(`Azure member ${mail} already exists in the local directory`)
       }
diff --git a/src/azure/types.ts b/src/azure/types.ts
index bf06ae6..60021d4 100644
--- a/src/azure/types.ts
+++ b/src/azure/types.ts
@@ -47,8 +47,13 @@ export type CreateMemberInput = {
   firstName: string
   lastName: string
   assocNumber: number
+  /** The part before `@polinetwork.org`, already validated. */
+  localPart: string
 }
 
+/** The directory fields the member number workflow reads. */
+export type MemberSummary = Pick<ParsedUser, "id" | "displayName" | "givenName" | "mail" | "employeeId">
+
 export type CreatedMember = {
   firstName: string
   lastName: string
@@ -59,6 +64,12 @@ export type CreatedMember = {
 
 export type AzureDirectory = {
   getMembers(): Promise<ParsedUser[]>
+  /** Null when no user has this id. */
+  getMember(userId: string): Promise<MemberSummary | null>
+  /** Any user whose `employeeId` is this number. */
+  findByMemberNumber(assocNumber: number): Promise<MemberSummary | null>
+  /** Any user whose sign-in name or mail is this address. */
+  findByMail(mail: string): Promise<MemberSummary | null>
   setMemberNumber(userId: string, assocNumber: number): Promise<{ error: string | null }>
   createMember(input: CreateMemberInput): Promise<CreatedMember>
   getAllGroups(): Promise<ParsedGroup[]>
diff --git a/src/emails/mailer.tsx b/src/emails/mailer.tsx
index 65f445e..4603670 100644
--- a/src/emails/mailer.tsx
+++ b/src/emails/mailer.tsx
@@ -4,6 +4,7 @@ import type { JSX } from "react"
 import { sendEmail as azureSendEmail, type EmailAttachment } from "@/azure/functions/emails"
 import { env } from "@/env"
 import { logger } from "@/logger"
+import MemberNumberChanged from "./templates/member-number-changed"
 import OtpEmail from "./templates/otp"
 import SignatureRequestEmail from "./templates/signature-request"
 import SignedDocumentEmail from "./templates/signed-document"
@@ -64,6 +65,28 @@ export async function sendWelcomeEmail(
   )
 }
 
+export async function sendMemberNumberChangedEmail(
+  toAddress: string,
+  memberInfo: {
+    firstName: string | null
+    assocNumber: number
+    previousAssocNumber: string | null
+    email: string | null
+  }
+) {
+  const subject = makeSubject("Your PoliNetwork member number has changed")
+  return sendEmail(
+    toAddress,
+    subject,
+    <MemberNumberChanged
+      firstName={memberInfo.firstName}
+      assocNum={memberInfo.assocNumber}
+      previousAssocNum={memberInfo.previousAssocNumber}
+      email={memberInfo.email}
+    />
+  )
+}
+
 export async function sendSignatureRequestEmail(
   toAddress: string,
   props: { signerName: string; requestedBy: string; title: string; role: string | null; url: string }
diff --git a/src/emails/templates/member-number-changed.tsx b/src/emails/templates/member-number-changed.tsx
new file mode 100644
index 0000000..d819898
--- /dev/null
+++ b/src/emails/templates/member-number-changed.tsx
@@ -0,0 +1,93 @@
+import {
+  Body,
+  CodeInline,
+  Container,
+  Head,
+  Heading,
+  Html,
+  Link,
+  Preview,
+  pixelBasedPreset,
+  Section,
+  Tailwind,
+  Text,
+} from "@react-email/components"
+import { Footer } from "../components/footer"
+import { Logo } from "../components/logo"
+import type { EmailTemplate } from "../types"
+
+type Props = {
+  firstName: string | null
+  assocNum: number
+  previousAssocNum: string | null
+  email: string | null
+}
+
+const MemberNumberChangedEmail: EmailTemplate<Props> = (props) => {
+  return (
+    <Html>
+      <Tailwind config={{ presets: [pixelBasedPreset] }}>
+        <Head />
+        <Preview>Your PoliNetwork member number is now {props.assocNum.toString()}</Preview>
+
+        <Body className="m-0 bg-white p-0 font-sans text-base leading-normal">
+          <Logo />
+
+          {/* Main Content Container */}
+          <Container className="mx-auto bg-white px-5">
+            <Heading className="m-0 text-center text-2xl font-bold leading-8">Your member number has changed</Heading>
+
+            {/* Content Section */}
+            <Section className="py-8">
+              <Text className="my-2 text-base leading-normal">
+                {props.firstName ? (
+                  <>
+                    Hi <strong>{props.firstName}</strong>,
+                  </>
+                ) : (
+                  "Hi,"
+                )}
+                <br /> your PoliNetwork member number is now <strong>{props.assocNum}</strong>
+                {props.previousAssocNum ? <> (previously number {props.previousAssocNum})</> : null}.
+              </Text>
+
+              {props.email ? (
+                <>
+                  <Text className="my-4 text-base leading-normal">Microsoft 365 account</Text>
+
+                  <Section className="p-4 bg-blue-100 rounded-md">
+                    <CodeInline className="text-xs sm:text-sm">{props.email}</CodeInline>
+                  </Section>
+                </>
+              ) : null}
+
+              <Text className="my-4 text-base leading-normal">
+                For help, contact IT on{" "}
+                <Link href="https://t.me/lorenzocorallo" className="text-[#1156AE] underline">
+                  Telegram
+                </Link>{" "}
+                or at{" "}
+                <Link href="mailto:it@polinetwork.org" className="text-[#1156AE] underline">
+                  it@polinetwork.org
+                </Link>
+              </Text>
+
+              <Text className="my-2 text-sm leading-normal text-gray-700">~ Lorenzo Corallo, Team Lead IT</Text>
+            </Section>
+          </Container>
+
+          <Footer />
+        </Body>
+      </Tailwind>
+    </Html>
+  )
+}
+
+MemberNumberChangedEmail.PreviewProps = {
+  firstName: "Mario",
+  assocNum: 456,
+  previousAssocNum: "123",
+  email: "mario.rossi@polinetwork.org",
+}
+
+export default MemberNumberChangedEmail
diff --git a/src/emails/templates/welcome.tsx b/src/emails/templates/welcome.tsx
index e87f535..19a4ff1 100644
--- a/src/emails/templates/welcome.tsx
+++ b/src/emails/templates/welcome.tsx
@@ -78,12 +78,14 @@ const WelcomeEmail: EmailTemplate<Props> = (props) => {
                 If you encounter any issue or have some questions, please contact me on{" "}
                 <Link href="https://t.me/lorenzocorallo" className="text-[#1156AE] underline">
                   Telegram
+                </Link>{" "}
+                or at{" "}
+                <Link href="mailto:it@polinetwork.org" className="text-[#1156AE] underline">
+                  it@polinetwork.org
                 </Link>
               </Text>
 
-              <Text className="my-2 text-sm leading-normal text-gray-700">
-                ~ Lorenzo Corallo, Gestione Progetti Innovativi e Supporto Tecnico (IT)
-              </Text>
+              <Text className="my-2 text-sm leading-normal text-gray-700">~ Lorenzo Corallo, Team Lead IT</Text>
             </Section>
           </Container>
 
diff --git a/src/routers/azure/members.ts b/src/routers/azure/members.ts
index 027a9c8..85145dd 100644
--- a/src/routers/azure/members.ts
+++ b/src/routers/azure/members.ts
@@ -1,9 +1,13 @@
+import type { Actor } from "@polinetwork/auth-kit"
 import z from "zod"
 import { azureDirectory } from "@/azure/directory"
-import { sendWelcomeEmail } from "@/emails/mailer"
+import { IncompleteMemberError } from "@/azure/errors"
+import { MAIL_DOMAIN, mailboxLocalPart, mailboxSchema } from "@/azure/mailbox"
+import type { CreatedMember, MemberSummary } from "@/azure/types"
+import { sendMemberNumberChangedEmail, sendWelcomeEmail } from "@/emails/mailer"
 import { dashboard } from "@/idp/policies"
 import { logger } from "@/logger"
-import { createTRPCRouter, legacyProcedure, policy } from "@/trpc"
+import { createTRPCRouter, policy } from "@/trpc"
 
 // Becomes the Entra display name and mail nickname.
 const personName = z
@@ -13,25 +17,162 @@ const personName = z
   .max(64)
   .regex(/^[\p{L}\p{M}' -]+$/u, "Only letters, spaces, apostrophes and hyphens")
 
+function auditActor(actor: Actor | null) {
+  return actor?.kind === "user" ? { sub: actor.sub, client: actor.client } : { legacy: true }
+}
+
+/**
+ * Runs member writes one at a time, so two requests cannot both pass the duplicate checks before either writes.
+ * Entra does not enforce a unique `employeeId`, and the backend runs as a single instance.
+ */
+let memberWrites: Promise<unknown> = Promise.resolve()
+function serializeMemberWrite<T>(task: () => Promise<T>): Promise<T> {
+  const run = memberWrites.then(task, task)
+  memberWrites = run.catch(() => undefined)
+  return run
+}
+
+// Keep successful writes until both directory searches and user reads can see them.
+const pendingNumbers = new Map<
+  number,
+  { member: MemberSummary; previousNumbers: Set<string | null>; created: boolean; userVisible: boolean }
+>()
+
+function rememberNumber(member: MemberSummary, assocNumber: number, created = false) {
+  const previousNumbers = new Set([member.employeeId])
+  for (const [number, pending] of pendingNumbers) {
+    if (pending.member.id === member.id) {
+      for (const previous of pending.previousNumbers) previousNumbers.add(previous)
+      previousNumbers.add(pending.member.employeeId)
+      created ||= pending.created && !pending.userVisible
+      pendingNumbers.delete(number)
+    }
+  }
+  if (created) previousNumbers.add(null)
+  pendingNumbers.set(assocNumber, {
+    member: { ...member, employeeId: assocNumber.toString() },
+    previousNumbers,
+    created,
+    userVisible: false,
+  })
+}
+
+async function currentMember(userId: string) {
+  const member = await azureDirectory.getMember(userId)
+  const entry = [...pendingNumbers.entries()].find(([, pending]) => pending.member.id === userId)
+  if (!entry) return member
+  const [number, pending] = entry
+  if (member?.employeeId === pending.member.employeeId) pending.userVisible = true
+  const externalChange =
+    (member === null && !pending.created) ||
+    (member !== null &&
+      !pending.previousNumbers.has(member.employeeId) &&
+      member.employeeId !== pending.member.employeeId)
+  if (pending.userVisible || externalChange) {
+    // Once the user read has caught up, later edits or deletions in Entra are authoritative.
+    if (member?.employeeId !== pending.member.employeeId) pendingNumbers.delete(number)
+    return member
+  }
+  return { ...(member ?? pending.member), employeeId: pending.member.employeeId }
+}
+
+async function numberHolder(assocNumber: number) {
+  const holder = await azureDirectory.findByMemberNumber(assocNumber)
+  const pending = pendingNumbers.get(assocNumber)
+  if (pending) {
+    await currentMember(pending.member.id)
+    if (!pendingNumbers.has(assocNumber)) return holder
+    if (holder?.id === pending.member.id && pending.userVisible) pendingNumbers.delete(assocNumber)
+    return pending.member
+  }
+  return holder
+}
+
+/** Entra's message when the sign-in name or an address already belongs to another object. */
+function isAddressConflict(error: unknown) {
+  return error instanceof Error && /same value for property (userPrincipalName|proxyAddresses)/i.test(error.message)
+}
+
+function numberTaken(assocNumber: number, holder: MemberSummary) {
+  return `Member number ${assocNumber} is already assigned to ${holder.displayName ?? holder.mail ?? "another user"}.`
+}
+
 export default createTRPCRouter({
   getAll: policy(dashboard("azure:members:read")).query(async () => {
     return await azureDirectory.getMembers()
   }),
-  setAssocNumber: legacyProcedure
+  /**
+   * Change the member number (`employeeId`) of an existing user, refusing a number another user holds, and
+   * optionally email the new number. Token callers only: it can send mail to a caller-supplied address.
+   */
+  setAssocNumber: policy(dashboard("azure:members:write"), { tokenOnly: true })
     .input(
       z.object({
-        userId: z.string(),
-        assocNumber: z.number(),
+        userId: z.string().min(1),
+        assocNumber: z.number().int().positive(),
+        notifyEmail: z.email().optional(),
       })
     )
-    .output(z.object({ error: z.nullable(z.string()) }))
-    .mutation(async ({ input }) => {
-      const { error } = await azureDirectory.setMemberNumber(input.userId, input.assocNumber)
-      return { error }
+    .output(z.object({ error: z.nullable(z.string()), notificationSent: z.nullable(z.boolean()) }))
+    .mutation(async ({ input, ctx }) => {
+      const by = auditActor(ctx.actor)
+      try {
+        const changed = await serializeMemberWrite(async () => {
+          const member = await currentMember(input.userId)
+          if (!member) return { error: "This member no longer exists in the directory." }
+          if (member.employeeId === input.assocNumber.toString())
+            return { error: `The member already has number ${input.assocNumber}.` }
+
+          const holder = await numberHolder(input.assocNumber)
+          if (holder && holder.id !== member.id) return { error: numberTaken(input.assocNumber, holder) }
+
+          const { error } = await azureDirectory.setMemberNumber(member.id, input.assocNumber)
+          if (error) {
+            logger.error({ error, by, memberId: member.id }, "[trpc:azure:members] could not set the member number")
+            return { error: "Microsoft 365 refused the change, see the backend logs." }
+          }
+          rememberNumber(member, input.assocNumber)
+          return { error: null, member }
+        })
+        if (changed.error !== null) return { error: changed.error, notificationSent: null }
+        const { member } = changed
+        logger.info(
+          {
+            by,
+            memberId: member.id,
+            from: member.employeeId,
+            to: input.assocNumber,
+            notify: Boolean(input.notifyEmail),
+          },
+          "[AZURE] member number changed"
+        )
+
+        let notificationSent: boolean | null = null
+        if (input.notifyEmail) {
+          try {
+            notificationSent = await sendMemberNumberChangedEmail(input.notifyEmail, {
+              firstName: member.givenName,
+              assocNumber: input.assocNumber,
+              previousAssocNumber: member.employeeId,
+              email: member.mail,
+            })
+          } catch (error) {
+            logger.error({ error, by, memberId: member.id }, "[AZURE] member number notification failed")
+            notificationSent = false
+          }
+        }
+        return { error: null, notificationSent }
+      } catch (error) {
+        logger.error({ error, by, userId: input.userId }, "[trpc:azure:members] error in setAssocNumber procedure")
+        return {
+          error: error instanceof Error ? error.message : "Unknown error, see backend logs",
+          notificationSent: null,
+        }
+      }
     }),
   /**
-   * The dashboard's only Azure mutation (RFC v3 §4 decision 9): create a new Entra user and add
-   * only that user to the fixed Soci group. No caller-supplied group or existing user.
+   * Create a new Entra user and add only that user to the fixed Soci group (RFC v3 §4 decision 9). No
+   * caller-supplied group or existing user. The address is `firstname.lastname` unless a custom one is chosen.
    */
   create: policy(dashboard("azure:members:create"))
     .input(
@@ -40,6 +181,7 @@ export default createTRPCRouter({
         lastName: personName,
         assocNumber: z.number().int().positive(),
         sendEmailTo: z.email(),
+        mailbox: mailboxSchema.default({ kind: "standard" }),
       })
     )
     .output(
@@ -54,23 +196,57 @@ export default createTRPCRouter({
       ])
     )
     .mutation(async ({ input, ctx }) => {
-      const by = ctx.actor?.kind === "user" ? { sub: ctx.actor.sub, client: ctx.actor.client } : { legacy: true }
+      const by = auditActor(ctx.actor)
+      const localPart = mailboxLocalPart(input.firstName, input.lastName, input.mailbox)
+      if (localPart === null) return { error: "This name cannot form a standard address: choose a custom one." }
+      const mail = `${localPart}@${MAIL_DOMAIN}`
+      if (input.sendEmailTo.toLowerCase() === mail)
+        return { error: "The welcome email cannot go to the address being created: it has no mailbox yet." }
       try {
-        const member = await azureDirectory.createMember({
-          firstName: input.firstName,
-          lastName: input.lastName,
-          assocNumber: input.assocNumber,
+        const created = await serializeMemberWrite(async () => {
+          if (await azureDirectory.findByMail(mail)) return { error: `The address ${mail} is already in use.` }
+          const holder = await numberHolder(input.assocNumber)
+          if (holder) return { error: numberTaken(input.assocNumber, holder) }
+
+          let member: CreatedMember
+          try {
+            member = await azureDirectory.createMember({
+              firstName: input.firstName,
+              lastName: input.lastName,
+              assocNumber: input.assocNumber,
+              localPart,
+            })
+          } catch (error) {
+            if (error instanceof IncompleteMemberError) rememberNumber(error.member, input.assocNumber, true)
+            throw error
+          }
+          rememberNumber(
+            {
+              id: member.id,
+              displayName: `${input.firstName} ${input.lastName}`,
+              givenName: input.firstName,
+              mail: member.mail,
+              employeeId: input.assocNumber.toString(),
+            },
+            input.assocNumber,
+            true
+          )
+          return { error: null, member }
         })
+        if (created.error !== null) return { error: created.error }
+        const { member } = created
         logger.info({ by, memberId: member.id, assocNumber: input.assocNumber }, "[AZURE] member created")
 
-        const mailOk = await sendWelcomeEmail(
-          input.sendEmailTo,
-          { email: member.mail, password: member.password },
-          {
-            firstName: input.firstName,
-            assocNumber: input.assocNumber,
-          }
-        )
+        let mailOk = false
+        try {
+          mailOk = await sendWelcomeEmail(
+            input.sendEmailTo,
+            { email: member.mail, password: member.password },
+            { firstName: input.firstName, assocNumber: input.assocNumber }
+          )
+        } catch (error) {
+          logger.error({ error, by, memberId: member.id }, "[AZURE] welcome email failed")
+        }
 
         return {
           error: null,
@@ -79,7 +255,12 @@ export default createTRPCRouter({
           welcomeMailSent: mailOk,
         }
       } catch (error) {
+        if (error instanceof IncompleteMemberError) {
+          logger.error({ error: error.cause, by, memberId: error.member.id }, "[AZURE] member setup incomplete")
+          return { error: error.message }
+        }
         logger.error({ error, by, assocNumber: input.assocNumber }, "[trpc:azure:members] error in create procedure")
+        if (isAddressConflict(error)) return { error: `The address ${mail} is already in use.` }
         return { error: error instanceof Error ? error.message : "Unknown error, see backend logs" }
       }
     }),
diff --git a/tests/azure-directory.test.ts b/tests/azure-directory.test.ts
new file mode 100644
index 0000000..51d88a2
--- /dev/null
+++ b/tests/azure-directory.test.ts
@@ -0,0 +1,212 @@
+import { beforeEach, describe, expect, it, vi } from "vitest"
+
+const graph = vi.hoisted(() => ({ getAzureClient: vi.fn() }))
+const PASSWORD = "private-generated-password"
+
+vi.mock("@/azure/client", () => graph)
+vi.mock("@/logger", () => ({ logger: { debug: vi.fn(), info: vi.fn(), error: vi.fn() } }))
+vi.mock("@/utils/password", () => ({ generatePassword: () => "private-generated-password" }))
+vi.mock("@/utils/wait", () => ({ withRetry: (task: () => Promise<unknown>) => task() }))
+
+import { createMember, findByMemberNumber, getMembers } from "@/azure/functions/members"
+
+const SOCI_ID = "1c68dbb8-4ac3-4569-a886-283b5a825cbd"
+const CREATED_ID = "created-katherine"
+const CREATED_MAIL = "katherine.johnson@polinetwork.org"
+const NEW_MEMBER = { firstName: "Katherine", lastName: "Johnson", assocNumber: 2042, localPart: "katherine.johnson" }
+
+type GraphUser = {
+  id: string
+  displayName: string
+  mail: string
+  givenName: string
+  surname: string
+  employeeId: string
+  assignedLicenses: { skuId: string }[]
+}
+
+function user(id: string, employeeId: string): GraphUser {
+  return {
+    id,
+    displayName: id,
+    mail: `${id}@polinetwork.org`,
+    givenName: id,
+    surname: "Member",
+    employeeId,
+    assignedLicenses: [],
+  }
+}
+
+function fakeGraph(
+  options: { failGroup?: boolean; failLicenses?: boolean; failCleanup?: boolean; cleanupNotFound?: boolean } = {}
+) {
+  const users = new Map<string, GraphUser>([["existing-user", user("existing-user", "1001")]])
+  const soci = new Set<string>(["existing-user"])
+  const deleted = new Set<string>()
+  const userPageTwo = "https://graph.microsoft.com/v1.0/users?$skiptoken=users-page-two"
+  const groupPageTwo = `https://graph.microsoft.com/v1.0/groups/${SOCI_ID}/members?$skiptoken=group-page-two`
+  let pages = false
+
+  const client = {
+    api(resource: string) {
+      const url = new URL(resource, "https://graph.microsoft.com/v1.0/")
+      const path = url.pathname.replace(/^\/v1\.0/, "")
+      let advanced = false
+      let filter = ""
+      const request = {
+        header(name: string, value: string) {
+          if (name === "ConsistencyLevel" && value === "eventual") advanced = true
+          return request
+        },
+        count(enabled: boolean) {
+          if (enabled) advanced = true
+          return request
+        },
+        select() {
+          return request
+        },
+        filter(value: string) {
+          filter = value
+          return request
+        },
+        top() {
+          return request
+        },
+        async get() {
+          if (path === "/users" && filter.startsWith("employeeId eq ")) {
+            const employeeId = filter.match(/^employeeId eq '([^']+)'$/)?.[1]
+            return { value: advanced ? [] : [...users.values()].filter((member) => member.employeeId === employeeId) }
+          }
+          if (path === "/users") {
+            if (pages) {
+              if (url.searchParams.has("$skiptoken") && !advanced) throw new Error("Advanced query header missing")
+              return url.searchParams.has("$skiptoken")
+                ? { value: [user("second-page-user", "2043")] }
+                : { value: [users.get("existing-user")], "@odata.nextLink": userPageTwo }
+            }
+            return { value: [...users.values()] }
+          }
+          if (path === `/groups/${SOCI_ID}/members`) {
+            if (pages) {
+              return url.searchParams.has("$skiptoken")
+                ? { value: [{ id: "existing-user" }, { id: "second-page-user" }] }
+                : { value: [{ id: "unlisted-user" }], "@odata.nextLink": groupPageTwo }
+            }
+            return { value: [...soci].map((id) => ({ id })) }
+          }
+          if (path.startsWith("/users/")) return users.get(path.slice("/users/".length))
+          throw new Error(`Unexpected Graph read: ${resource}`)
+        },
+        async post(body: Record<string, unknown>) {
+          if (path === "/users") {
+            users.set(CREATED_ID, {
+              ...user(CREATED_ID, typeof body.employeeId === "string" ? body.employeeId : ""),
+              displayName: String(body.displayName),
+              mail: String(body.userPrincipalName),
+            })
+            return { id: CREATED_ID }
+          }
+          if (path === `/groups/${SOCI_ID}/members/$ref`) {
+            if (options.failGroup) throw new Error("Group membership unavailable")
+            const id = String(body["@odata.id"]).split("/").at(-1)
+            if (id) soci.add(id)
+            return undefined
+          }
+          if (path === `/users/${CREATED_ID}/assignLicense`) {
+            if (options.failLicenses) throw new Error("License assignment unavailable")
+            return undefined
+          }
+          throw new Error(`Unexpected Graph write: ${resource}`)
+        },
+        async patch(body: Partial<GraphUser>) {
+          const id = path.slice("/users/".length)
+          const member = users.get(id)
+          if (!member) throw new Error("User does not exist")
+          users.set(id, { ...member, ...body })
+        },
+        async delete() {
+          if (options.failCleanup) throw new Error("Cleanup unavailable")
+          const id = path.slice("/users/".length)
+          users.delete(id)
+          soci.delete(id)
+          deleted.add(id)
+          if (options.cleanupNotFound) throw Object.assign(new Error("User no longer exists"), { statusCode: 404 })
+        },
+      }
+      return request
+    },
+  }
+  graph.getAzureClient.mockReturnValue(client)
+  return {
+    users,
+    soci,
+    deleted,
+    paginate() {
+      pages = true
+    },
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe("Azure member directory Graph operations", () => {
+  it("includes subsequent user and Soci membership pages", async () => {
+    const directory = fakeGraph()
+    directory.paginate()
+
+    const members = await getMembers()
+
+    expect(members.map((member) => member.id)).toEqual(["existing-user", "second-page-user"])
+    expect(members.every((member) => member.isMember)).toBe(true)
+  })
+
+  it.each([
+    ["group membership", { failGroup: true }, "Group membership unavailable"],
+    ["license assignment", { failLicenses: true }, "License assignment unavailable"],
+  ])("removes only the newly created account when %s fails", async (_, failure, error) => {
+    const directory = fakeGraph(failure)
+
+    await expect(createMember(NEW_MEMBER)).rejects.toThrow(error)
+
+    expect([...directory.users.keys()]).toEqual(["existing-user"])
+    expect([...directory.soci]).toEqual(["existing-user"])
+    expect([...directory.deleted]).toEqual([CREATED_ID])
+  })
+
+  it("treats an already absent account as successful cleanup and preserves the provisioning error", async () => {
+    const directory = fakeGraph({ failGroup: true, cleanupNotFound: true })
+
+    await expect(createMember(NEW_MEMBER)).rejects.toThrow("Group membership unavailable")
+
+    expect([...directory.users.keys()]).toEqual(["existing-user"])
+    expect([...directory.soci]).toEqual(["existing-user"])
+    expect([...directory.deleted]).toEqual([CREATED_ID])
+  })
+
+  it("identifies an incomplete account without exposing its password when cleanup also fails", async () => {
+    const directory = fakeGraph({ failGroup: true, failCleanup: true })
+    const result = await createMember(NEW_MEMBER).then(
+      () => ({ message: "Unexpected success" }),
+      (error: Error) => error
+    )
+
+    expect(result.message).toContain(CREATED_ID)
+    expect(result.message).toContain(CREATED_MAIL)
+    expect(result.message).not.toContain(PASSWORD)
+    expect(directory.users.get(CREATED_ID)?.mail).toBe(CREATED_MAIL)
+    expect(directory.users.has("existing-user")).toBe(true)
+    expect(directory.deleted.size).toBe(0)
+  })
+
+  it("finds the current number holder even while the advanced query index is stale", async () => {
+    const directory = fakeGraph()
+    directory.users.set("fresh-number-holder", user("fresh-number-holder", "2042"))
+
+    await expect(findByMemberNumber(2042)).resolves.toMatchObject({
+      id: "fresh-number-holder",
+      employeeId: "2042",
+    })
+  })
+})
diff --git a/tests/azure-router.test.ts b/tests/azure-router.test.ts
index 70071a4..f50edfc 100644
--- a/tests/azure-router.test.ts
+++ b/tests/azure-router.test.ts
@@ -2,10 +2,13 @@ import type { Actor } from "@polinetwork/auth-kit"
 import { beforeEach, describe, expect, it, vi } from "vitest"
 import type { Context } from "@/trpc"
 
-vi.mock("@/emails/mailer", () => ({
+const mailer = vi.hoisted(() => ({
   sendWelcomeEmail: vi.fn().mockResolvedValue(true),
+  sendMemberNumberChangedEmail: vi.fn().mockResolvedValue(true),
 }))
 
+vi.mock("@/emails/mailer", () => mailer)
+
 const REQUIRED_ENV: Record<string, string> = {
   NODE_ENV: "test",
   BETTER_AUTH_SECRET: "test-secret-with-at-least-thirty-two-characters",
@@ -28,11 +31,59 @@ async function createCaller(context: Context = {}) {
   return azureRouter.createCaller(context)
 }
 
+/** Widens the gap between the duplicate check and the write, as a slow Graph call would. */
+async function slowNumberLookups() {
+  const { azureDirectory } = await import("@/azure/directory")
+  const find = azureDirectory.findByMemberNumber
+  vi.spyOn(azureDirectory, "findByMemberNumber").mockImplementation(async (assocNumber) => {
+    const found = await find(assocNumber)
+    await new Promise((resolve) => setTimeout(resolve, 20))
+    return found
+  })
+}
+
 beforeEach(() => {
   vi.clearAllMocks()
 })
 
 describe("Azure tRPC routes without credentials", () => {
+  it("reserves the number of an incomplete account while directory searches are stale", async () => {
+    const caller = await createCaller()
+    const { azureDirectory } = await import("@/azure/directory")
+    const { IncompleteMemberError } = await import("@/azure/errors")
+    const create = azureDirectory.createMember
+    let creating!: () => void
+    const firstCreateStarted = new Promise<void>((resolve) => {
+      creating = resolve
+    })
+    vi.spyOn(azureDirectory, "createMember").mockImplementationOnce(async (input) => {
+      creating()
+      const member = await create(input)
+      throw new IncompleteMemberError(
+        {
+          id: member.id,
+          displayName: "Katherine Johnson",
+          givenName: "Katherine",
+          mail: member.mail,
+          employeeId: "2042",
+        },
+        new Error("Setup failed")
+      )
+    })
+    vi.spyOn(azureDirectory, "findByMemberNumber").mockResolvedValue(null)
+    const input = { firstName: "Katherine", lastName: "Johnson", assocNumber: 2042, sendEmailTo: "test@example.com" }
+
+    // The second request must queue behind the first, whose mock is the one that fails.
+    const first = caller.members.create(input)
+    await firstCreateStarted
+    const second = caller.members.create({ ...input, firstName: "Mary" })
+    const results = await Promise.all([first, second])
+
+    expect(results[0]?.error).toContain("setup and cleanup failed")
+    expect(results[1]?.error).toContain("Member number 2042 is already assigned")
+    expect((await caller.members.getAll()).filter((member) => member.employeeId === "2042")).toHaveLength(1)
+    expect(mailer.sendWelcomeEmail).not.toHaveBeenCalled()
+  })
   it("returns linked seed data for members and groups", async () => {
     const caller = await createCaller()
 
@@ -47,18 +98,31 @@ describe("Azure tRPC routes without credentials", () => {
     )
   })
 
-  it("updates a member number", async () => {
+  it("creates a member and exposes it in later reads", async () => {
     const caller = await createCaller()
 
-    await expect(caller.members.setAssocNumber({ userId: "mock-member-grace", assocNumber: 2042 })).resolves.toEqual({
-      error: null,
+    const result = await caller.members.create({
+      firstName: "Katherine",
+      lastName: "Johnson",
+      assocNumber: 2043,
+      sendEmailTo: "developer@example.com",
     })
 
-    const members = await caller.members.getAll()
-    expect(members.find((member) => member.id === "mock-member-grace")?.employeeId).toBe("2042")
+    expect(result).toMatchObject({
+      error: null,
+      email: "katherine.johnson@polinetwork.org",
+      welcomeMailSent: true,
+    })
+    if (result.error !== null) throw new Error(result.error)
+    expect((await caller.members.getAll()).find((member) => member.id === result.id)).toMatchObject({
+      displayName: "Katherine Johnson",
+      employeeId: "2043",
+      isMember: true,
+    })
   })
 
-  it("creates a member and exposes it in later reads", async () => {
+  it("returns the created member when sending the welcome email throws", async () => {
+    mailer.sendWelcomeEmail.mockRejectedValueOnce(new Error("Email rendering failed"))
     const caller = await createCaller()
 
     const result = await caller.members.create({
@@ -71,14 +135,137 @@ describe("Azure tRPC routes without credentials", () => {
     expect(result).toMatchObject({
       error: null,
       email: "katherine.johnson@polinetwork.org",
-      welcomeMailSent: true,
+      welcomeMailSent: false,
     })
     if (result.error !== null) throw new Error(result.error)
     expect((await caller.members.getAll()).find((member) => member.id === result.id)).toMatchObject({
-      displayName: "Katherine Johnson",
       employeeId: "2043",
-      isMember: true,
+      mail: result.email,
+    })
+  })
+
+  it("creates a member at a custom address", async () => {
+    const caller = await createCaller()
+
+    const result = await caller.members.create({
+      firstName: "Katherine",
+      lastName: "Johnson",
+      assocNumber: 2043,
+      sendEmailTo: "developer@example.com",
+      mailbox: { kind: "custom", localPart: "K.Johnson" },
+    })
+
+    expect(result).toMatchObject({ error: null, email: "k.johnson@polinetwork.org" })
+  })
+
+  it("builds the standard address without accents, apostrophes or spaces", async () => {
+    const caller = await createCaller()
+
+    const result = await caller.members.create({
+      firstName: "Maria Chiara",
+      lastName: "D'Amicò",
+      assocNumber: 2043,
+      sendEmailTo: "developer@example.com",
+      mailbox: { kind: "standard" },
     })
+
+    expect(result).toMatchObject({ error: null, email: "mariachiara.damico@polinetwork.org" })
+  })
+
+  it.each([
+    [
+      "an address already in use",
+      { mailbox: { kind: "custom", localPart: "ada.lovelace" } },
+      "The address ada.lovelace@polinetwork.org is already in use.",
+    ],
+    [
+      "a member number already assigned",
+      { assocNumber: 1001 },
+      "Member number 1001 is already assigned to Ada Lovelace.",
+    ],
+    [
+      "a welcome email to the address being created",
+      { sendEmailTo: "Katherine.Johnson@polinetwork.org" },
+      "The welcome email cannot go to the address being created: it has no mailbox yet.",
+    ],
+    [
+      "a name without a standard address",
+      { firstName: "Łukasz" },
+      "This name cannot form a standard address: choose a custom one.",
+    ],
+  ] as const)("refuses to create a member with %s", async (_, override, error) => {
+    const caller = await createCaller()
+
+    const result = await caller.members.create({
+      firstName: "Katherine",
+      lastName: "Johnson",
+      assocNumber: 2043,
+      sendEmailTo: "developer@example.com",
+      ...override,
+    })
+
+    expect(result).toEqual({ error })
+    expect(mailer.sendWelcomeEmail).not.toHaveBeenCalled()
+  })
+
+  it("lets only one of two concurrent creations take the same number", async () => {
+    const caller = await createCaller()
+    await slowNumberLookups()
+    const member = (firstName: string) => ({
+      firstName,
+      lastName: "Johnson",
+      assocNumber: 2043,
+      sendEmailTo: "developer@example.com",
+    })
+
+    const results = await Promise.all([
+      caller.members.create(member("Katherine")),
+      caller.members.create(member("Mary")),
+    ])
+
+    expect(results.filter((result) => result.error === null)).toHaveLength(1)
+    expect(results.map((result) => result.error)).toContainEqual(
+      expect.stringMatching(/^Member number 2043 is already assigned to (Katherine|Mary) Johnson\.$/)
+    )
+  })
+
+  it("reports an address Entra refuses as already in use", async () => {
+    const caller = await createCaller()
+    const { azureDirectory } = await import("@/azure/directory")
+    vi.spyOn(azureDirectory, "createMember").mockRejectedValueOnce(
+      new Error("Another object with the same value for property proxyAddresses already exists.")
+    )
+
+    await expect(
+      caller.members.create({
+        firstName: "Katherine",
+        lastName: "Johnson",
+        assocNumber: 2043,
+        sendEmailTo: "developer@example.com",
+      })
+    ).resolves.toEqual({ error: "The address katherine.johnson@polinetwork.org is already in use." })
+  })
+
+  it("refuses an invalid custom address", async () => {
+    const caller = await createCaller()
+
+    await expect(
+      caller.members.create({
+        firstName: "Katherine",
+        lastName: "Johnson",
+        assocNumber: 2043,
+        sendEmailTo: "developer@example.com",
+        mailbox: { kind: "custom", localPart: "k johnson@polinetwork.org" },
+      })
+    ).rejects.toMatchObject({ code: "BAD_REQUEST" })
+  })
+
+  it("refuses anonymous member number changes", async () => {
+    const caller = await createCaller()
+
+    await expect(
+      caller.members.setAssocNumber({ userId: "mock-member-grace", assocNumber: 2042 })
+    ).rejects.toMatchObject({ code: "UNAUTHORIZED" })
   })
 
   it("adds and removes group memberships", async () => {
@@ -148,7 +335,7 @@ describe("Azure directory token authorization", () => {
     await expect(caller.members.getAll()).rejects.toMatchObject({ code: "FORBIDDEN" })
   })
 
-  it("keeps existing-user and group changes unavailable even with both member permissions", async () => {
+  it("keeps member number and group changes unavailable with only read and create", async () => {
     const caller = await createCaller(tokenContext(["azure:members:read", "azure:members:create"]))
     await expect(
       caller.members.setAssocNumber({ userId: "mock-member-grace", assocNumber: 2042 })
@@ -165,6 +352,311 @@ describe("Azure directory token authorization", () => {
   })
 })
 
+describe("Azure member number changes", () => {
+  const writer = () => createCaller(tokenContext(["azure:members:read", "azure:members:write"]))
+
+  it("uses a different external number even before the previous write has been observed", async () => {
+    const caller = await writer()
+    const { azureDirectory } = await import("@/azure/directory")
+    const before = await azureDirectory.getMember("mock-member-alan")
+    const read = vi.spyOn(azureDirectory, "getMember").mockResolvedValue(before)
+    await caller.members.setAssocNumber({ userId: "mock-member-alan", assocNumber: 2042 })
+    read.mockRestore()
+    await azureDirectory.setMemberNumber("mock-member-alan", 2043)
+
+    await caller.members.setAssocNumber({
+      userId: "mock-member-alan",
+      assocNumber: 2044,
+      notifyEmail: "alan@example.com",
+    })
+
+    expect(mailer.sendMemberNumberChangedEmail).toHaveBeenCalledWith(
+      "alan@example.com",
+      expect.objectContaining({ previousAssocNumber: "2043", assocNumber: 2044 })
+    )
+  })
+
+  it("refuses to change an existing user deleted before a saved write was observed", async () => {
+    const caller = await writer()
+    const { azureDirectory } = await import("@/azure/directory")
+    await caller.members.setAssocNumber({ userId: "mock-member-alan", assocNumber: 2042 })
+    vi.spyOn(azureDirectory, "getMember").mockResolvedValue(null)
+    const write = vi.spyOn(azureDirectory, "setMemberNumber")
+
+    await expect(caller.members.setAssocNumber({ userId: "mock-member-alan", assocNumber: 2043 })).resolves.toEqual({
+      error: "This member no longer exists in the directory.",
+      notificationSent: null,
+    })
+    expect(write).not.toHaveBeenCalled()
+  })
+
+  it("changes the number and emails the member", async () => {
+    const caller = await writer()
+
+    await expect(
+      caller.members.setAssocNumber({ userId: "mock-member-alan", assocNumber: 2042, notifyEmail: "alan@example.com" })
+    ).resolves.toEqual({ error: null, notificationSent: true })
+
+    expect((await caller.members.getAll()).find((member) => member.id === "mock-member-alan")?.employeeId).toBe("2042")
+    expect(mailer.sendMemberNumberChangedEmail).toHaveBeenCalledWith("alan@example.com", {
+      firstName: "Alan",
+      assocNumber: 2042,
+      previousAssocNumber: "1002",
+      email: "alan.turing@polinetwork.org",
+    })
+  })
+
+  it("changes the number without a notification", async () => {
+    const caller = await writer()
+
+    await expect(caller.members.setAssocNumber({ userId: "mock-member-grace", assocNumber: 2042 })).resolves.toEqual({
+      error: null,
+      notificationSent: null,
+    })
+    expect(mailer.sendMemberNumberChangedEmail).not.toHaveBeenCalled()
+  })
+
+  it("reports a failed notification after a saved change", async () => {
+    mailer.sendMemberNumberChangedEmail.mockResolvedValueOnce(false)
+    const caller = await writer()
+
+    await expect(
+      caller.members.setAssocNumber({ userId: "mock-member-grace", assocNumber: 2042, notifyEmail: "g@example.com" })
+    ).resolves.toEqual({ error: null, notificationSent: false })
+    expect((await caller.members.getAll()).find((member) => member.id === "mock-member-grace")?.employeeId).toBe("2042")
+  })
+
+  it("keeps a saved number change successful when sending its notification throws", async () => {
+    mailer.sendMemberNumberChangedEmail.mockRejectedValueOnce(new Error("Email rendering failed"))
+    const caller = await writer()
+
+    await expect(
+      caller.members.setAssocNumber({ userId: "mock-member-grace", assocNumber: 2042, notifyEmail: "g@example.com" })
+    ).resolves.toEqual({ error: null, notificationSent: false })
+    expect((await caller.members.getAll()).find((member) => member.id === "mock-member-grace")?.employeeId).toBe("2042")
+  })
+
+  it.each([
+    "changes",
+    "creations",
+    "create then change",
+    "change then create",
+  ] as const)("allows only one claimant during concurrent %s while number lookups are stale", async (scenario) => {
+    const caller = await createCaller(
+      tokenContext(["azure:members:read", "azure:members:write", "azure:members:create"])
+    )
+    const { azureDirectory } = await import("@/azure/directory")
+    vi.spyOn(azureDirectory, "findByMemberNumber").mockResolvedValue(null)
+    const create = (firstName: string) =>
+      caller.members.create({
+        firstName,
+        lastName: "Johnson",
+        assocNumber: 2042,
+        sendEmailTo: "developer@example.com",
+      })
+    const change = (userId: string) => caller.members.setAssocNumber({ userId, assocNumber: 2042 })
+    const operations = {
+      changes: () => [change("mock-member-grace"), change("mock-member-alan")],
+      creations: () => [create("Katherine"), create("Mary")],
+      "create then change": () => [create("Katherine"), change("mock-member-grace")],
+      "change then create": () => [change("mock-member-grace"), create("Katherine")],
+    }
+
+    const results = await Promise.all(operations[scenario]())
+
+    expect(results.filter((result) => result.error === null)).toHaveLength(1)
+    expect(results.map((result) => result.error)).toContainEqual(
+      expect.stringMatching(/^Member number 2042 is already assigned to /)
+    )
+    expect((await caller.members.getAll()).filter((member) => member.employeeId === "2042")).toHaveLength(1)
+  })
+
+  it("keeps the latest number reserved across successive writes while the member read still shows the original number", async () => {
+    const caller = await writer()
+    const { azureDirectory } = await import("@/azure/directory")
+    const originalMember = await azureDirectory.getMember("mock-member-alan")
+    const currentGet = azureDirectory.getMember
+    vi.spyOn(azureDirectory, "getMember").mockImplementation((userId) =>
+      userId === "mock-member-alan" ? Promise.resolve(originalMember) : currentGet(userId)
+    )
+    vi.spyOn(azureDirectory, "findByMemberNumber").mockResolvedValue(null)
+
+    for (const assocNumber of [2042, 2043]) {
+      await expect(
+        caller.members.setAssocNumber({ userId: "mock-member-alan", assocNumber, notifyEmail: "alan@example.com" })
+      ).resolves.toEqual({ error: null, notificationSent: true })
+    }
+    await expect(caller.members.setAssocNumber({ userId: "mock-member-grace", assocNumber: 2043 })).resolves.toEqual({
+      error: "Member number 2043 is already assigned to Alan Turing.",
+      notificationSent: null,
+    })
+    await expect(
+      caller.members.setAssocNumber({ userId: "mock-member-alan", assocNumber: 2043, notifyEmail: "alan@example.com" })
+    ).resolves.toEqual({ error: "The member already has number 2043.", notificationSent: null })
+
+    expect((await caller.members.getAll()).filter((member) => member.employeeId === "2043")).toHaveLength(1)
+    expect(mailer.sendMemberNumberChangedEmail).toHaveBeenCalledTimes(2)
+    expect(mailer.sendMemberNumberChangedEmail).toHaveBeenLastCalledWith(
+      "alan@example.com",
+      expect.objectContaining({ assocNumber: 2043, previousAssocNumber: "2042" })
+    )
+  })
+
+  it("does not repeat a saved change or its email while the member read is stale", async () => {
+    const caller = await writer()
+    const { azureDirectory } = await import("@/azure/directory")
+    const originalMember = await azureDirectory.getMember("mock-member-alan")
+    vi.spyOn(azureDirectory, "getMember").mockResolvedValue(originalMember)
+    const write = vi.spyOn(azureDirectory, "setMemberNumber")
+    const input = { userId: "mock-member-alan", assocNumber: 2042, notifyEmail: "alan@example.com" }
+
+    await expect(caller.members.setAssocNumber(input)).resolves.toEqual({ error: null, notificationSent: true })
+    await expect(caller.members.setAssocNumber(input)).resolves.toEqual({
+      error: "The member already has number 2042.",
+      notificationSent: null,
+    })
+
+    expect(write).toHaveBeenCalledTimes(1)
+    expect(mailer.sendMemberNumberChangedEmail).toHaveBeenCalledTimes(1)
+    expect((await caller.members.getAll()).find((member) => member.id === input.userId)?.employeeId).toBe("2042")
+  })
+
+  it("does not repeat a change when number lookup confirms it before the member read does", async () => {
+    const caller = await writer()
+    const { azureDirectory } = await import("@/azure/directory")
+    const originalMember = await azureDirectory.getMember("mock-member-alan")
+    const currentGet = azureDirectory.getMember
+    vi.spyOn(azureDirectory, "getMember").mockImplementation((userId) =>
+      userId === "mock-member-alan" ? Promise.resolve(originalMember) : currentGet(userId)
+    )
+    const write = vi.spyOn(azureDirectory, "setMemberNumber")
+    const input = { userId: "mock-member-alan", assocNumber: 2042, notifyEmail: "alan@example.com" }
+
+    await expect(caller.members.setAssocNumber(input)).resolves.toEqual({ error: null, notificationSent: true })
+    await expect(caller.members.setAssocNumber({ userId: "mock-member-grace", assocNumber: 2042 })).resolves.toEqual({
+      error: "Member number 2042 is already assigned to Alan Turing.",
+      notificationSent: null,
+    })
+    await expect(caller.members.setAssocNumber(input)).resolves.toEqual({
+      error: "The member already has number 2042.",
+      notificationSent: null,
+    })
+
+    expect(write).toHaveBeenCalledTimes(1)
+    expect(mailer.sendMemberNumberChangedEmail).toHaveBeenCalledTimes(1)
+    expect((await caller.members.getAll()).find((member) => member.id === input.userId)?.employeeId).toBe("2042")
+  })
+
+  it("uses a subsequent external number change after the member read has confirmed a saved change", async () => {
+    const caller = await writer()
+    const { azureDirectory } = await import("@/azure/directory")
+    vi.spyOn(azureDirectory, "findByMemberNumber").mockResolvedValue(null)
+
+    await expect(caller.members.setAssocNumber({ userId: "mock-member-alan", assocNumber: 2042 })).resolves.toEqual({
+      error: null,
+      notificationSent: null,
+    })
+    await expect(caller.members.setAssocNumber({ userId: "mock-member-alan", assocNumber: 2042 })).resolves.toEqual({
+      error: "The member already has number 2042.",
+      notificationSent: null,
+    })
+    await azureDirectory.setMemberNumber("mock-member-alan", 2043)
+    await expect(
+      caller.members.setAssocNumber({ userId: "mock-member-alan", assocNumber: 2044, notifyEmail: "alan@example.com" })
+    ).resolves.toEqual({ error: null, notificationSent: true })
+
+    expect(mailer.sendMemberNumberChangedEmail).toHaveBeenCalledWith("alan@example.com", {
+      firstName: "Alan",
+      assocNumber: 2044,
+      previousAssocNumber: "2043",
+      email: "alan.turing@polinetwork.org",
+    })
+    expect((await caller.members.getAll()).find((member) => member.id === "mock-member-alan")?.employeeId).toBe("2044")
+  })
+
+  it("allows a released number to be reassigned after the previous holder changes it again", async () => {
+    const caller = await writer()
+    const { azureDirectory } = await import("@/azure/directory")
+    const currentFind = azureDirectory.findByMemberNumber
+    const lookup = vi.spyOn(azureDirectory, "findByMemberNumber").mockResolvedValue(null)
+
+    await expect(caller.members.setAssocNumber({ userId: "mock-member-alan", assocNumber: 2042 })).resolves.toEqual({
+      error: null,
+      notificationSent: null,
+    })
+    await expect(caller.members.setAssocNumber({ userId: "mock-member-alan", assocNumber: 2043 })).resolves.toEqual({
+      error: null,
+      notificationSent: null,
+    })
+    lookup.mockImplementation(currentFind)
+    await expect(caller.members.setAssocNumber({ userId: "mock-member-grace", assocNumber: 2042 })).resolves.toEqual({
+      error: null,
+      notificationSent: null,
+    })
+
+    const members = await caller.members.getAll()
+    expect(members.find((member) => member.id === "mock-member-alan")?.employeeId).toBe("2043")
+    expect(members.find((member) => member.id === "mock-member-grace")?.employeeId).toBe("2042")
+  })
+
+  it.each([
+    [
+      "a number another member holds",
+      { userId: "mock-member-grace", assocNumber: 1001 },
+      "Member number 1001 is already assigned to Ada Lovelace.",
+    ],
+    ["the current number", { userId: "mock-member-ada", assocNumber: 1001 }, "The member already has number 1001."],
+    [
+      "an unknown member",
+      { userId: "mock-member-nobody", assocNumber: 2042 },
+      "This member no longer exists in the directory.",
+    ],
+  ])("refuses %s", async (_, input, error) => {
+    const caller = await writer()
+
+    await expect(caller.members.setAssocNumber({ ...input, notifyEmail: "x@example.com" })).resolves.toEqual({
+      error,
+      notificationSent: null,
+    })
+    expect(mailer.sendMemberNumberChangedEmail).not.toHaveBeenCalled()
+  })
+
+  it("lets only one of two concurrent changes take the same number", async () => {
+    const caller = await writer()
+    await slowNumberLookups()
+
+    const results = await Promise.all([
+      caller.members.setAssocNumber({ userId: "mock-member-grace", assocNumber: 2042 }),
+      caller.members.setAssocNumber({ userId: "mock-member-alan", assocNumber: 2042 }),
+    ])
+
+    expect(results.filter((result) => result.error === null)).toHaveLength(1)
+    const members = await caller.members.getAll()
+    expect(members.filter((member) => member.employeeId === "2042")).toHaveLength(1)
+  })
+
+  it("refuses a non-positive number", async () => {
+    const caller = await writer()
+    await expect(caller.members.setAssocNumber({ userId: "mock-member-grace", assocNumber: 0 })).rejects.toMatchObject({
+      code: "BAD_REQUEST",
+    })
+  })
+
+  it.each([
+    ["read and create alone", tokenContext(["azure:members:read", "azure:members:create"])],
+    ["no admin scope", tokenContext(["azure:members:write"], undefined, [])],
+    ["stale snapshot", tokenContext(["azure:members:write"], undefined, undefined, false)],
+    ["service actor", tokenContext(["azure:members:write"], { kind: "service", client: "telegram-bot" })],
+  ])("refuses changes with %s", async (_, context) => {
+    const caller = await createCaller(context)
+    await expect(
+      caller.members.setAssocNumber({ userId: "mock-member-grace", assocNumber: 2042 })
+    ).rejects.toMatchObject({
+      code: "FORBIDDEN",
+    })
+  })
+})
+
 describe("Azure group token authorization", () => {
   const membership = { groupId: "mock-group-empty", userId: "mock-member-grace" }
 
diff --git a/tests/esign-service.test.ts b/tests/esign-service.test.ts
index 1617153..22027a4 100644
--- a/tests/esign-service.test.ts
+++ b/tests/esign-service.test.ts
@@ -29,7 +29,7 @@ function setup(
     directory?: () => Promise<{ sub: string; name: string; email: string | null }[]>
   } = {}
 ) {
-  let clock = new Date("2026-10-17T10:00:00Z").getTime()
+  let clock = Date.now()
   const store = createMemoryStore()
   const drive = createMockDrive()
   const archive = createMockDrive({ id: "archive", label: "Archive" })
diff --git a/tests/idp-router.test.ts b/tests/idp-router.test.ts
index 52d18a1..7326225 100644
--- a/tests/idp-router.test.ts
+++ b/tests/idp-router.test.ts
@@ -101,6 +101,10 @@ describe("app router", () => {
     expect(policyOf("azure.members.create")?.policy).toEqual({
       user: { scope: "backend:admin", permission: "azure:members:create" },
     })
+    expect(policyOf("azure.members.setAssocNumber")).toMatchObject({
+      policy: { user: { scope: "backend:admin", permission: "azure:members:write" } },
+      tokenOnly: true,
+    })
     expect(policyOf("azure.groups.getAll")?.policy).toEqual({
       user: { scope: "backend:admin", permission: "azure:groups:read" },
     })
@@ -119,13 +123,7 @@ describe("app router", () => {
         .filter(([, procedure]) => procedure._def.meta?.policy === "legacy")
         .map(([path]) => path)
     )
-    for (const path of [
-      "auth.updateProfilePic",
-      "test.dbQuery",
-      "tg.permissions.addRole",
-      "tg.link.link",
-      "azure.members.setAssocNumber",
-    ])
+    for (const path of ["auth.updateProfilePic", "test.dbQuery", "tg.permissions.addRole", "tg.link.link"])
       expect(legacy).toContain(path)
   })