Module 1: Managing Entra ID Users and Groups

A year into running everything on Azure, Rohan's firm had grown past the point where he could keep managing accounts himself between client meetings. They hired a part-time administrator, someone who knew Azure conceptually from AZ-900 study but had never actually created a user account, organized a group, or set up access at scale. Her first week was this module, in practice.

Creating and managing users, beyond the theory

Creating a user in Entra ID means more than a name and password: setting a usage location (required before licenses can be assigned), choosing between a cloud-only account or one synced from an on-premises directory, and deciding group memberships at creation time rather than as an afterthought. For more than a handful of people, bulk operations, importing users from a CSV file, matters, doing this one at a time doesn't scale past a small handful of hires.

Security groups vs. Microsoft 365 groups

Entra ID has two group types that get confused constantly: a security group exists purely to manage access, permissions to a resource, membership in a role, nothing more. A Microsoft 365 group is broader, it also provisions a shared mailbox, a calendar, and a Teams presence, meant for actual collaboration, not just access control. Rohan's new admin needed security groups for scoping Azure resource access (Module 6's resource groups from AZ-900, now actually configured), and Microsoft 365 groups for the project teams that needed shared inboxes and calendars.

Dynamic groups: membership that maintains itself

A dynamic group defines membership by rule rather than manual assignment, "every user in the Sales department," for instance, automatically adding and removing members as their attributes change, without anyone manually updating a list. This trades a little setup complexity for membership that never silently goes stale, exactly the kind of thing worth setting up once for a group that changes often, like department-based access.

Check your understanding

1. What must typically be set on a user account before a license can be assigned?

A phone number A usage location A profile photo A manager

2. What is the main advantage of bulk user creation over creating accounts one at a time?

It is required by Entra ID It scales to onboarding many users at once, rather than a slow manual process per person It automatically assigns licenses It removes the need for usage locations

3. What is the key difference between a security group and a Microsoft 365 group?

They are identical in every way A security group manages access only; a Microsoft 365 group also provisions a mailbox, calendar, and Teams presence for collaboration Security groups can only contain devices Microsoft 365 groups cannot be used for access control

4. What defines membership in a dynamic group?

Manual addition by an administrator each time A rule based on user or device attributes, updated automatically as those attributes change A fixed list that never changes Random assignment

5. Why might Rohan's admin choose a dynamic group for department-based access?

Dynamic groups are always faster to create Membership stays current automatically as people join or leave the department, without manual upkeep Dynamic groups cannot be used for security purposes Static groups are not supported in Entra ID

Rohan's firm finally hires an actual administrator

Creating and managing users, beyond the theory

Security groups vs. Microsoft 365 groups

Dynamic groups: membership that maintains itself

Check your understanding