Manage Azure Identities and Governance · Topic 1 of 4
Microsoft Entra Users and Groups
AZ-104 Entra ID: create users and groups, dynamic membership, licenses, guest and external users, collaboration restrictions and self-service password reset.
- 5 min
- Security groups give access. Microsoft 365 groups are for collaboration.
- Dynamic membership uses rules and needs Entra ID P1. Assigned membership is manual.
- A user needs a usage location before a license can be assigned.
What it is
Microsoft Entra ID is the directory behind every Azure subscription. It holds the users, groups and external guests who sign in, and it is where licenses and password reset rules are set.
The exam asks you to create and change identities, assign licenses, manage guests and configure self-service password reset (SSPR).
How it works
Users and groups
A user is either a member of your organization or a guest from outside. You create users in the portal, in bulk from a CSV file, or with scripts. You can edit properties such as name, job title and usage location afterward.
A group collects identities so that access can be given once. There are two group types.
| Group type | Used for |
|---|---|
| Security | Giving access to resources and applications |
| Microsoft 365 | Shared mailbox, calendar and team collaboration, which can also be used for access |
Membership can be assigned by an administrator, or dynamic. A dynamic group adds and removes users automatically by evaluating a rule on their attributes, for example department equals Sales. Dynamic membership needs Microsoft Entra ID P1 or higher.
A deleted user is kept for 30 days and can be restored in that time.
Licenses
A license turns on features such as Entra ID P1 or P2. A user must have a usage location set before a license can be assigned. You can assign a license to a user directly, or to a group so that every member receives it. Group-based licensing needs a paid Entra ID plan and is easier to maintain.
If there are not enough licenses, or two licenses conflict, the assignment shows an error that you fix from the group or user license page.
External users
A guest is a user from another organization or a personal account. You invite a guest by email, and they accept the invitation. The guest then signs in with their own identity and appears in your directory with the guest type.
Two settings control guests.
- External collaboration settings decide who may invite guests, what guests can see, and collaboration restrictions. Collaboration restrictions can allow invitations only to chosen domains, or deny chosen domains.
- Cross-tenant access settings define inbound and outbound trust with specific other organizations.
A guest who is assigned an Azure role signs in to their home directory by default and must switch to your directory in the Azure portal to see the resources.
Self-service password reset
SSPR lets users reset a forgotten password without calling the help desk. You configure three things.
- Who: none, selected groups or all users.
- Methods: how many methods are required to reset, such as one or two, and which methods are allowed.
- Registration: require users to register when they sign in, and how often they must re-confirm their details.
Writing a reset password back to an on premises directory needs password writeback, which requires Entra ID P1 or higher.
Entra ID plans at a glance
| Plan | Adds |
|---|---|
| Free | The core directory, users, groups and single sign on |
| P1 | Conditional Access, dynamic groups, group-based licensing and hybrid features such as password writeback |
| P2 | Everything in P1, plus Identity Protection and Privileged Identity Management |
A question that needs dynamic membership or group-based licensing is really asking which plan you need, and the answer is P1 or higher.
Creating users and dynamic rules
Besides the portal, you can create a user from the command line, or in bulk by uploading a CSV file.
az ad user create --display-name "Ana Silva" --user-principal-name ana@contoso.com --password "<password>"A dynamic membership rule is a condition on user or device attributes.
user.department -eq "Sales"
device.deviceOSType -eq "Windows"A worked scenario
New hires in the Sales department must automatically receive the Sales application license, without an administrator touching each account. The solution has three parts. Create a dynamic security group with the rule user.department -eq "Sales", assign the license to that group, and make sure each user has a usage location. When a hire's department is set to Sales, they join the group and receive the license by themselves.
How the exam asks about this
- "Which setting must exist before assigning a license?" The usage location.
- "Which group type can add members by rule?" A dynamic group, which needs P1.
- "Guests must come only from one partner domain." Collaboration restrictions, allow list.
- "Users can reset their own passwords." Self-service password reset, scoped to selected users or all.
- A deleted user is recoverable for 30 days.
What to remember for the exam
- Security groups give access. Microsoft 365 groups are for collaboration.
- Dynamic membership uses rules and needs Entra ID P1. Assigned membership is manual.
- A user needs a usage location before a license can be assigned.
- Group-based licensing assigns a license to every member of a group.
- Guests are invited by email. Collaboration restrictions allow or deny domains.
- SSPR is set for none, selected or all users, with one or two methods.
- Deleted users can be restored for 30 days.
"Allow invitations only to one company" is a collaboration restriction. "Trust MFA from a partner" is a cross-tenant access setting.
Common mistakes
Assigning a license without a usage location. The assignment fails until the location is set.
Choosing a dynamic group on the free plan. Dynamic membership needs Entra ID P1.
Expecting a guest to see your subscription at once. They must switch to your directory first.
Confusing SSPR scope with method count. Scope is who can use it. Methods are how they prove who they are.
Check yourself
Which membership type adds users automatically based on an attribute?
Dynamic membership.
What must be set on a user before a license can be assigned?
The usage location.
Which setting restricts guest invitations to chosen domains?
Collaboration restrictions in external collaboration settings.
Topic 1 of 4 in Manage Azure Identities and Governance
Test yourself on Manage Azure Identities and Governance
The full Microsoft AZ-104 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.