Users, Groups, Devices and Licences

What it is

Once a tenant exists, you fill it with identities and keep them in order. That means creating users and groups, giving them the attributes and licences they need, bringing devices into the directory, and doing all of it at scale with bulk tools and scripts.

The exam asks you to choose the right object, the right method and the right setting for a described situation.

How it works

Users

A user can be created in the admin center, by importing a CSV file, with Microsoft Graph PowerShell, or by synchronisation from on premises. Important properties include the user principal name, display name, usage location, manager, department and user type, which is either Member or Guest.

A user's Source shows where the account came from: Microsoft Entra ID for cloud accounts, Windows Server AD for synchronised accounts, External Microsoft Entra ID for a guest from another tenant, and Microsoft Account for a guest who signed up with a personal address.

To turn a guest into an employee while keeping the object ID, group memberships and role assignments, change the user type of the existing account from Guest to Member. Deleting or re-inviting would create a new object.

Deleted users are kept for 30 days and can be restored.

Groups

Dynamic membership needs Microsoft Entra ID P1. Group settings can restrict who may create groups, apply a naming policy, and set an expiration policy for Microsoft 365 groups.

Custom security attributes

Custom security attributes are business specific key value pairs that you define and assign to users, service principals or applications, for example Project = Contoso or Clearance = Level2. They are not visible to everyone and are managed with special roles, Attribute Definition Administrator and Attribute Assignment Administrator. Use them to classify identities and then write rules or access policies based on them.

Bulk operations

Connect-MgGraph -Scopes "User.ReadWrite.All"
New-MgUser -DisplayName "Ana Silva" -UserPrincipalName "ana@contoso.com" -MailNickname "ana" -AccountEnabled -PasswordProfile @{ Password = "<password>"; ForceChangePasswordNextSignIn = $true }
Get-MgUser -Filter "department eq 'Sales'"
Update-MgUser -UserId "ana@contoso.com" -JobTitle "Account Manager"
Get-MgUserMemberOf -UserId "ana@contoso.com"
Remove-MgUser -UserId "ana@contoso.com"

Common cmdlets are Get-MgUser to read users, Update-MgUser to change properties, Remove-MgUser to delete, and Get-MgUserMemberOf to list the groups and directory roles a user belongs to. To find stale accounts, read the signInActivity property of each user in Microsoft Graph, which returns the last sign in time.

Devices

A device can be linked to Entra ID in three ways.

Device settings control who may join or register devices, whether MFA is required to join, and the maximum number of devices per user, which is 50 by default. Joined devices can be managed with Microsoft Intune, and Conditional Access can require a compliant or joined device. Windows Autopilot prepares new devices for users.

Licences

Licences give users access to Microsoft 365 and Entra features. A user needs a usage location before a licence can be assigned. Licences can be assigned directly or, better, through a group, and group based licensing needs Entra ID P1. When a user joins the group, the licence follows, and when they leave it is removed. Reports show who holds which licence and flag errors, such as not enough licences.

Choosing the right approach

A worked scenario

A company onboards 120 seasonal workers. HR sends a spreadsheet, which an administrator turns into the bulk create CSV template and uploads. A dynamic group on department adds the workers to a Retail group, and group based licensing gives that group the right licence once the usage location is set. A consultant who has become an employee has their user type changed from Guest to Member, so the object ID and permissions stay. To find stale accounts, a script reads signInActivity for every member and lists those with no sign in for 90 days.