Manage users and groups in Microsoft Entra ID — AZ-104 Hoofdstuk 2

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Microsoft Entra-gebruikers, -groepen en -licenties beheren

Know the identity objects

Entra ID holds users, groups, devices, app registrations and service principals / managed identities.

Object	Used for
Member user	An employee, created in the tenant or synced from on-premises AD
Guest user (B2B)	A person from another organisation, invited by email
Security group	Give access to resources and apps
Microsoft 365 group	Shared mailbox, calendar and Teams for a team
Managed identity	An identity for an Azure resource (a VM, a function) — no password to manage
Service principal	The identity of an app or a pipeline (for example GitHub Actions)

Onthoud

Entra ID roles (like User Administrator) control the directory. Azure roles (like Contributor) control resources. They are two different systems.

2.2

Create users

Create users one by one, in bulk from a CSV file, or sync them from Active Directory with Entra Connect.

$az ad user create --display-name "Mia Lee" --user-principal-name mia@contoso.onmicrosoft.com --password 'Start-2026!' --force-change-password-next-sign-in true
$az ad user list --query "[].{name:displayName, upn:userPrincipalName}" -o table
$az ad user update --id mia@contoso.onmicrosoft.com --account-enabled false
$az ad user delete --id mia@contoso.onmicrosoft.com

Deleted users stay in Deleted users for 30 days and can be restored.
Bulk create: Users → Bulk operations → Bulk create, download the CSV template, fill it, upload it.

2.3

Invite guest users

B2B collaboration lets partners log in with their own account. You control what guests may see.

Users → New user → Invite external user, type the email.
The guest accepts the invitation by email.
Give the guest access through a group, like any user.

Op het werk

Set External collaboration settings so only admins (or a role) may invite guests, and review guests regularly with access reviews.

2.4

Use groups for access

Give rights to groups, never to single users. Then a new team member gets everything by joining one group.

$az ad group create --display-name sg-web-admins --mail-nickname sg-web-admins
$az ad group member add --group sg-web-admins --member-id $(az ad user show --id mia@contoso.onmicrosoft.com --query id -o tsv)
$az ad group member list --group sg-web-admins --query "[].displayName" -o tsv

Membership	How members are added	Needs
Assigned	By hand	Free
Dynamic user	By a rule, for example `user.department -eq "IT"`	Entra ID P1
Dynamic device	By a rule on device properties	Entra ID P1

2.5

Assign licenses

Some features need paid licenses (Entra ID P1/P2, Microsoft 365). Group-based licensing gives the license to everyone in a group.

Billing → Licenses → All products, choose the product.
Assign → choose a group.
Every user needs a usage location (country) before a license can be assigned.

2.6

Let users reset their own password

Self-service password reset (SSPR) saves help-desk calls. Users verify with methods like the Authenticator app, a phone or email.

Protection → Password reset → Properties: enable for Selected (a pilot group) or All.
Authentication methods: how many methods are needed (1 or 2) and which ones.
Registration: ask users to register at their next sign-in.

Examentip

Know where each setting lives: SSPR in Password reset, MFA and Conditional Access in Protection, licenses in Billing, user and group objects in Identity.

2.7

Join and manage devices

Devices can be Entra registered (personal devices), Entra joined (company Windows devices, cloud only) or hybrid joined (also in on-premises AD).

Device settings decide who may join devices and whether local admins are added.
Joined devices make Conditional Access possible ("only managed devices may open the admin portal").

Alle commando's in dit hoofdstuk

az