Identity & governance · Lesson 3 of 24

Entra ID: users, groups, licences, SSPR

The company directory that also checks passwords. What an admin creates in it, what needs the paid licence, and how people reset their own passwords.

About 10 min · Interactive · 3 practice questions

Exam objective
Create users and groups · Manage user and group properties · Manage licenses · Manage external users · Configure SSPRManage Azure identities and governance · 20–25% of the exam · typical question: "Feature does not work, what is the cause?" (licence, usage location) and SSPR configuration scenarios
In one sentence. Microsoft Entra ID is the list of everyone and everything in your company (users, groups, devices) plus the service that checks their password when they sign in; you administer the list, Microsoft runs the service.

The problem it solves

Contoso hires Priya on Monday. By lunchtime she needs an account, an Office licence, membership of the Sales team's group so she inherits its permissions, and a way to reset her own password at 7 pm without ringing the helpdesk. On Friday a contractor from a partner firm needs to see one SharePoint site without getting a Contoso account. Entra ID is where all of that is done.

It is not the on-premises Active Directory you may know. There are no OUs, no Group Policy and no Kerberos tickets. If the company still runs on-prem AD, a small agent called Entra Connect (software installed on an on-prem server that copies users and password hashes from Active Directory up to Entra ID every 30 minutes) keeps the two lists in step, and those copied users are edited on-prem, not in the cloud.

1. TenantOne Entra ID directory per organisation: contoso.com. Everything below lives inside it.
contoso.comthe directory
2. UsersPeople. Cloud-only (created here), synced (copied from on-prem AD, mostly read-only here), or guest (an outsider using their own company login).
Priyacloud-only, Sales
Ravisynced from on-prem
Partner contractorguest
3. GroupsBuckets of users. Security groups carry permissions; Microsoft 365 groups also get a mailbox and a Teams team. Membership is Assigned (you add people) or Dynamic (a rule adds them).
Salesdynamic: department = Sales
Support-Sydassigned
Partner-Projectassigned, includes guests
4. What hangs off themLicences, Azure role assignments, app access, SSPR scope.
M365 E3 licencevia the Sales group
Reader on Prodvia Support-Syd
One SharePoint sitevia Partner-Project
Quick check

Ravi's job title is wrong in Entra ID. His user record shows most fields greyed out. Where must it be fixed?

Groups: assigned versus dynamic

With an assigned group you add and remove members by hand. With a dynamic group you write a rule once, such as user.department -eq "Sales", and Entra adds or removes people as their attributes change. Dynamic membership is a paid feature: it needs an Entra ID P1 licence (the first paid tier of Entra ID; P2 adds risk-based features such as Identity Protection and Privileged Identity Management) in the tenant. If the rule is correct and the group stays empty, the missing P1 licence is the usual cause.

Membership type can be changed later, but switching from dynamic to assigned drops the rule, and switching to dynamic drops the hand-picked members.

Licences

A licence (Microsoft 365 E3, Entra ID P1) is assigned per user or, more sensibly, to a group so that joining the group grants it (group-based licensing also needs P1). Before any licence can be assigned the user must have a usage location (country) set, because some services are not sold everywhere. A licence assignment that "fails" with no obvious reason is almost always a missing usage location.

Quick check

You create a dynamic security group with the rule (user.department -eq "Sales"). After an hour it is still empty. Most likely cause?

External users (B2B)

Instead of creating a Contoso account for the partner contractor, you invite their email address. They sign in with their own company's credentials and appear in your directory as UserType = Guest. You then put the guest in a group and give the group access like anyone else. Who is allowed to send invitations is set under External collaboration settings (by default any member can). This is called B2B collaboration (business-to-business: letting people from other organisations use your resources with their own identity).

Self-service password reset (SSPR)

How SSPR works

  1. Admin switches it on for a scopePassword reset › Properties: None, Selected (one group, e.g. Sales), or All users.
  2. Admin chooses the proofsAuthentication methods: how many methods are required (1 or 2) and which are allowed (Authenticator app, phone, email, security questions). Administrators always need two.
  3. User registers their proofsAt aka.ms/mysecurityinfo, or when forced on next sign-in.
  4. User resets at 7 pmaka.ms/sspr, proves identity with the required methods, sets a new password.
  5. Optional: the new password goes back on-premPassword writeback, a setting in Entra Connect, needs P1. Without it a synced user's reset changes only the cloud copy.
Quick check

Requirement: users must prove identity with two methods before resetting their own password. Which setting?

Memorise (definitions)

  • Three user kinds: cloud-only, synced, guest
  • Security vs Microsoft 365 groups; Assigned vs Dynamic
  • Needs P1: dynamic groups, group licensing, SSPR writeback, Conditional Access. P2: Identity Protection, PIM
  • Usage location before a licence
  • SSPR: 1 or 2 methods for users, always 2 for admins

Apply (scenarios you must solve)

  • "Feature X does not work": licence or usage location missing?
  • Synced user attribute wrong: fix on-prem
  • Partner needs access: invite as guest, put in a group
  • Meet a reset-security requirement with the right SSPR setting
  • Bulk-create 200 users: Bulk operations CSV template

You, the admin: Priya's first day

  1. Entra ID › Users › + New user › Create new user: display name, user principal name [email protected], initial password. (For 200 starters: Users › Bulk operations › Bulk create, download the CSV template, fill it, upload.)
  2. Priya › Properties: set Department = Sales and Usage location = Australia. Save. The dynamic Sales group picks her up within minutes.
  3. Her licence arrives through the Sales group (Groups › Sales › Licenses already has M365 E3 assigned).
  4. Entra ID › Password reset › Properties: SSPR enabled for Selected = group All-Staff. Authentication methods: 2 required, Authenticator app + mobile phone allowed.
  5. Friday: Users › + New user › Invite external user, enter the contractor's email; add the guest to Partner-Project.

Script: az ad user create --display-name Priya --user-principal-name [email protected] --password '<temp>' · az ad group member add -g Support-Syd --member-id <user id>

Recognise the wording. "Dynamic group empty" / "cannot assign licence to group" / "writeback does nothing" = P1 missing. "Licence assignment fails" = usage location. "Partner must use their own credentials" = B2B guest invite. "Two methods before reset" = SSPR methods required. "Attribute greyed out" = synced, change on-prem.

Key points

  • Entra ID is the company phone book plus sign-in, run by Microsoft. It is not on-premises Active Directory; Entra Connect copies users up.
  • Usage location before licence. Licence assignment fails until the user has one.
  • P1 unlocks the clever features: dynamic groups, group-based licensing, SSPR writeback, Conditional Access. P2 adds Identity Protection and PIM.
  • SSPR: you pick one or two proofs for users; admins always need two.
  • Guests sign in with their own company credentials and show UserType = Guest.

Formal terms: Microsoft Entra ID (formerly Azure Active Directory), Entra Connect, user principal name (UPN), dynamic membership rule, B2B guest, usage location, SSPR, password writeback, Conditional Access, Entra ID P1/P2.

Check your understanding

3 exam-style questions in the formats AZ-104 uses. Each is marked when you check it, with the reasoning.

0 of 3 checked

All scenarios and questions are original. None are taken from the exam, Microsoft's practice assessment or any question bank. PrepToExcel is not affiliated with Microsoft.