AZ-104 Objective 1.1: Manage Microsoft Entra Users and Groups

Key Concepts:

• Tenant: A dedicated instance of Microsoft Entra ID for your organization
• Directory: The container for all users, groups, and applications
• Identity: A digital representation of a person, application, or device
• Authentication: The process of verifying an identity
• Authorization: The process of determining what an authenticated identity can access

Step-by-Step Process:

1. Navigate to Microsoft Entra ID: Go to Azure Portal → Microsoft Entra ID
2. Access Users: Click on "Users" in the left navigation pane
3. Create New User: Click "New user" → "Create new user"
4. Fill User Details:
   • User principal name (UPN): username@domain.com
   • Name: First and last name
   • Display name: How the user appears in the directory
   • Password: Set initial password or auto-generate
   • Usage location: Required for license assignment
5. Assign Roles: Optionally assign directory roles
6. Create User: Click "Create" to complete the process

PowerShell Commands:

# Connect to Microsoft Graph PowerShell
Connect-MgGraph -Scopes "User.ReadWrite.All"

# Create a new user
$PasswordProfile = @{
    Password = "TempPassword123!"
    ForceChangePasswordNextSignIn = $true
}

$UserParams = @{
    DisplayName = "John Doe"
    UserPrincipalName = "john.doe@contoso.com"
    MailNickname = "johndoe"
    PasswordProfile = $PasswordProfile
    AccountEnabled = $true
    UsageLocation = "US"
}

New-MgUser @UserParams

REST API Example:

POST https://graph.microsoft.com/v1.0/users
Content-Type: application/json

{
  "accountEnabled": true,
  "displayName": "John Doe",
  "mailNickname": "johndoe",
  "userPrincipalName": "john.doe@contoso.com",
  "passwordProfile": {
    "forceChangePasswordNextSignIn": true,
    "password": "TempPassword123!"
  },
  "usageLocation": "US"
}

Security Groups:

• Purpose: Used for access control and permissions
• Membership: Can contain users, devices, and other groups
• Use Cases: Resource access, application permissions, conditional access

Microsoft 365 Groups:

• Purpose: Collaboration-focused groups with shared resources
• Resources: Include shared mailbox, calendar, SharePoint site, Teams workspace
• Use Cases: Team collaboration, project management, department communication

Distribution Groups:

• Purpose: Email distribution lists
• Membership: Can contain users, contacts, and other groups
• Use Cases: Email notifications, announcements, mailing lists

Step-by-Step Process:

1. Navigate to Groups: Go to Microsoft Entra ID → Groups
2. Create New Group: Click "New group"
3. Select Group Type: Choose Security, Microsoft 365, or Distribution
4. Configure Group Settings:
   • Group name: Descriptive name for the group
   • Group description: Purpose and scope of the group
   • Membership type: Assigned, Dynamic User, or Dynamic Device
5. Add Members: Add initial members (if using assigned membership)
6. Create Group: Click "Create" to complete

Dynamic Group Rule Examples:

# Users in specific department
(user.department -eq "Sales")

# Users with specific job title
(user.jobTitle -eq "Manager")

# Users in specific location
(user.usageLocation -eq "US")

# Complex rule combining multiple conditions
(user.department -eq "IT" -and user.jobTitle -contains "Engineer")

# Device-based dynamic group
(device.deviceOSType -eq "Windows")

Identity Information:

• User Principal Name (UPN): Primary login identifier
• Display Name: How user appears in directory
• First/Last Name: Personal identification
• Email Addresses: Primary and proxy addresses
• Object ID: Unique identifier in directory

Contact Information:

• Business Phone: Work contact number
• Mobile Phone: Personal contact number
• Office Location: Physical work location
• Street Address: Mailing address

Organizational Information:

• Department: Organizational unit
• Job Title: Position within organization
• Manager: Reporting relationship
• Company: Organization name
• Usage Location: Required for license compliance

PowerShell Bulk Operations:

# Update multiple users' department
$Users = Get-MgUser -Filter "department eq 'OldDepartment'"
foreach ($User in $Users) {
    Update-MgUser -UserId $User.Id -Department "NewDepartment"
}

# Bulk assign users to group
$UserIds = @("user1@contoso.com", "user2@contoso.com", "user3@contoso.com")
$GroupId = "group-id-here"
foreach ($UserId in $UserIds) {
    New-MgGroupMember -GroupId $GroupId -DirectoryObjectId $UserId
}

Basic Properties:

• Group Name: Display name of the group
• Description: Purpose and scope description
• Group Type: Security, Microsoft 365, or Distribution
• Email Address: Group email (for Microsoft 365 groups)

Membership Settings:

• Membership Type: Assigned, Dynamic User, or Dynamic Device
• Owners: Users who can manage the group
• Members: Users, groups, or devices in the group
• Dynamic Rules: Automatic membership criteria

Access Settings:

• Guest Access: Allow external users to join
• Member Access: Who can add/remove members
• Owner Access: Who can manage group settings
• Privacy Settings: Public, Private, or Hidden

Microsoft 365 Business Plans:

• Business Basic: Web-based Office apps, Exchange, Teams
• Business Standard: Desktop Office apps, Exchange, Teams, SharePoint
• Business Premium: All Standard features + Advanced security

Microsoft 365 Enterprise Plans:

• E3: Full productivity suite with security features
• E5: Advanced security, analytics, and compliance
• F3 (Frontline): Designed for frontline workers

Azure AD Premium:

• P1: Advanced identity protection, conditional access
• P2: Identity governance, privileged identity management

Azure Portal Method:

1. Navigate to User: Go to Microsoft Entra ID → Users → Select user
2. Access Licenses: Click "Licenses" in the left navigation
3. Assign Licenses: Click "Assignments" → "Add assignments"
4. Select Products: Choose the license products to assign
5. Configure Options: Enable/disable specific service plans
6. Save Changes: Click "Save" to apply license assignment

Group-Based Licensing Setup:

1. Create License Group: Create a security group for license assignment
2. Assign Licenses to Group: Go to Microsoft Entra ID → Groups → Select group → Licenses
3. Configure Service Plans: Enable/disable specific services within the license
4. Add Users to Group: Users automatically receive licenses when added to the group
5. Monitor Assignment: Use license reports to track assignments and usage

License Assignment Commands:

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "User.ReadWrite.All"

# Get available license SKUs
Get-MgSubscribedSku

# Assign license to user
$User = Get-MgUser -UserId "user@contoso.com"
$LicenseSku = Get-MgSubscribedSku | Where-Object {$_.SkuPartNumber -eq "ENTERPRISEPACK"}
$LicenseAssignment = @{
    AddLicenses = @(
        @{
            SkuId = $LicenseSku.SkuId
        }
    )
    RemoveLicenses = @()
}
Set-MgUserLicense -UserId $User.Id -BodyParameter $LicenseAssignment

# Assign license to group
$Group = Get-MgGroup -GroupId "group-id"
$LicenseAssignment = @{
    AddLicenses = @(
        @{
            SkuId = $LicenseSku.SkuId
        }
    )
    RemoveLicenses = @()
}
Set-MgGroupLicense -GroupId $Group.Id -BodyParameter $LicenseAssignment

Key Reports and Monitoring:

• License Usage Report: Track assigned vs. used licenses
• Unused Licenses: Identify licenses that can be reclaimed
• License Conflicts: Resolve service plan conflicts
• Expiring Licenses: Monitor license renewal dates
• Cost Analysis: Optimize license spending

Guest Users (B2B Collaboration):

• Definition: Users from external organizations invited to collaborate
• Authentication: Use their own organization's credentials
• Access: Limited to resources explicitly shared with them
• Management: Managed in your tenant but authenticated by their home tenant

External Identities:

• Social Identities: Google, Facebook, LinkedIn accounts
• Email One-Time Passcode: Passwordless authentication via email
• Self-Service Sign-Up: Users can register themselves for specific applications

Step-by-Step Invitation:

1. Navigate to Users: Go to Microsoft Entra ID → Users
2. Invite External User: Click "New user" → "Invite external user"
3. Enter Email Address: Provide the external user's email address
4. Personal Message: Optional custom message for the invitation
5. Configure Access: Assign roles or groups if needed
6. Send Invitation: Click "Invite" to send the invitation email

Invitation Commands:

# Invite external user
$Invitation = @{
    InvitedUserEmailAddress = "external@partner.com"
    InviteRedirectUrl = "https://myapps.microsoft.com"
    SendInvitationMessage = $true
}
New-MgInvitation -BodyParameter $Invitation

# Get all guest users
Get-MgUser -Filter "userType eq 'Guest'"

# Update guest user properties
Update-MgUser -UserId "guest-user-id" -DisplayName "Updated Name"

# Remove guest user
Remove-MgUser -UserId "guest-user-id"

Security Policies:

• Multi-Factor Authentication: Require MFA for external users
• Device Compliance: Require compliant devices for access
• Location Restrictions: Limit access based on geographic location
• Session Controls: Implement sign-in frequency and session timeouts
• Risk-Based Policies: Block high-risk sign-ins

Automated Management:

• Access Reviews: Regular review of external user access
• Expiration Policies: Automatic removal of inactive guest users
• Approval Workflows: Require approval for guest invitations
• Access Packages: Self-service access request and approval
• Audit Logging: Track all external user activities

Available Methods:

• Mobile Phone: SMS or voice call verification
• Office Phone: Voice call to registered office number
• Email Address: Email verification code
• Security Questions: Pre-configured questions and answers
• Microsoft Authenticator App: Push notification or code
• Alternative Email: Secondary email address

Step-by-Step Setup:

1. Navigate to SSPR: Go to Microsoft Entra ID → Password reset
2. Configure Properties:
   • Self-service password reset enabled: Select "All" or specific groups
   • Authentication methods: Choose required methods (minimum 2)
   • Number of methods required: Set to 1 or 2
   • Number of days before users must re-confirm: Set re-registration period
3. Configure Registration:
   • Require users to register when signing in: Enable for better adoption
   • Number of days before users are asked to re-confirm: Set reminder period
4. Configure Notifications:
   • Notify users on password resets: Enable security notifications
   • Notify all admins when other admins reset their password: Enable admin notifications
5. Save Configuration: Click "Save" to apply settings

Configuration Commands:

# Connect to Azure AD
Connect-AzureAD

# Get current SSPR policy
Get-AzureADSSPRPolicy

# Configure SSPR settings
$SSPRPolicy = @{
    SelfServicePasswordResetEnabled = $true
    NumberOfAuthenticationMethodsRequired = 2
    NumberOfDaysBeforeUsersAreAskedToReconfirm = 180
    RequireUsersToRegisterWhenSigningIn = $true
    NotifyUsersOnPasswordResets = $true
    NotifyAllAdminsWhenOtherAdminsResetTheirPassword = $true
}

Set-AzureADSSPRPolicy @SSPRPolicy

# Configure authentication methods
$AuthMethods = @{
    AuthenticationMethods = @("mobilePhone", "email", "securityQuestions")
}

Set-AzureADSSPRPolicy @AuthMethods

Recommended Policies:

• Trusted Locations: Allow SSPR from trusted network locations
• Device Compliance: Require compliant devices for password reset
• Risk-Based Access: Block high-risk password reset attempts
• Time-Based Restrictions: Limit SSPR to business hours
• Geographic Restrictions: Block SSPR from suspicious locations

Registration Steps:

1. Access Registration: Users visit aka.ms/ssprsetup or are prompted during sign-in
2. Choose Methods: Select and configure authentication methods
3. Verify Methods: Test each method to ensure it works
4. Complete Registration: Save configuration for future use
5. Regular Re-confirmation: Update methods as required by policy

Reset Steps:

1. Access Reset Page: Users visit aka.ms/sspr or click "Can't access your account?"
2. Enter Username: Provide user principal name or email
3. Complete CAPTCHA: Verify human interaction
4. Verify Identity: Use registered authentication methods
5. Create New Password: Set new password meeting complexity requirements
6. Sign In: Use new password to access resources

Essential Reports:

• Sign-in Reports: Track user authentication activities
• Audit Logs: Monitor administrative actions and changes
• License Usage Reports: Track license assignments and usage
• Guest User Reports: Monitor external user activities
• SSPR Reports: Track password reset activities and success rates
• Group Membership Reports: Monitor group changes and membership

Monitoring Scripts:

# Get user sign-in activities
Get-MgAuditLogSignIn -Top 100

# Get license usage
Get-MgSubscribedSku | Select-Object SkuPartNumber, ConsumedUnits, PrepaidUnits

# Get guest users
Get-MgUser -Filter "userType eq 'Guest'" | Select-Object DisplayName, UserPrincipalName, CreatedDateTime

# Get group membership changes
Get-MgAuditLogDirectoryAudit -Filter "category eq 'GroupManagement'"

# Get SSPR activities
Get-MgAuditLogSignIn -Filter "status/errorCode eq 0 and authenticationDetails/any(a:a/authenticationMethod eq 'password')"

Security Measures:

• Privileged Access Management: Protect administrative accounts
• Conditional Access: Implement risk-based access policies
• Identity Protection: Monitor for risky sign-ins and users
• External User Controls: Limit and monitor guest user access
• License Security: Regular review of license assignments
• SSPR Security: Strong authentication methods and monitoring

Sample Exam Questions:

1. What is the minimum number of authentication methods required for SSPR?
2. Which PowerShell cmdlet is used to create a new user in Microsoft Entra ID?
3. What license is required for dynamic group membership?
4. How can you bulk assign licenses to multiple users?
5. What are the three types of groups available in Microsoft Entra ID?
6. Which authentication method is recommended for SSPR security?
7. How do you invite an external user for B2B collaboration?
8. What is the difference between a security group and a Microsoft 365 group?