Microsoft Entra users, groups and licensing
Microsoft Entra ID (formerly Azure Active Directory, Azure AD) is the identity service behind every Azure subscription. The exam tests day-to-day tenant administration: users, groups, licenses and delegated admin rights.
Users
A user is a member (internal) or a guest (external, invited through B2B collaboration). You can create users one by one, in bulk with a CSV file, or sync them from on-premises Active Directory with Microsoft Entra Connect. Synced users are managed on-premises: you cannot edit most of their attributes in Entra ID. Cloud-only users can be edited there, including Job title and Usage location.
Groups
| Type | Use |
|---|---|
| Security | Grant access to resources and apps |
| Microsoft 365 | Mailbox, Teams, SharePoint; also usable for access |
Membership type can be Assigned, Dynamic user or Dynamic device. Dynamic groups use rules like user.department -eq "Finance" and need Microsoft Entra ID P1 or P2. You cannot add members manually to a dynamic group. A group can also have role-assignable enabled so that Entra roles can be assigned to it; this setting can only be chosen at creation.
Licensing
Assign licenses directly or to a group (group-based licensing). Users need a usage location before they receive a license. Security groups and Microsoft 365 groups can hold licenses; dynamic groups work too. Nested groups do not pass licenses down to the members of the nested group.
Delegating administration
Entra roles (Global Administrator, User Administrator, Groups Administrator) are assigned from Roles and administrators. An administrative unit limits the scope of such a role to part of the directory, for example one office. This is different from Azure RBAC, which applies to resources.
Self-service password reset and devices
SSPR lets users reset their own password after proving identity with methods you require. Enable it for all users or a selected group. Device settings control who can join or register devices and the maximum number of devices per user.
Exam traps
- Azure roles and Entra roles are separate systems. User Administrator is an Entra role, not an Azure role.
- Dynamic membership needs a paid Entra tier; plain assigned groups do not.
- Guests are invited, not created with a password. The invitation can be redeemed with the partner’s own identity.
- Nested groups do not inherit licenses from the parent group.
- Synced objects are edited on-premises, not in the portal.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. Users must be added to a group automatically when their Department attribute is Finance. Which group setup do you use?
Show answer
Answer: B.Dynamic membership rules add and remove users based on attributes such as department. This needs Microsoft Entra ID P1 or higher.
2. A user shows no licensed services after you assign a license through a group. The user has no usage location. What is the likely fix?
Show answer
Answer: A.A license cannot be assigned until a usage location is set. Group-based licensing reports an error for such users.
3. Local administrators in three offices must manage only the users in their own office. What do you use?
Show answer
Answer: B.Administrative units restrict an Entra role (such as User Administrator) to a subset of users or groups.
4. You need an external partner to access one app in your tenant using their own company credentials. Which user type do you create?
Show answer
Answer: B.Invite the partner as a guest user (Microsoft Entra B2B collaboration).