Manage Microsoft Entra Users and Groups (AZ-104)

Microsoft Entra ID is Azure's cloud-based identity and access management service, and it is the directory that holds every account and group that signs in to Azure, Microsoft 365, and thousands of other applications. It was formerly called Azure Active Directory (Azure AD); Microsoft renamed it to Entra ID in 2023, but the underlying service and most portal workflows are unchanged, so older documentation still applies.

A user is an identity for a person or, in some cases, a service that needs to sign in. Every user has properties you manage — display name, user principal name (UPN), job title, department, usage location, and group memberships — and these properties matter for more than record-keeping: dynamic groups and licensing decisions read them directly.

A group collects users (and sometimes devices or other groups) so you can manage them together. Instead of granting a role or a license to fifty people one by one, you grant it to a group once and every member inherits it. On the AZ-104 exam, identity questions almost always come down to two choices: what type of object you create, and how its membership or access is managed. Getting those two decisions right is most of the work.

Entra ID has two user types, and choosing correctly is a common exam task. A member is an internal account that belongs to your organization's directory — typically your employees. A guest is an external user from another organization or an email provider whom you invite to collaborate through Microsoft Entra B2B collaboration; the guest keeps signing in with their own home credentials, and you never manage their password.

You create a member from the portal under Microsoft Entra ID > Users > New user > Create new user, setting the UPN, display name, and initial password. You add a guest with Invite external user: you enter their email address and Entra sends an invitation they redeem to appear in your directory as a guest (their UPN takes the form alice_contoso.com#EXT#@yourtenant.onmicrosoft.com).

On the exam, wording such as external partner sign-in or invite someone from another company points to a guest (B2B) account, not a member.

When you need to onboard or remove many accounts at once, Entra ID supports bulk operations driven by a CSV file, saving you from clicking through the portal repeatedly. On the Users blade you will find Bulk create, Bulk invite, Bulk delete, and Download users.

Each operation works the same way: you download the CSV template Microsoft provides, fill in one row per user, and upload it. The template has fixed header rows you must not remove — for bulk create you supply the display name, user principal name, and initial password; for bulk invite you supply each external user's email address and a redirection URL. Entra validates the file and reports any rows that failed so you can correct and re-upload.

A practical example: to onboard forty new contractors, you export the template, paste their details from a spreadsheet, and run Bulk invite once — all forty receive B2B invitations without forty manual steps. When their engagement ends, a Bulk delete CSV listing their user principal names removes them together. Bulk operations run in the background, and you can track them under Bulk operation results. For the exam, remember that large-scale user provisioning is a CSV-based bulk operation, not a custom script you must write.

Entra ID has two group types, and they serve different purposes. A security group is used to grant access — you assign it Azure roles, application permissions, or licenses, and every member inherits them. Security groups can contain users, devices, and other groups, and they are the workhorse for access management on the exam.

A Microsoft 365 group is built for collaboration rather than pure access control. Creating one provisions a shared mailbox, calendar, SharePoint site, and Teams-ready workspace, and its membership can include only users, not devices. You choose a Microsoft 365 group when a team needs shared resources; you choose a security group when you simply need to control who can do what.

Both group types support assigned or dynamic membership, but only security groups support dynamic device rules — a Microsoft 365 group can be dynamic on user attributes only. On the exam, if a scenario needs shared mailboxes or a Teams site, the answer is a Microsoft 365 group; if it needs to grant a role or license, the answer is a security group.

Group membership is managed one of two ways, and this is one of the most heavily tested identity concepts. With assigned (also called direct) membership, you add and remove each member yourself. With dynamic membership, you write a membership rule and Entra ID evaluates every user's (or device's) attributes and adds or removes them automatically — no manual maintenance.

Dynamic membership requires a Microsoft Entra ID P1 license for each member the rule evaluates. You configure it by setting the group's Membership type to Dynamic User or Dynamic Device and entering a rule using attribute syntax.

Admin scenario. Suppose you want every person in the Sales department to automatically belong to a group that receives a licensing bundle and a role. You create a security group, set Membership type to Dynamic User, and enter the rule:

user.department -eq "Sales"

From then on, any user whose department attribute equals Sales is added within minutes; when someone transfers out of Sales and their attribute changes, Entra removes them automatically. You never touch the membership list again — you manage the attribute, and the group follows.

On the exam, any phrase like auto-add users by attribute or membership updates automatically points to a dynamic group.

Licenses in Entra ID grant users access to products such as Microsoft 365, Enterprise Mobility + Security, or Microsoft Entra ID P1/P2, and you can assign them directly to a user or — far more efficiently — through group-based licensing. Group-based licensing lets you assign one or more product licenses to a group, and every member automatically inherits those licenses; when a user joins the group they are licensed, and when they leave, the license is removed and returned to the pool.

You configure it under Microsoft Entra ID > Billing > Licenses > All products, select a product, choose Assign, and pick the group. You can turn individual service plans within the product on or off for that group. Group-based licensing itself requires a paid Microsoft Entra ID P1 license for the tenant.

The real power comes from combining it with dynamic groups: point a license assignment at a dynamic group whose rule is user.department -eq "Sales", and every new Sales hire is licensed automatically the moment their account is created with the right department, with no administrator involvement. Watch for usage location — a user without a usage location set will fail licensing, because some services are not available in every region. On the exam, group-based licensing is the answer for assigning licenses to many users at scale.

Two remaining tasks round out user management: external users and self-service password reset. External users are the guests you invite through B2B collaboration, and you govern them with External collaboration settings — controlling who is allowed to send invitations, whether guests can invite other guests, and which domains are allowed or blocked. This lets you open collaboration to trusted partners while keeping it locked down elsewhere.

Self-service password reset (SSPR) lets users reset or unlock their own passwords without calling a help desk, cutting support tickets. You enable it under Microsoft Entra ID > Password reset, choosing None, Selected (a pilot group), or All users. Users must register authentication methods — such as a mobile phone, email, security questions, or the Microsoft Authenticator app — and you decide how many methods are required. SSPR for cloud users requires a Microsoft Entra ID P1 or equivalent Microsoft 365 license; for accounts synced from on-premises, password writeback pushes the new password back to Active Directory.

That last point highlights how Entra ID differs from on-premises Active Directory. Entra ID is a flat, cloud, multi-tenant directory reached over HTTPS with modern protocols (OAuth, OpenID Connect, SAML); it has no organizational units, no Group Policy, and no forest or domain-controller model. On-premises AD uses LDAP and Kerberos with OUs and Group Policy Objects. Many organizations run both and synchronize them with Microsoft Entra Connect. On the exam, external partner access means B2B guests, and letting users reset their own passwords means SSPR.