Permissions in Azure hang on accounts, and these accounts live in the directory, not in the resource group. Whoever runs Azure therefore creates users and groups, changes their details and cleans them up again. This lesson shows that with the Microsoft Entra admin center and with commands.
Nordlicht Reisen GmbH, a fictional travel agency, hires two new employees for the booking team. IT is to create them, add them to a group "Buchung" (German for booking) and later assign permissions to the group, not to people. That is exactly what you practice, with invented people.
Prior knowledge: What Microsoft Entra ID and a tenant are and how sign-in works is covered in "AZ-900 compact", lesson 2.6. The relationship between Entra roles and Azure roles, and a script that creates a group with disabled test users, is shown in K3, lesson 3.1.4. Here the management is covered in detail, as the exam names it. Licenses, guests and password reset follow in lesson 1.2.
User types
An account in a workforce tenant (workforce tenant) is one of four types:
| Type | Description |
|---|---|
| Internal member (internal member) | usually permanent employees, credentials in your own tenant |
| Internal guest (internal guest) | account in your own tenant, but with guest permissions; often older than guest collaboration |
| External member (external member) | signs in with an external account, but has member permissions; typical in organizations with several tenants |
| External guest (external guest) | a real guest, signs in with an external method, has guest permissions |
The credentials differ: Internal users have sign-in data in your own tenant, which administrators manage. External guests set their password themselves through the link in the invitation. External members sign in in their home tenant; if they forget their password, the administration there resets it. Guests and invitations are the topic of lesson 1.2. Here you create internal members.
Which role you need for that is named by Microsoft according to the principle of least privilege:
| Task | Minimum role required |
|---|---|
| create users | User Administrator |
| invite an external guest | Guest Inviter |
| assign Entra roles | Privileged Role Administrator |
| manage groups | Groups Administrator or User Administrator |
These are Entra roles, not Azure roles. With a test account of your own, you are an administrator in your own tenant. In a company directory you usually aren't allowed to be; there you create the exercises in a test tenant of your own (Microsoft describes this under "Create a new tenant", Further reading).