Prepstellar
Get the app

AZ-104 · Microsoft Entra users and groups

21 cards

Microsoft Entra Users and External Identities

Swipe, scroll or use ← →

  1. Why every person needs a user object

    Access to resources starts with an identity. Anyone who needs to reach organizational resources needs a user account in Microsoft Entra ID, because that account holds all the information required to authenticate the person during sign-in.

    Authentication is only the first half. Once the person is authenticated, Microsoft Entra ID builds an access token that authorizes them: the token determines which resources the user can reach and what the user can do with those resources.

    Stage What carries it What it decides
    Sign-in The user account Whether the person is who they claim to be
    After sign-in The access token Which resources are available, and which actions are allowed

    Keeping these two stages apart explains most account design decisions later: creating the object is what makes sign-in possible, and what the person can then do is a matter of authorization, not of the account existing.

    1 / 21

  2. Quick check

    A person signs in successfully. What does Microsoft Entra ID build at that point, and what does it decide?

    1. AA user account, which holds the details needed to authenticate the person

      The user account already exists before sign-in; it is what makes authentication possible rather than what follows it.

    2. BAn access token, which sets what may be reached and done

      Right. After authentication, the access token authorizes the user and sets which resources are available and what can be done with them.

    3. CA directory switch, which moves the session into a different directory

      Switching directories changes which directory an administrator is working in; it is not something sign-in produces.

    2 / 21

  3. Find the users, and check which directory you are in

    User objects are managed in the Microsoft Entra admin center. Select Users under Identity, then open the All users view to list the directory's accounts. The User Type column is worth a look straight away: it separates members from guests.

    One detail causes more mistakes than any other. The admin center works with a single directory at a time, so the list you are reading belongs to whichever directory is currently active. To move to another one, use the Directory + Subscription panel or the Switch directory button in the toolbar.

    Surface What it gives you
    Identity > Users > All users The user objects of the active directory
    User Type column Members and guests at a glance
    Directory + Subscription / Switch directory The change of directory context

    If several directories contain similarly named accounts, change the context first and confirm it. Everything you select afterwards belongs to that directory and to no other.

    3 / 21

  4. Quick check

    The accounts you need to edit belong to a different Microsoft Entra directory from the one on screen. What has to happen first?

    1. ASwitch directory: one directory is active at a time

      Right. Only one directory is active at a time, so the context has to change before the correct objects can even be listed.

    2. BNothing, because All users lists every directory of the organization at once

      All users shows the active directory only, so the accounts of the other directory are simply not in that list.

    3. CSort All users by the User Type column so the other directory appears

      User Type separates members from guests inside the current directory and never brings in another directory's accounts.

    4 / 21

  5. Create a cloud user

    Creating an account is a short path with one starting point. From Users, select New user, then Create new user. The form then collects the identity details of the new account.

    Field on the creation form Example value
    User principal name ChrisG
    Name Chris Green
    First name Chris
    Last name Green
    Password A unique password for the account
    Usage location The location the person actually works in

    The user principal name is the sign-in name of the account, so it is the field that makes the object usable. When the form is submitted, verify that the new account appears in All users.

    Neighbouring commands do other jobs: Groups > New group builds a group object, and Deleted users > Restore user recovers an account that already existed. Neither one creates a user.

    5 / 21

  6. Quick check

    Which path creates a cloud user, and which detail belongs on its form?

    1. AGroups, then New group, followed by a membership type

      New group creates a group object and its membership rule, which is a different object entirely.

    2. BDeleted users, then Restore user, followed by a confirmation

      Restore user brings back an account that was deleted; nothing new is created by that path.

    3. CUsers, then New user and Create new user, followed by a user principal name

      Right. Creation begins at Users > New user > Create new user, and the user principal name is the sign-in name entered on the form.

    6 / 21

  7. Keep your progress in the app

    That’s 3 of 10 quick checks. In the app they stay answered, and every lesson remembers where you left off.

    Get the app Keep reading here

  8. Set the usage location before licensing

    Usage location deserves its own moment because it is a licensing prerequisite, not decoration. Some Microsoft services are unavailable in certain locations because of local laws and regulations, so a license cannot be assigned until the property says where the person is.

    It is an editable user property: open the user and set it on the Properties tab in the Microsoft Entra admin center. If a stored value does not represent the person's actual location, correcting it there lets the license assign correctly the next time.

    Two consequences follow:

    • With group-based licensing, any user without a usage location inherits the location of the directory — which may not be where that person is.
    • Setting the value as part of user creation avoids licensing failures for people spread across several countries.

    A group's membership type, a restoration dialog and the directory panel all sit elsewhere in the admin center and none of them stores this value.

    7 / 21

  9. Quick check

    A license assignment fails because a user's usage location does not match where that person actually works. Where is the value corrected?

    1. AOn the user's Properties tab in the admin center

      Right. Usage location is an editable user property on the Properties tab, and fixing it lets the license assign correctly next time.

    2. BIn the membership type setting of the group that licenses them

      Membership type decides how a group is populated and holds no location value for any individual user.

    3. CIn the Directory + Subscription panel

      That panel changes which directory is active and stores nothing about an individual user's location.

    8 / 21

  10. One user, or many at once

    The All users list is also the selection surface. Selecting the check boxes next to accounts lets you manage several users at the same time. Opening a user's page instead scopes whatever you do next to that individual only.

    Starting point Scope of the operation
    Check boxes in the All users list Every account ticked
    A single user's page That one account

    For example, to delete an account: tick the user in the list, select Delete user on the menu, review the dialog and confirm. The same pattern — tick first, then choose the command — is what turns a single-user action into a bulk one.

    9 / 21

  11. Quick check

    The same change must be applied to eleven accounts in the All users list. How should the administrator begin?

    1. AOpen one user's page and add the other ten there as properties

      A user's page manages that individual only, and other accounts cannot be held inside it as properties.

    2. BTick the check boxes of those accounts in the list

      Right. The check boxes in the list are the multi-user selection surface, so the command that follows applies to every ticked account.

    3. CSwitch directory once for every account in the operation

      Directory switching changes the active directory and is not a way to pick individual accounts.

    10 / 21

  12. Recognize where an identity comes from

    Microsoft Entra ID typically defines users in three ways, and each one displays a different source. Reading that column tells you where the account is really governed.

    Kind of identity Where it lives Source shown
    Cloud identity Only in Microsoft Entra ID — administrator accounts and users you manage yourself Microsoft Entra ID
    Cloud identity from elsewhere Defined in another Microsoft Entra instance, but needing resources this directory controls External Microsoft Entra directory
    Directory-synchronized identity On-premises Active Directory, brought in by a synchronization activity Windows Server AD
    Guest user Outside the organization Invited user

    Cloud identities are removed when they are deleted from the primary directory. The other kinds keep their real home elsewhere, which is exactly what the source column is telling you.

    11 / 21

  13. Recognize where an identity comes from

    Directory-synchronized identities need a tool to carry them into the cloud, and there are two.

    • Microsoft Entra Cloud Sync is the recommended synchronization tool for most organizations: a lightweight cloud-managed agent that supports multiple disconnected forests.
    • Microsoft Entra Connect Sync remains available for complex scenarios, such as device synchronization or groups with more than 50,000 members.

    Whichever tool moves them, the accounts still show Windows Server AD as their source, because the source describes where the identity originates, not which agent transported it.

    12 / 21

  14. Quick check

    An account was created in on-premises Active Directory and reaches Microsoft Entra ID through a synchronization activity. How is it classified, and what source is displayed?

    1. AA guest user, displayed with Invited user

      Invited user marks an identity from outside the organization, not an account that originates on-premises.

    2. BA cloud identity, displayed with an External Microsoft Entra directory source

      That source belongs to an account defined in another Microsoft Entra instance, which is still a cloud identity.

    3. CA directory-synchronized identity, displayed with Windows Server AD

      Right. Origin in on-premises Active Directory makes it a directory-synchronized identity, and the source shown is Windows Server AD.

    13 / 21

  15. Bring in people from outside the organization

    Guest users exist outside your organization — accounts from other cloud providers, or Microsoft accounts — and their source reads Invited user. This account type is useful when external vendors or contractors need access to your organization's resources.

    The end of the collaboration is as important as its start. Once their help is no longer necessary, you can remove the account, and all of their access goes with it. That single removal is what makes the guest pattern safe for temporary work.

    Situation Fitting object
    A contractor with their own outside account, for a fixed engagement A guest user, removed when the work ends
    An employee whose account lives in on-premises Active Directory A directory-synchronized identity
    A person you manage entirely in this directory A cloud identity

    Note what does not end access: clearing a usage location changes licensing behaviour, not permissions.

    14 / 21

  16. Quick check

    A contractor keeps their own account outside your organization, needs your resources for one project, and must lose that access when it ends. What fits?

    1. AA guest user, whose source reads Invited user and whose access ends on removal

      Right. Guests are the object type for identities outside the organization, and removing the account removes all of their access.

    2. BA synchronized account brought in from on-premises Active Directory

      Synchronization models employees who originate on-premises, which is not the contractor's own external account.

    3. CA cloud administrator account whose usage location is cleared afterwards

      An administrator account is a stronger identity than the work needs, and usage location affects licensing rather than access.

    15 / 21

  17. Deletion is reversible for 30 days

    Deleting a user does not destroy the object immediately. The account remains in a suspended state for 30 days, and during that window it can be restored together with all its properties.

    When the window passes, the permanent deletion process starts automatically — and a permanently deleted user cannot be restored.

    Moment State of the account What is possible
    Day 0 to day 30 Suspended Restore it with all its properties
    After day 30 Permanent deletion starts automatically Nothing; the object is gone for good

    Deletion also does not turn a member into a guest, and it does not leave the account working in the meantime. Suspended means unusable but recoverable.

    16 / 21

  18. Quick check

    What is true of a user account during the first 30 days after it is deleted?

    1. AIt keeps working normally until the window closes

      Deletion suspends the account immediately; the 30 days are a recovery window, not continued service.

    2. BIt is suspended, and it can be restored with all its properties

      Right. Within that window the object is suspended and restoration brings it back together with all its properties.

    3. CIt has already been removed for good and must be recreated from scratch

      Permanent deletion only begins after the window, so at this stage nothing has been lost yet.

    17 / 21

  19. Restore a deleted account, and who may do it

    Recovery has its own list. In the Users page, open Deleted users to see every account deleted less than 30 days ago — those are the restorable ones. Select the account, choose Restore user, review the dialog and confirm; the account then reappears in All users.

    Restoring or permanently deleting users is a privileged operation. One of these roles is required:

    • Global Administrator
    • Partner Tier-1 Support
    • Partner Tier-2 Support
    • User Administrator

    Creating a replacement account is not a substitute: a new object does not carry the original's properties. And waiting is the one move that removes the option altogether, since permanent deletion starts on its own once the window ends.

    18 / 21

  20. Quick check

    An account deleted 20 days ago must come back with its original properties, and a replacement account is unacceptable. What should the administrator do?

    1. ABuild a new account carrying the same name

      A new object starts empty, so the properties of the original account do not come back with it.

    2. BLet the 30 days pass, then restore the object

      Once the window closes the deletion becomes permanent, and a permanently deleted user cannot be restored.

    3. COpen Deleted users, select the account and choose Restore user

      Right. At day 20 the account is still suspended, so restoring it from Deleted users recovers the object with all its properties.

    19 / 21

  21. Key takeaways

    • The account authenticates, the token authorizes. A user account holds what is needed to sign in; the access token built afterwards decides which resources are reachable and what may be done with them.
    • Work in the right directory. The admin center handles one directory at a time; use Directory + Subscription or Switch directory before touching anything, and read User Type in All users to tell members from guests.
    • Create from Users > New user > Create new user, supplying the user principal name, name, first and last name, password and usage location — and correct usage location on the Properties tab before assigning a license.
    • Select before you act. Check boxes in the list manage several accounts at once; a user's page manages that one account.
    • The source column tells the story. Microsoft Entra ID, External Microsoft Entra directory, Windows Server AD and Invited user each name a different origin; Cloud Sync is the recommended tool, with Connect Sync for complex scenarios.
    • Deletion lasts 30 days. Restore from Deleted users with a Global Administrator, Partner Tier-1 Support, Partner Tier-2 Support or User Administrator role, because after the window the loss is permanent.
    20 / 21

  22. Quick check

    An administrator is viewing directory A and must update several users in directory B without touching similarly named accounts in A. Which sequence meets both constraints?

    1. ASwitch to directory B, open All users, and tick the accounts to change

      Right. Directory context has to change first, and the check boxes then limit the operation to the chosen accounts in directory B.

    2. BTick the names in directory A first, and then switch over to directory B

      Those ticks belong to directory A's objects and do not carry over when the directory context changes.

    3. CStay in directory A and open one user page to manage both directories

      One directory is active at a time, and a single user's page scopes the work to that individual anyway.

    21 / 21

  23. 10 quick checks · then the test

    In the app, finishing the quick checks opens this lesson’s 10-question test, and the ones you miss come back exactly when you’re about to forget them.

    Take this lesson’s test → Next lesson: Microsoft Entra Groups and PropertiesGet the app
← Previous Keep your progress · Get the app Next card →

The whole course, on your phone

Lessons you can read, audio you can listen to on the way to work, and practice that remembers what you got wrong.

Get the app