Chapter 4: Creating, Configuring, and Managing Identities

The previous chapter discussed how to customize the Azure Active Directory (AD) tenant with a custom domain, and then how to set up users and devices to join to Azure AD and the custom domain. In this chapter, we will go into further detail on how users and groups are created, and how to manage and assign licenses for the various types of users and groups.

In this chapter, we're going to cover the following main topics: 

• Creating, configuring, and managing users
• Creating, configuring, and managing groups
• Managing licenses

Technical requirements

In this chapter, we will continue to explore configuring a tenant for the use of Microsoft 365 and Azure. There will be exercises that will require access to Azure AD. If you have not yet created the trial licenses for Microsoft 365, please follow the directions provided within Chapter 1, Preparing for Your Microsoft Exam.

Creating, configuring, and managing users

In order to be able to create users in Azure AD, you will need to have the Global Administrator or the User Administrator role. Since the best practice is to adhere to the principle of least privilege, the User Administrator role assignment should be given to anyone who is required to create, configure, and manage users within Azure AD.

Once you are in Azure AD with the proper role, you have the ability to create users. This chapter will focus on member users in detail, with a high-level focus on guest users and hybrid or AD users. External and guest users and hybrid users will be covered in later chapters.

Member users

Member users are those users who are cloud-native to the Azure AD tenant. They are the direct users from the company that need access to Microsoft 365 and/or Azure resources. These users are typically the first users that are added to the tenant when it is created and then assigned the various groups and roles that...

Creating, configuring, and managing groups

Now that we understand how to add users in Azure AD, you may want to group these users based on roles, departments, or locations.

Creating groups that users belong to can assist in the management of providing access to licenses, assigning roles, and maintaining compliance and data sovereignty for users located in different countries. Group assignments can be created manually or dynamically based on an attribute. We will step through the creation process of groups later in the chapter. The following sections will explore the different types of groups and the use cases for them to be used.

Microsoft 365 groups

Microsoft 365 groups are the recommended group to create when working only with Microsoft 365 resources. These groups can contain users both inside and outside of the company to allow them to collaborate and be part of Microsoft Teams channels. When these groups are created, a group email address is created to allow users to...

Managing licenses

Licenses are important within Microsoft to be able to use features and capabilities for Microsoft 365 and Azure AD. Without proper licenses assigned, some features may not be available, such as Exchange Online, SharePoint Online, or Microsoft Teams. Users that do not have licenses assigned to them may not be able to be added to groups, have access to resources that they need to work, or allow security features for identity and access management to be configured. The next sections will describe some of these requirements.

License requirements

Some license requirements to enable capabilities have already been discussed in some of the sections already. For example, dynamic groups require an Azure AD Premium P1 or P2 license. These Azure AD Premium licenses are also required for many of the advanced identity and access features that will be discussed in this book. For a full comparison of these features, review the information at this link: https://azure.microsoft...

Summary

In this chapter, we described how to create users and groups and manage licenses. This included the multiple ways to add member users to Azure AD, adding an assigned and dynamic group, and finally, the use of Azure AD Premium licenses for the advanced identity and access features. In the next chapters, we will go into further detail on how external and hybrid users can be added and used within Azure AD.