Manage Azure identities and governance
Microsoft Entra Identity Lifecycle and SSPR
ImportantAdminister users, groups, properties, licenses, external collaboration, and password reset at tenant scope.
Aligned to the current AZ-104 study guide, verified August 21, 2026.
Why this matters
Identity configuration determines who can sign in, which users can collaborate, and whether routine password recovery can happen without help-desk intervention.
Must Know
- Create individual user objects for people and use groups to manage shared access or licensing at scale.
- User properties such as usage location can be prerequisites for license assignment; group type and membership type determine how a group can be used.
- A guest is represented in the resource tenant but normally authenticates with an identity managed by a home organization or another identity provider.
- SSPR is enabled for a selected tenant population and depends on registration and allowed authentication methods.
Compare and Distinguish
- User vs group: a user is an identity that signs in; a group collects identities so access or licenses can be managed consistently.
- Member vs guest: member usually represents an identity managed for the tenant; guest supports external collaboration and remains subject to resource-tenant access controls.
- Microsoft Entra role vs Azure RBAC role: an Entra role manages directory objects; an Azure role authorizes Azure resource operations at a management scope.
Scenario examples
- Scenario: Every support employee needs the same license and storage access. Think: Use a managed group for repeatable assignment and change membership as staffing changes.
- Scenario: A partner needs access to one application without becoming an internal employee. Think: Invite a guest and grant only the resource access required.
- Scenario: Users can open the password-reset page but cannot complete reset. Think: Check SSPR scope, method policy, and each user’s authentication-method registration.
Exam traps
- Creating a group does not grant permissions or licenses until an administrator assigns something to it.
- Inviting a guest does not automatically give the guest access to Azure resources or applications.
- Enabling SSPR for all users does not mean every user has registered enough allowed authentication methods.
Key takeaways
- Manage common entitlements through groups and reserve direct assignment for deliberate exceptions.
- Treat identity creation, authentication recovery, licensing, and resource authorization as separate administrative steps.
How it works
- Applications and Azure control planes use Entra identities as principals, but each target still evaluates its own assignments and policies.
- Group-based management turns a membership change into inherited entitlement or access where that group has an assignment.
Objects and administrative surfaces
- Tenant — users, groups, licenses, external identities, and SSPR settings in the Microsoft Entra admin center.
- Group or user — properties, memberships, assigned licenses, authentication registration, and sign-in state.
- Azure resource — access is configured separately through Azure RBAC, even when the same Entra identity is the principal.
When to use it
- Use groups for stable department, job-function, or application populations.
- Use external identities when another organization’s user needs governed collaboration without a new internal account.
Security and governance implications
- Apply least privilege, maintain accountable group owners, and review stale guests and dormant accounts.
- Protect authentication-method registration and require stronger methods appropriate to the organization’s policy.
How to reason about this
- For missing access, inspect object state, tenant, membership, assignment, license status, and target-resource authorization in that order.
- For SSPR failure, separate population scope from registration state, method availability, and account-type restrictions.
More detail
- Administrators can create cloud identities, update profiles, control group membership, assign supported licenses, invite external users, and block or delete accounts as lifecycle events require.
- SSPR policy defines who may reset and which methods are usable; successful operation also requires the user to satisfy registration and method requirements.
Ready for the quiz?
- Which properties and memberships must be correct before a new user receives the intended services?
- Why can a successfully invited guest still receive an authorization error?
- What would you inspect when SSPR works for one group but not another?
Related objectives
- D1.1.S1 — Create users and groups
- D1.1.S2 — Manage user and group properties
- D1.1.S3 — Manage licenses in Microsoft Entra ID
- D1.1.S4 — Manage external users
- D1.1.S5 — Configure self-service password reset (SSPR)