Implement and manage user identities
Know the objects
Microsoft Entra ID (formerly Azure AD) stores users that are cloud-only, synchronized from AD DS via Connect Sync or Cloud Sync, or invited as B2B guests. Groups are security or Microsoft 365, with assigned or dynamic membership. Dynamic user rules look like user.department -eq "Sales" -and user.accountEnabled -eq true; device rules use device properties. Administrative units scope admin roles to a subset of users, groups, or devices. Licenses come from a subscription and are assigned directly or through group-based licensing.
Traps to expect
- Group-based licensing needs a usage location set on every user first; without it the assignment errors out.
- Dynamic groups, custom banned passwords, and SSPR password writeback all require Entra ID P1.
- A group is either assigned or dynamic, never both; switching membership type discards manual members.
- Removing a user from a group removes that group's licenses, but directly assigned licenses persist.
- For synced users the on-premises directory is the source of authority, so most attributes cannot be edited in the cloud.
SSPR and password protection
Self-service password reset needs two authentication methods by default; writeback to on-premises AD requires P1 plus the on-premises agent. Smart lockout and the global or custom banned password lists apply in the cloud and, with the DC agent, on-premises too.
Rule of thumb
Membership drives licenses. If a licensed user loses access, check group membership first, then usage location, then conflicting service plans.