Implement and manage Microsoft Entra identity and access
Identity objects and delegation
Users are cloud-only, synced from AD DS, or guests invited through B2B collaboration. Groups are assigned or dynamic: dynamic user rules rely on supported attributes (for example user.department -eq "Sales") and dynamic device rules rely on device attributes; a dynamic group must be converted to assigned before its rule can be edited. Administrative units scope a role to a subset of users, groups, or devices for regional delegation, and Privileged Identity Management makes eligible role assignments time-bound and approval-gated.
Authentication methods
Microsoft Entra Password Protection blocks weak and banned passwords and can be pushed on-premises with a domain controller agent. Methods include Microsoft Authenticator (push, number matching, passwordless), FIDO2 security keys, Windows Hello for Business, certificate-based authentication, and Temporary Access Pass, a time-limited code used to bootstrap passwordless enrollment or recover a user. Security defaults are a fixed baseline; Conditional Access supersedes them and the two cannot be enabled at the same time.
Conditional Access and governance
A policy is assignments (users and groups, cloud apps, conditions such as sign-in risk, device platform, location, client app) plus controls (block, or grant: require MFA, compliant or hybrid-joined device, approved client app, authentication strength) plus session controls (sign-in frequency, persistent browser, app-enforced restrictions). Layer Identity Protection risk policies, self-service password reset with on-premises writeback, access reviews for group and guest membership, and entitlement management access packages.
Worked example: a policy that blocks legacy authentication is built as a block policy whose condition is Client apps = Other clients; it is not a grant control. Build it in report-only mode first, exclude two cloud-only break-glass accounts, and confirm impact in sign-in logs before enabling.
Traps: requiring a license tier you did not buy (Conditional Access needs P1), assigning to All users without exclusions, and confusing authentication strength with per-user MFA.