Create Users and Groups in Microsoft Entra ID

Configure Advanced User Identity Attributes and Settings

Member and Guest Identities

In Microsoft Entra ID, administrators must distinguish between Member users and Guest users to maintain a secure environment. Internal employees are typically created as Member users and receive broad access to directory features, while external collaborators are invited as Guest users with highly restricted permissions. Setting specific attributes for these profiles ensures that users receive only the exact level of access they need to complete their tasks. This separation of roles forms the foundation of a least privilege security model across the cloud environment.

Authentication and Access Policies

Advanced identity security uses Conditional Access policies to enforce Multi-Factor Authentication (MFA) based on real-time signals. These policies evaluate specific conditions, such as the user's location or device health, before granting or blocking access to resources. To automate this process, administrators can enable risk-based policies using Microsoft Entra ID Protection to automatically detect and respond to suspicious sign-in behavior.

Key authentication methods include:

• Passwordless authentication: Allows users to sign in securely using biometrics or security keys.
• Temporary Access Pass (TAP): A time-limited passcode designed for initial device setup or credential recovery.
• Self-Service Password Reset (SSPR): Gives users the ability to safely reset their own passwords without administrator help.

Lifecycle Management and Managed Identities

Managing the user account lifecycle requires automating identity creation and deletion to eliminate potential security gaps. The provisioning state automatically creates accounts in cloud systems based on authoritative data from HR software, while the deprovisioning state immediately revokes access when an employee leaves the company. Removing these stale accounts prevents unauthorized users from accessing company resources.

To secure connections between services, administrators use Managed Identities to allow Azure resources to authenticate without storing hardcoded credentials. A system-assigned managed identity is tied directly to the lifecycle of a single Azure resource, while a user-assigned managed identity exists as a standalone resource that can be shared. Using these identities significantly reduces the risk of credential leaks during resource operations.

Types of managed identities:

• System-assigned: The identity lifecycle is bound directly to a single Azure resource and is deleted when the resource is deleted.
• User-assigned: The identity is created as an independent Azure resource and can be associated with multiple services.

Identity Governance

Maintaining long-term security requires administrators to regularly evaluate permissions through Access Reviews and Entitlement Management. These review systems prompt resource owners or managers to confirm if a user still requires access to a resource. Automating these evaluations for external guests helps identify inactive accounts and securely removes access when collaboration ends.

Create and Manage Azure AD Users and Groups

Access Management and Resources

Microsoft Entra ID simplifies access management by grouping individual users who require similar permissions to perform their tasks. Assigning permissions to a group rather than to individual users reduces administrative effort and ensures consistent access control. Administrators must manage access separately for each cloud resource to ensure that security boundaries are strictly enforced.

Microsoft Entra groups can manage access to various resources, including:

• Azure services
• SharePoint sites
• On-premises resources
• External SaaS apps

Assignment and Group Types

When creating a group, administrators must choose how to control its membership. Membership can be handled manually, dynamically based on user attributes, or synchronized from an external source. Selecting the correct assignment type helps align group management with organizational needs and operational capabilities.

Assignment types include:

• Direct assignment: The resource owner manually assigns specific users directly to a resource.
• Group assignment: A group is assigned to the resource, granting access to all of its members.
• Rule-based assignment: Group membership is automatically updated using queries based on user attributes.
• External authority assignment: Membership and access are managed by an outside directory, such as an on-premises system.

To maintain clean and manageable directories, organizations should implement standardized group management strategies. Allowing users to request group memberships through self-service options reduces the workload on technical support teams. Regular validation processes ensure that group permissions remain relevant as business requirements evolve.

Group management best practices include:

• Enable self-service group management: Allows users to create and manage their own groups to lower administrative overhead.
• Leverage sensitivity labels: Classifies and protects groups based on specific data security requirements.
• Automate membership with dynamic groups: Uses attribute rules to manage membership changes automatically.
• Conduct periodic access reviews: Verifies group memberships at scheduled intervals to maintain accurate access.

Group Membership and Role Assignment

Administrators must choose the correct group type and membership method during creation. Security groups are designed to secure access to applications and resources, while Microsoft 365 groups are configured to facilitate collaborative work. Additionally, memberships can be assigned manually or dynamically populated for both users and physical devices.

Group types include:

• Security groups: Used to distribute permissions and manage access to shared resources, devices, and service principals.
• Microsoft 365 groups: Used to establish shared mailboxes, calendars, and collaborative environments for internal and external members.

Membership types include:

• Assigned groups: Members are manually added and removed by group owners or administrators.
• Dynamic membership groups for users: Dynamic rules automatically add or remove users based on their directory attributes.
• Dynamic membership groups for devices: Dynamic rules automatically add or remove devices based on physical device properties.

Granting administrative permissions in the directory requires a structured role assignment. This assignment binds an identity to a specific set of permissions within a defined boundary of resources. Properly configuring these components ensures that administrators can perform their duties without receiving excessive rights.

Role assignment components include:

• Security principal: The user, group, or service principal that receives the permissions.
• Role definition: The specific collection of read, write, or delete permissions being granted.
• Scope: The exact boundary of Azure resources where the permissions are active.

Implement Dynamic Group Membership and Collaboration Policies

Dynamic Membership Rules

Using dynamic memberships in Microsoft Entra ID automates the management of Security groups and Microsoft 365 groups based on user attributes. Administrators write rules that evaluate attributes like job title or department, and the system automatically updates group membership when these attributes change. This automation reduces manual directory maintenance and ensures that permissions update instantly when a user changes roles.

To construct a dynamic group, administrators build membership rules using specific user or device characteristics. For example, a rule can be set to automatically add any user whose department attribute is marked as "Sales". Each group can only target either users or devices dynamically, so a single group cannot mix dynamic rules for both types.

Group-Based Access and Collaboration

Group-based access control is the primary method for managing resource permissions at scale. Instead of granting permissions directly to individuals, administrators assign roles to groups and let membership define who has access. To streamline this process further, organizations can bundle groups, applications, and SharePoint sites into access packages with built-in approval workflows.

Organizations must configure secure external collaboration policies to work with partners and vendors safely. Through Microsoft Entra External ID and B2B collaboration, external guests can access internal applications while continuing to use their own credentials. This integration relies on entitlement management and automated workflows to onboard external users and clean up their access when projects conclude.

Security Policies and Just-In-Time Access

To enforce high-security standards, organizations combine dynamic groups with advanced security tools. Conditional Access policies enforce strict rules, such as requiring MFA or blocking non-compliant devices from accessing group resources. Furthermore, Privileged Identity Management (PIM) protects sensitive groups by requiring users to request just-in-time activation before their administrative permissions become active.

Best practices for dynamic groups and collaboration include:

• Automate membership: Use dynamic rules to adjust memberships automatically and reduce human error.
• Leverage group-based licensing: Assign licenses to groups so new members automatically receive required software.
• Conduct periodic access reviews: Set up automated schedules to double-check that members still need access.
• Enable self-service group management: Provide users with managed workflows to request access, including naming policies and expiration dates.
• Assign multiple owners: Ensure at least two owners are assigned to every group to prevent orphaned groups.
• Use sensitivity labels: Classify groups to automatically apply security and encryption policies based on content sensitivity.