Manage Azure identities and governance Study Guide — AZ-104

Manage Azure Identities and Governance

Microsoft weights this domain at 20–25% of the AZ-104 exam, tied with compute as the largest. It tests your ability to manage identities in Microsoft Entra ID (formerly Azure Active Directory), control access using RBAC, enforce compliance with Azure Policy, structure subscriptions with management groups, and apply governance controls including resource locks, tags, and Cost Management. Questions are scenario-based: you are given a business requirement and must select the correct service, configuration, or sequence of steps.

Microsoft Entra ID Users, Groups, and Group-Based Licensing

Users

Microsoft Entra ID supports three user account types:

Key user facts:

• Deleted users are soft-deleted and recoverable for 30 days.
• Bulk operations (create, invite, delete) are done via CSV upload in the portal or PowerShell/CLI.
• The UsageLocation property must be set before assigning a license to a user.
• UserPrincipalName (UPN) must be unique within the tenant.

Groups

Dynamic group rules use membership rules evaluated automatically when user attributes change. Changes propagate within minutes but can take up to 24 hours.

Group-Based Licensing

• Requires Entra ID P1 (or Microsoft 365 that includes it).
• Assign licenses to a group; all members inherit the license.
• If a license cannot be assigned (no available seats, conflicting plans), the user enters a licensing error state — you must resolve manually.
• Nested group membership does not inherit licenses — only direct members get licenses.

Common traps:

• Forgetting to set UsageLocation before license assignment — this is a required field.
• Assuming nested groups propagate licenses — they do not.
• Believing dynamic groups are available in the Free tier — they require P1.
• Confusing Security groups (used for RBAC/policy) with Microsoft 365 groups (collaboration-focused).

Worked scenario: A company wants to automatically assign an Office 365 E3 license to all users in the Marketing department as they join. Solution: Create a dynamic Security group with rule department -eq "Marketing", then assign the E3 license to that group. This requires Entra ID P1.

Self-Service Password Reset and External Users

Self-Service Password Reset (SSPR)

SSPR registration portal: https://aka.ms/ssprsetup
SSPR reset portal: https://aka.ms/sspr

External Users (B2B)

• Invited via Entra External Identities / B2B collaboration.
• Guest users use their own organization's credentials (or a Microsoft/Google account).
• Default guest permissions are limited: they cannot enumerate users/groups by default.
• Guest access restrictions can be tightened or relaxed in External Collaboration Settings.
• Guests are counted against the Entra ID P1/P2 license model using a 1:5 ratio: one paid Entra ID P1/P2 license covers up to 5 guest users.
• You can bulk invite guests using a CSV file.

Common traps:

• Assuming SSPR for all users works on the Free tier — it requires P1 for non-admin users.
• Forgetting password writeback requires both Entra Connect AND a P1 license.
• Thinking admin accounts can be configured to use only 1 reset method — they always need 2.
• Confusing B2B (partner/external user) with B2C (customer identity management — a separate service).