1.1 - Manage Microsoft Entra ID identities (users, groups, domains)
AZ-104 objective 1.1 covers managing Microsoft Entra ID identities and the directory itself. You create and manage users and groups, and you must tell a security group, which can hold nested groups and be assigned an Azure RBAC role, apart from a Microsoft 365 group built for collaboration and a distribution list that only routes email. Group membership is either assigned manually or driven automatically by dynamic rules. You add and verify a custom domain by creating a TXT or MX record at your DNS provider, then set it as primary so new accounts get the new suffix by default. External collaboration invites a partner as a guest through B2B using their own credentials, and the most restrictive setting limits what guests can enumerate in the directory. Self-service password reset lets users unlock their own accounts without the helpdesk, users manage their own registered methods under security info, and administrative units scope role administration to a subset of the directory. Entra ID Governance bundles an eligible role, an access review and an expiration into an access package that users request. Expect scenarios that ask which identity object or feature fits.
Nestable and RBAC-assignable = security group; mailbox and SharePoint = Microsoft 365 group. Prove domain ownership with a TXT record. Invite a partner with their own credentials = B2B guest. Users reset their own password = self-service password reset.
Practice questions
1. Twenty new employees must all receive the same set of Azure permissions. What is the recommended way to grant them access?
- Assign the role to an Entra ID group and add the users to it (correct answer)
- Assign the role separately to each individual user account every single time a new person joins the team
- Make every user a subscription Owner
- Create one custom role per user
Assigning an RBAC role to a group and adding users to that group scales cleanly: membership changes automatically inherit the role. Per-user assignments are tedious and error-prone, Owner is over-privileged, and one custom role per user is unmanageable.
2. You must let a helpdesk admin reset passwords only for users in the Sales department, not the whole tenant. Which Entra feature scopes this?
- Administrative units (correct answer)
- A tenant-wide Password Administrator role assigned across the entire organization directory
- A dynamic distribution list
- Conditional Access
Administrative units let you scope a directory role to a subset of users or groups, such as one department. A tenant-wide role would grant far too much, distribution lists are for mail, and Conditional Access governs sign-in conditions.
3. Which type of Entra ID group can be assigned an Azure RBAC role and can also contain other groups as members?
- A security group (correct answer)
- A Microsoft 365 group, which is built mainly to give a team a shared mailbox, calendar and SharePoint site
- A distribution list
- A mail-enabled security group only
Security groups are used to manage access to Azure resources through RBAC and can be nested. Microsoft 365 groups are built for collaboration (mailbox, calendar, SharePoint), distribution lists only route email, and mail-enabled security groups cannot be managed through the standard groups blade.
4. You must create 500 user accounts at once from a spreadsheet in the Entra admin center. Which feature should you use?
- Bulk create with a CSV file (correct answer)
- Adding each user one at a time through the New user form and typing all of their properties by hand
- A dynamic membership rule
- A group-based license
Bulk create imports a downloadable CSV template listing many users, creating them in one operation. Adding them one by one is slow and error-prone, a dynamic rule governs group membership not account creation, and group-based licensing assigns licenses, not accounts.
5. An external consultant from another company must access one shared resource using their own corporate email. How do you add them to your tenant?
- Invite them as a B2B guest user (correct answer)
- Create a brand-new internal member account for them and hand over a fresh password that they must change at first sign-in
- Add them to a distribution list
- Assign them a Microsoft 365 license
A B2B guest invitation lets the external person sign in with their existing corporate identity, so you never manage a password for them. Creating an internal member duplicates their identity and adds credential overhead, a distribution list is for mail, and a license does not grant tenant access.
6. You want a group whose membership automatically includes every user whose department attribute equals Sales. What group membership type do you choose?
- Dynamic user (correct answer)
- Assigned, where an administrator has to manually add and remove each member whenever anyone changes department
- Dynamic device
- Mail-enabled
A dynamic user group evaluates a rule against user attributes and updates membership automatically. Assigned membership requires manual maintenance, dynamic device targets devices rather than users, and mail-enabled concerns email delivery.