Manage Azure identities and governance

Microsoft Entra ID basics

• Microsoft Entra ID (formerly Azure Active Directory) is the identity service for a tenant. A tenant is a dedicated directory. A subscription trusts exactly one tenant, but one tenant can be trusted by many subscriptions.
• Entra roles (Global Administrator, User Administrator, Groups Administrator and so on) manage the directory itself. Azure roles (Owner, Contributor, Reader) manage Azure resources. They are separate systems. A Global Administrator has no access to subscriptions until they use Elevate access (which grants User Access Administrator at the root scope).
• Custom domains need a DNS TXT or MX record to prove ownership. The initial domain is tenant.onmicrosoft.com.
• Editions: Free, P1, P2 (plus Microsoft Entra Suite). P1 adds group-based licensing, dynamic groups, conditional access and SSPR writeback. P2 adds Identity Protection and Privileged Identity Management (PIM).

Users and groups

Creating and managing users

az ad user create --display-name "Ana Lopez" --user-principal-name ana@contoso.com --password "<temp>" --force-change-password-next-sign-in true
az ad group create --display-name "Helpdesk" --mail-nickname helpdesk
az ad group member add --group Helpdesk --member-id <user-object-id>

New-MgUser -DisplayName "Ana Lopez" -UserPrincipalName ana@contoso.com -MailNickname ana -AccountEnabled -PasswordProfile @{Password="<temp>"}

• Bulk operations: the portal accepts a CSV template for bulk create, invite, delete and group membership.
• Properties you edit: job info, contact info, usage location (required before assigning a licence), authentication methods. Deleting a user soft-deletes it for 30 days, during which it can be restored.
• Administrative units scope Entra admin roles to part of the directory (for example a helpdesk who can reset passwords only for one department).

Groups

• A group can hold other groups (nesting) for access assignment but nested groups don’t inherit licences in group-based licensing.
• Role-assignable groups are created with isAssignableToRole set; it can’t be changed later, and these groups can’t be dynamic.
• A group can’t be both dynamic and have its members edited by hand. Switching type is possible, but the existing members are re-evaluated.

Licences

• Licences (Entra ID P1/P2, Microsoft 365) are assigned to a user or to a group (group-based licensing needs P1). The user needs a usage location first, or assignment fails.
• Group-based licensing shows errors (not enough licences, conflicting service plans) in the group’s Licenses blade. Fix the cause, then Reprocess.
• Removing a user from the group removes the licence the group gave them.

External users

• Invite guests with B2B collaboration: portal Users > Invite external user, or New-MgInvitation. The guest redeems the invitation with an email one-time passcode, a Microsoft account, a Google account or their own Entra tenant.
• External collaboration settings control who can invite (everyone, members only, specific admins, nobody) and which domains are allowed or blocked.
• Guests get limited directory permissions by default. Add them to groups to give them Azure RBAC access, and use access reviews (P2) to remove stale guests.
• Resend or manage an invite from the guest’s profile. An unredeemed invitation shows as pending.

Self-service password reset (SSPR)

• Enable per tenant with scope None, Selected (a group) or All.
• Configure the number of methods required to reset (1 or 2), the registration requirement at sign-in, and notifications. Methods include mobile app notification or code, email, phone call, SMS, security questions (not for admins).
• Administrators always use a strong two-method policy by default.
• Password writeback to on-premises AD needs P1 and Entra Connect (or Cloud Sync). Without writeback, a synced user can’t reset an on-premises password in the cloud.
• Trap: SSPR works for cloud users on the Free tier only for a limited path. Anything beyond the basics (writeback, customised options) is P1.

Azure RBAC

Role-based access control is the authorisation system for Azure Resource Manager. An assignment is who (security principal) + what (role definition) + where (scope).

Scopes and inheritance

Management group  ->  Subscription  ->  Resource group  ->  Resource

Assignments inherit downwards. Assign at the lowest scope that works. You can’t remove an inherited assignment at a lower scope; you can only add more access. Azure RBAC is additive: a user’s effective access is the union of all assignments. The only thing that subtracts is a deny assignment (created by Azure Blueprints/managed apps, not by you directly).

Built-in roles to know

• Management plane vs data plane: Contributor on a storage account lets you manage the account and list its keys, but does not by itself give Entra-based access to blob data. Use Storage Blob Data * roles for that.
• Custom roles are JSON: Actions, NotActions, DataActions, NotDataActions, AssignableScopes. Create with az role definition create --role-definition role.json. They can be assigned at the scopes listed in AssignableScopes.
• Limits to remember: 4,000 role assignments per subscription; 5,000 custom roles per tenant.

Assigning and reading access

az role assignment create --assignee user@contoso.com --role "Reader" --scope /subscriptions/<sub>/resourceGroups/rg-app
az role assignment list --assignee user@contoso.com --all --output table
az role definition list --name "Contributor"

New-AzRoleAssignment -SignInName user@contoso.com -RoleDefinitionName "Reader" -ResourceGroupName rg-app
Get-AzRoleAssignment -ObjectId <id>

• Access control (IAM) blade: Check access shows a user’s effective roles at that scope. Role assignments lists assignments including inherited ones. Roles lists definitions. Deny assignments shows blocks.
• Interpreting assignments: add up roles from every scope above the resource, plus group memberships. If one assignment is Reader on the subscription and another is Contributor on rg-app, the user can write inside rg-app and only read elsewhere.
• Assign to groups, not individuals. Use PIM (P2) for just-in-time elevation (eligible assignments).
• Classic administrators (Service Administrator, Co-Administrator) are retired. Use RBAC.

Azure Policy

Azure Policy evaluates resource properties and enforces rules. It doesn’t grant access.

• A policy definition holds the rule (if condition, then effect). An initiative (policy set) bundles definitions. An assignment applies either to a scope, with optional exclusions and parameters.
• Policies are inherited down the scope hierarchy from management group to resource.

• Policy only evaluates on create/update and on a compliance scan (about every 24 hours, or on demand with az policy state trigger-scan). Existing resources aren’t changed by Deny; they just show non-compliant.
• To fix existing resources with Modify or DeployIfNotExists, create a remediation task. The assignment’s managed identity needs the role listed in the definition.
• Exemptions (waiver or mitigated) exclude a specific resource or scope from an assignment with an expiry.
• Typical built-ins: Allowed locations, Allowed virtual machine size SKUs, Require a tag and its value, Inherit a tag from the resource group.

az policy assignment create --name allowed-loc --policy e56962a6-4747-49cd-b67b-bf8b01975c4c \
  --scope /subscriptions/<sub> --params '{"listOfAllowedLocations":{"value":["westeurope","northeurope"]}}'

Policy versus RBAC

Resource locks

• Two lock levels: CanNotDelete (read and modify allowed, delete blocked) and ReadOnly (acts like Reader for everyone, including owners). Locks can be set on a subscription, resource group or resource and inherit downwards.
• Locks apply to everyone, regardless of RBAC role. To remove one you need Microsoft.Authorization/locks/* (Owner and User Access Administrator have it).
• Traps: a ReadOnly lock on a storage account stops listing keys (a POST operation), so Azure Files and some portal actions break. A ReadOnly lock on a resource group stops a VM start or restart that needs a write. A lock on a resource group blocks deleting resources in it, and an RG with a lock can’t be deleted.
• Locks protect against management-plane actions only. They don’t stop data inside a database or blob from being changed.

az lock create --name keep --lock-type CanNotDelete --resource-group rg-prod

Tags

• Tags are name/value pairs for organisation, cost reporting and automation. Up to 50 tags per resource or resource group. Name up to 512 characters (128 for storage accounts), value up to 256.
• Tags are not inherited by default. Resources in a group do not automatically carry the group’s tags. Use policy (Inherit a tag from the resource group, with Modify) or a script.
• Tagging a resource group doesn’t tag its contents, and moving a resource keeps its tags. Tags appear in cost analysis only for usage after they were applied.
• Tags are not a security boundary and aren’t encrypted.

az tag update --resource-id <id> --operation merge --tags Dept=Finance Env=Prod
az resource list --tag Dept=Finance

Resource groups

• A resource group is a logical container. It stores metadata in a Region, but resources inside can be in any Region. Deleting a group deletes everything in it.
• A resource belongs to exactly one group. Groups can’t be nested and can’t be renamed.
• Moving resources: az resource move. The source and destination groups are locked for writes during the move, the resource ID changes, and not every type is movable. Moving to a new subscription needs both subscriptions under the same tenant. Moving a resource doesn’t change its Region.
• Use az group create/delete/list, and export template from a group to capture current state.

Subscriptions

• A subscription is a billing and access boundary and a quota boundary. It trusts one tenant.
• Change directory moves the subscription to another tenant, which removes all role assignments and managed identities and affects some resources (for example Key Vaults need fixing).
• Transfer billing ownership moves the commercial relationship (billing account) without changing resources. Cancel a subscription: resources stop, and the subscription enters a disabled state, then deletion after 90 days.
• States: Active, Disabled, Warned, Past due, Expired. Each subscription has a name and an ID (GUID); the name can be changed.
• Quotas (for example vCPUs per Region) are raised with a support request (quota request), not by RBAC.

Management groups

• A hierarchy above subscriptions, so policy and RBAC can apply to many subscriptions. There is a built-in root management group (the tenant root group). Up to six levels of depth (not counting the root and subscription level) and 10,000 management groups per directory.
• A management group has one parent. A subscription belongs to exactly one management group.
• Assignments on a management group inherit to all child groups and subscriptions.
• By default every new subscription goes to the default management group (the root, unless you change it). To manage the hierarchy you need Azure RBAC on the group; to move a subscription you need write on both sides.

az account management-group create --name mg-prod --display-name "Production"
az account management-group subscription add --name mg-prod --subscription <sub-id>

Cost management

• Cost analysis shows spend by scope, tag, service or Region. Budgets define a threshold on a scope (subscription, resource group, management group) with alerts at percentages of actual or forecast cost. A budget only alerts or triggers an action group. It does not stop spending. To act on a breach, link an action group to run automation (such as stopping VMs).
• Cost alerts include budget alerts, credit alerts, department spending quota alerts, and anomaly alerts.
• Azure Advisor gives recommendations in five pillars: Reliability, Security, Operational excellence, Performance, Cost. Cost recommendations include resizing or shutting down underused VMs, buying reservations and savings plans. You can postpone or dismiss recommendations, and set alerts for new ones.
• Other cost levers: Azure Hybrid Benefit, reserved instances (1 or 3 years), spot VMs, auto-shutdown, and right-sizing with Advisor.
• Budgets need Cost Management Reader at minimum to view, Contributor to create.