Azure Basics · Module 01

Identity – Microsoft Entra ID (Azure AD), Users and Groups

Understand tenants, subscriptions and identities in Microsoft Entra ID, pick the right edition, then create users and groups and scope admin rights with Administrative Units.

Practice interactively →

What you will learn

• Tell identities, accounts, tenants and subscriptions apart
• Compare Entra ID with on-premises AD DS
• Choose an edition by feature; describe Entra join and SSPR
• Create users and groups and add members with `az ad`
• Scope administration with Administrative Units

Lessons

1. What Microsoft Entra ID Is — Tenants, Subscriptions and Identities

   Entra ID (formerly Azure AD) manages identities in the cloud; the tenant is the organisation's "directory", the subscription is the billing unit for resources.

2. Comparing AD DS and Microsoft Entra ID

   AD DS uses LDAP, Kerberos, OUs and GPOs on the internal network; Entra ID is an identity service for the web, queried over REST and authenticating with SAML, WS-Fed and OpenID Connect.

3. Editions, Microsoft Entra Join and SSPR

   Free covers basic identity; P1 adds Conditional Access, hybrid features and dynamic groups; P2 adds Identity Protection and PIM. Entra join puts Windows devices into the tenant; SSPR lets users reset their own passwords.

4. Users, Bulk Users and Groups

   Create users and groups in the portal, from CSV or with `az ad`; groups are Security or Microsoft 365 type, with Assigned or Dynamic membership.

5. Administrative Units

   An Administrative Unit restricts the scope of an admin role to a set of users, groups or devices, such as one branch office.