Users, Bulk Users and Groups

Azure Basics · Identity – Microsoft Entra ID (Azure AD), Users and Groups · Lesson 4 of 5

Create users and groups in the portal, from CSV or with `az ad`; groups are Security or Microsoft 365 type, with Assigned or Dynamic membership.

Users

Everyone needs an account to be authenticated and authorized; profile data (job title, photo, contact) is optional.
Managing users needs the User Administrator or Global Administrator role.
Deleted users sit in "Deleted users" and can be restored for 30 days; after that they are gone for good.
Bulk create/delete with the CSV template downloaded from the portal; follow activity in the sign-in and audit logs.

Groups

Group type	Used for
Security	Granting access to resources, apps, licences
Microsoft 365	Collaboration: shared mailbox, calendar, SharePoint, Teams

Membership type	Meaning
Assigned	Added/removed by hand
Dynamic User	Rule on user attributes, for example `user.department -eq "DevOps"` (needs P1)
Dynamic Device	Rule on device attributes — Security groups only

flowchart LR
  U["az ad user create"] --> ID["Alice's object ID"]
  G["az ad group create devops-team"] --> M["az ad group member add"]
  ID --> M
  M --> L["az ad group member list"]

az ad user create --display-name "Alice Nguyen" --user-principal-name alice@example.com --password 'changeme-Example1!'
az ad group create --display-name devops-team --mail-nickname devops-team
az ad group member add --group devops-team --member-id <alice-object-id>

--member-id needs the object ID, not the UPN; get it with az ad user show --id alice@example.com --query id -o tsv. The password in the command is only a placeholder — in practice use a temporary password and force a change at first sign-in (--force-change-password-next-sign-in).

Command	Meaning
`az ad group member list --group devops-team -o table`	Members of the group
`az ad user delete --id alice@example.com`	Delete a user (restorable for 30 days)

Member and guest users

A member belongs to your organisation; a guest is invited through B2B and signs in with their own company or personal account. Guests have fewer default permissions, for example they cannot browse the whole directory. Invite one with the portal or New-MgInvitation in Graph PowerShell, and remove access when the project ends.

Names that matter

The user principal name (UPN), such as alice@example.com, is the sign-in name and must use a verified domain. The display name is only a label and can repeat. The object ID is the permanent GUID that role assignments and group memberships actually reference, so renaming a user does not break their access.

Working with groups

Each group can have owners who manage its membership without being directory admins.
Groups can be nested inside security groups, but some features, such as group-based licensing and some app assignments, do not follow nested membership.
Group-based licensing (P1) gives everyone in a group the same licences.
Access reviews (P2 or ID Governance) ask owners to confirm periodically who still needs membership.

Assign Azure roles and app access to groups rather than individual users; onboarding and offboarding then become a single membership change.

Useful commands

Command	Meaning
`az ad user update --id alice@example.com --set jobTitle=DevOps`	Change an attribute
`az ad group list --display-name devops -o table`	Find groups by name
`az ad group member check --group devops-team --member-id <id>`	Is this user a member?

A naming convention such as sg-<team>-<purpose> keeps hundreds of groups searchable.