Describing how external users and groups are used in Azure AD

Guest users and external users are invited to the Azure AD tenant and have access to resources that they have been authorized. This is helpful when someone outside your company needs access to an application to collaborate, or a partner or subsidiary company needs to be given access to resources.

Guests are invited from within the User tile by selecting + New Guest User and providing their external email address. Once they accept the invitation, they are now added to the Azure AD tenant and can be assigned permissions to authorize them access to resources.

In order to be able to create users in Azure AD, you will need to have the Global Administrator role or the User Administrator role. Since the best practice is to adhere to the principle of least privilege, the user administrator role assignment should be given to anyone that is required to create, configure, and manage users within Azure AD.

Once you are in...