Creating and managing users is central to administrating an information system—whether that system is an application on a small network, an enterprise-scale directory, or a cloud service hosted by a SaaS provider. In any instance, identities are used by people, applications, and devices to authenticate and perform activities.

In the context of Azure AD, there are three core types of identity:

• Cloud-based users
• Synchronized users
• Guest users

When planning out identity scenarios, it’s important to understand the benefits, features, drawbacks, and capabilities associated with each type of identity and authentication scheme—including ease of provisioning, integration with existing directory or security products, requirements for on-premises infrastructure, and network availability.

In this section, you’ll learn about managing each of these user types.

Creating and Managing Cloud Users

From an Azure...

If you’re familiar with using an email application such as Outlook, you’re probably familiar with the concept of a contact. A contact in Azure AD or Exchange Online is used for the same purpose—to provide a stored entry in the organization’s address book that can be used as an email recipient. A contact object can be used to reference any mail-enabled recipient—whether it’s an individual’s personal email account, an individual at an organization, a distribution or mailing list, or some sort of shared recipient.

Unlike users, contact objects are not security principals—that is, they have no login identity or password connected to them. Contact objects, however, can be made members of the distribution lists.

Contact objects can be created in either the Microsoft 365 admin center or the Exchange admin center.

Microsoft 365 Admin Center

The Microsoft 365 admin center provides a streamlined...

Groups are directory objects used to perform operations, grant rights or permissions, or communicate with one or more users collectively. In Azure Active Directory, there are several kinds of groups:

• Security groups – This type of group is typically used for granting permissions to resources, either on-premises or in Azure AD.
• Distribution lists or distribution groups – These groups are usually used for sending emails to multiple recipients, though they can also sometimes be used to restrict the scope of rules or for filtering purposes in Azure AD, SharePoint Online, and Exchange Online.
• Microsoft 365 groups – Formerly called modern groups (and sometimes still referred to as unified groups), this is an all-purpose group type that can be used as a security group for assigning permissions to resources or a distribution group for handling email. Microsoft 365 groups are special objects that are connected to SharePoint Online...

If identity is the foundation for security in the Microsoft 365 platform, licensing is the entitlement engine that is used to grant identities access to the tools and applications.

Every Microsoft 365 service is tied to a license—whether that’s individual product licenses for Exchange Online or SharePoint Online or bundled offerings such as Microsoft 365 G3 that include multiple services.

In Microsoft terminology, there are a number of key terms to be aware of:

• Licensing plans: In broad terms, a licensing plan is any purchased licensing item. For example, standalone Exchange Online P2 and Microsoft 365 E3 are both examples of licensing plans.
• Services: Also known as service plans, these are the individual services that exist inside of a licensing plan. For example, Exchange Online P2 has a single Exchange Online P2 service plan, while Microsoft 365 E3 has an Exchange Online service plan, a Microsoft...

While many organizations will deploy a hybrid identity solution and manage accounts on-premises, you may face scenarios where you need to manage cloud identities or guests in bulk (such as when creating bulk guest user invitations or during a tenant-to-tenant migration procedure).

These operations can be performed in several ways, including through the Microsoft 365 admin center, the Azure AD portal, and various PowerShell commands.

Microsoft 365 Admin Center

The Microsoft 365 admin center allows you to perform bulk user additions, either interactively or by uploading a specially-formatted CSV.

To begin the process, select Add multiple users on the Active users page of the Microsoft 365 admin center, as shown in Figure 2.32:

Figure 2.32 – Active users page

On the Add multiple users flyout, you can choose to either enter basic details interactively (up to 249 users) or you can download a CSV template with...

In this chapter, you learned some of the basics of administering objects on the Microsoft 365 platform, whether those objects were on-premises or cloud only. Managing identity is a large part of the Microsoft 365 administration experience, so it’s important to have a firm grasp on the variety of tools and methods for provisioning, licensing, and updating objects.

In the next chapter, you’ll learn how to manage roles in Microsoft 365.

Benchmark Score: 75%

Apart from a solid understanding of key concepts, being able to think quickly under time pressure is a skill that will help you ace your certification exam. That’s why, working on these skills early on in your learning journey is key.

Chapter review questions are designed to improve your test-taking skills progressively with each chapter you learn and review your understanding of key concepts in the chapter at the same time. You’ll find these at the end of each chapter.

Before You Proceed

You need to unlock these resources before you start using them. Unlocking takes less than 10 minutes, can be done from any device, and needs to be done only once. Head over to the start of Chapter 7, Managing Security Reports and Alerts by Using the Microsoft 365 Defender Portal in this book for instructions on how to unlock them.

To open the Chapter Review Questions for this chapter, click the following...