Episode 2 — Managing Users in Microsoft Entra ID

Episode 1 mapped the two planes of administration — the Microsoft Entra tenant for identities and Azure Resource Manager for resources — and the four inheriting scope levels. Now we step fully into the identity plane and work with its most basic object: the user.

Learning objectives

Distinguish the four user types of a workforce tenant (internal/external × member/guest) and how each one authenticates.
Create a new user in the Microsoft Entra admin center, completing the Basics, Properties, and Assignments tabs correctly.
Select the least-privileged Microsoft Entra role for creating, inviting, and deleting users.
Manage individual profile information, bulk edits, and tenant-wide user settings.
Delete and restore users, and state the soft-delete window and its licensing side effect.

Why it matters

Every access decision you will study later — group membership, licenses, RBAC assignments, SSPR policies — hangs off a user object. Creating that object with the wrong type, the wrong user principal name, or with an over-privileged admin role is the root cause of many real-world incidents and a favorite AZ-104 trap: the exam loves asking which role is the least privileged for a given user-management task, and what happens after you delete a user.

The user-type matrix

A Microsoft Entra workforce tenant distinguishes users along two independent axes: where the identity authenticates (internal to your tenant, or external) and what privilege level it holds (member or guest). That gives a 2×2 matrix:

	Member privileges	Guest privileges
Internal (account lives in your tenant)	Internal member — most likely a full-time employee. Credentials are in your tenant, managed by your administrators; the user can reset their own password.	Internal guest — an account in your tenant but with guest-level privileges; often created before B2B collaboration existed. Credentials managed by your admins.
External (authenticates elsewhere)	External member — authenticates to their home Microsoft Entra tenant; your tenant accepts them through federated sign-in. Common in multitenant organizations. A forgotten password is reset by their home admin.	External guest — a true guest. Sets up their own password via the link in the invitation email.

The practical difference is who manages the credentials: for internal users, you do; for external users, you never touch their password or lifecycle. Reviewing the default user permissions for members vs guests helps you pick the right quadrant before creating anything.

🧠 Mnemonic: Read the quadrant as two questions — "Whose door?" (internal = your tenant issues the credentials; external = they sign in at home) and "Which badge?" (member = staff badge, guest = visitor badge). Internal member: your door, staff badge. External guest: their door, visitor badge.

One paragraph on the other tenant flavor: a tenant in an external configuration exists exclusively for Microsoft Entra External ID scenarios (customer-facing apps). It has its own user types — internal users (typically admins), external users (consumers/business customers of your registered apps, with local accounts or external identity providers), and external guests. The portal there offers a dedicated Create new external user flow (sign-in by email instead of a UPN; no role or administrative-unit assignment). Know it exists; the exam focus stays on workforce tenants.

Creating a user in the portal

Sign in to the Microsoft Entra admin center (entra.microsoft.com) as at least a User Administrator, browse to Entra ID > Users, and select New user > Create new user. The wizard has four tabs: Basics, Properties, Assignments, Review + create.

Basics — the required core:

User principal name (UPN): a unique username plus a domain chosen after the @ (use Domain not listed to add a new one).
Mail nickname: derived from the UPN by default; uncheck Derive from user principal name to set a different one.
Display name: e.g. Chris Green.
Password: auto-generated by default; uncheck Auto-generate password to set your own initial password.
Account enabled: checked by default — uncheck it to prevent sign-in until you are ready (this setting was called Block sign in in the legacy flow).

Properties — optional details grouped into categories: Identity (first/last name, User type Member or Guest), Job information (title, department, manager), Contact information, Parental controls, and Settings (global location). On an existing user's profile a sixth category, On-premises, appears for accounts synced from Windows Server Active Directory — so the full profile spans six property categories, five of which you can fill at creation time.

The Parental controls category (think K-12 school districts) defines age groups: Minors are 12 and under, Not adult 13–18, Adults 18 and over — note the Microsoft docs overlap at 18; read adults as 18 and over. Combined with parental consent, this drives the Legal age group classification, which can limit the user's access. Not exam-critical, but know it exists.

Assignments — you can attach the new user, in this creation flow, to up to 20 groups or roles and exactly one administrative unit. These are portal-flow limits, not platform limits — you can add more assignments after creation.

Review + create — check the summary, select Create, done.

Inviting an external guest uses the sibling entry New user > Invite external user: you provide the guest's email address, a display name, and an optional invitation message; the guest's invitation state (e.g. PendingAcceptance, with a Resend invitation link) is tracked on the user's details. External users cannot be assigned to administrative units. The full B2B invitation and redemption story is Episode 5's topic.

Who can do what — least-privilege roles

Always use the least-privileged role that can do the job:

Task	Least-privileged role
Create a new user	User Administrator
Invite an external guest	Guest Inviter
Assign Microsoft Entra roles	Privileged Role Administrator
Delete non-admin users, Helpdesk Administrators, other User Administrators	User Administrator
Delete any user, including other administrators	Privileged Authentication Administrator

The deletion rows deserve attention: a User Administrator can delete any non-admin user, Helpdesk Administrators, and other User Administrators — but not admins holding other roles. Only the Privileged Authentication Administrator can delete any user, administrators included.

Managing the user profile

The user profile is the digital representation of an identity, surfaced across Outlook, Teams, Windows, and more — so it should reflect how the user wants to be represented. To edit one user: Entra ID > Users, select the user, then either

Edit properties (top of page) — the full property list opens in edit mode on the All category, with per-category tabs; or
the Properties tab — a read view where you edit one category at a time via the pencil icon next to its heading.

Either way, finish with Save.

Name guidance: first and last name should be what the user expects to see — the preferred name, which might not be the legal name (store the legal name in your HCM system). Use the display name field to implement your organization's display policy (e.g. Green, Chris for last-name-first), and don't use display name as an alternative name — that breeds inconsistent representation across apps, since Microsoft 365 shows either first+last name or the display name.

Profile picture: on the user's overview page, select the camera icon on the thumbnail (initials show when no image is set). The picture appears in Microsoft Entra ID and on the user's personal pages such as myapps.microsoft.com.

Bulk edit: from the All users page you can select up to 60 users at a time (another flow limit) and edit a fixed set of attributes at once — City, Company name, Country or region, Department, Employee hire date, Employee type, Job title, Office location, State or province, Street address, Usage location, Zip or postal code. Anything else requires visiting individual profiles.

Settings for all users

Tenant-wide toggles live under Entra ID > Users > User settings and require the Global Administrator role. The AZ-104-relevant ones:

Allow users to register their own applications.
Prevent non-admins from creating their own tenants; allow users to create security groups.
Restrict access to the Microsoft Entra administration portal for non-admins.
Guest user access restrictions, three levels: same access as members (most inclusive) → limited access to properties and memberships of directory objects → restricted to properties and memberships of their own directory objects (most restrictive).
Allow users to connect their work account with LinkedIn; the "Stay signed in?" prompt; external collaboration settings; user feature settings.

The hybrid caveat

For users whose source of authority is Windows Server Active Directory (synced via Microsoft Entra Connect), identity, contact, and job information must be edited on-premises, and you must wait for the next synchronization cycle before changes appear in the cloud. Exceptions: some Microsoft Entra ID attributes — notably Usage Location — are editable directly in the cloud, and a few synced attributes (User Principal Name, On-Premises Immutable ID, Account Enabled) can be changed in Entra ID, but only for emergency purposes.

Delete and restore

Deleting a user (Entra ID > Users, select the user, Delete user) is a soft delete:

The user disappears from All users but remains on the Deleted users page for 30 days, during which the account can be restored. Two facts to memorize: the 30-day restore window, and that any licenses the user consumed are freed immediately for other users at deletion.

Exercises

Exercise 2.1 — Create a test member user, least-privilege style

In a trial tenant, create an internal member user for Dana Reyes, a new employee in the Finance department, without using Global Administrator. State which role you sign in with, then create the user with a proper UPN, department, and one group assignment.

Solution

Role: sign in as User Administrator — the least-privileged role that can create users. Global Administrator works but violates least privilege; Guest Inviter can only invite external guests.

Steps:

Microsoft Entra admin center > Entra ID > Users > New user > Create new user.
Basics: User principal name dana.reyes@<yourtenant>.onmicrosoft.com; Display name Dana Reyes; keep Auto-generate password (note it for first sign-in); leave Account enabled checked.
Properties: Identity — First name Dana, Last name Reyes, User type Member; Job information — Department Finance.
Assignments: + Add group, pick the Finance group (this flow allows up to 20 groups/roles and exactly one administrative unit — UI limits, not platform limits).
Review + create > Create.

If you also needed to give Dana a Microsoft Entra role at creation, the creating admin would need Privileged Role Administrator for that part.

Exercise 2.2 — Who can delete a Helpdesk Administrator?

Your colleague holds the Helpdesk Administrator role and is leaving the company. The offboarding operator holds only the User Administrator role. Can they delete the account? What role would be required if the leaver were instead a Privileged Role Administrator?

Solution

Yes — a User Administrator can delete any non-admin user, Helpdesk Administrators, and other User Administrators. So the offboarding operator can delete the Helpdesk Administrator's account as-is.

If the leaver held a different administrator role (such as Privileged Role Administrator), User Administrator would not suffice: only a Privileged Authentication Administrator can delete any user, including other administrators.

Exercise 2.3 — Restore a deleted user

You deleted Dana Reyes's account yesterday by mistake. Restore it, and state (a) how long you had to act and (b) what happened to Dana's licenses at deletion.

Solution

Microsoft Entra admin center > Entra ID > Users > Deleted users page.
Select Dana Reyes and restore the user; the account returns to All users.

(a) The soft-delete window is 30 days — after that the user is permanently removed and cannot be restored. (b) At deletion, all licenses Dana consumed were released for other users, so verify and reassign licensing after the restore.

Key takeaways

Workforce-tenant users fit a 2×2 matrix: internal/external (where credentials live) × member/guest (privilege level); external members use federated sign-in to their home tenant, external guests set their own password from the invitation email.
Create users via Entra ID > Users > New user > Create new user: Basics (UPN + domain, mail nickname, display name, password, Account enabled), Properties, Assignments, Review + create.
The creation flow caps assignments at 20 groups or roles and 1 administrative unit — UI-flow limits, not platform limits.
Least privilege: create → User Administrator; invite guest → Guest Inviter; assign Entra roles → Privileged Role Administrator; delete any user including admins → Privileged Authentication Administrator.
Display name = preferred name, never an alternative name; legal names belong in the HCM system.
Tenant-wide User settings (app registration, portal restriction, three levels of guest access restrictions, LinkedIn) require Global Administrator; bulk property edit handles up to 60 users.
Users synced from Windows Server AD are edited on-premises (wait for the sync cycle); Usage Location is a notable cloud-editable exception.
Deletion is a soft delete: 30 days on the Deleted users page, restorable, with licenses freed immediately.

Quick recall

Q: An external member forgets their password. Who resets it? A: The administrator of their home Microsoft Entra tenant — your tenant only federates the sign-in; you never manage external users' credentials.

Q: Which role is the least privileged to invite an external guest? A: Guest Inviter.

Q: During user creation, how many groups, roles, and administrative units can you assign, and what kind of limit is that? A: Up to 20 groups or roles and exactly 1 administrative unit — a limit of the portal creation flow, not of the platform.

Q: Scenario — a User Administrator tries to delete (a) a standard user, (b) a Helpdesk Administrator, (c) a Global Administrator. Which succeed? A: (a) and (b) succeed; (c) fails — deleting other administrators requires Privileged Authentication Administrator.

Q: You deleted a user 3 weeks ago. Can you still restore them, and where? A: Yes — the soft-delete window is 30 days, via the Deleted users page.

Q: A synced user's job title is wrong in the cloud. Where do you fix it? A: In Windows Server Active Directory (the source of authority), then wait for the next synchronization cycle.

Coming up

One user at a time doesn't scale. Episode 3 moves to groups: Security vs Microsoft 365 group types, assigned vs dynamic membership, the surprising limits of group nesting, and the patterns for granting access to many users at once.