Can You Manage Users, Groups, and Administrative Units in Azure - Azure AD

You have accomplished the following:

• Created two new user accounts.
• Created two new group accounts.
• Manually added members to a group.
• Created a query to automatically add users to a dynamic group.
• Created a new administrative unit.
• Assigned the User Administrative role to the administrative unit.
• Added a user account as a member of the administrative unit.

 Sign in :- https://entra.microsoft.com

🧑‍💻 Create Student01

1. Sign in to the Microsoft Entra admin center.

2. In the left navigation pane, select Users > All users.

3. On the command bar, select New user.

4. In the User principal name field, enter: Student01

5. In the Display name field, enter: Student01

6. Clear the Auto-generate password checkbox.

7. In the Password field, enter: InitialPwd!-6256170

8. In the First name field, enter: Student01

9. In the Job title field, enter: IT Admin

10. In the Department field, enter: IT

11. Leave all other properties at their default values.

12. Select Create.

🧑‍💻 Create Student02

1. Still on the Users page, select New user again.

2. In the User principal name field, enter: Student02

3. In the Display name field, enter: Student02

4. Clear the Auto-generate password checkbox.

5. In the Password field, enter: InitialPwd!-6256170

6. In the First name field, enter: Student02

7. In the Job title field, enter: Sales Associate

8. In the Department field, enter: Sales

9. Leave all other properties at their default values.

10. Select Create.

• Create a Microsoft Entra Security group named IT Group using Assigned as the membership type.

Want to learn more? Review the documentation for guidance on creating a new group.

• Create a dynamic Security group named Sales group (Dynamic) that contains a query to automatically add users to the group with their department set to Sales.

Members of an assigned group type must be added or removed manually. Members of a dynamic group are added based on the results of the query that is attached to the group.

Want to learn more? Review the documentation for guidance on creating a dynamic group.

Check your work

Verify that you have created a new assigned group named IT Group.

Congratulations! You have created a new assigned group named IT Group

🔄 Refresh & Verify

• If the new users are not immediately visible, on the Users page command bar select Refresh (sometimes under the ellipsis …).

• Confirm that both Student01 and Student02 appear in the list of users.

Create user 1 like below

Create a group

• Open a new InPrivate or Incognito browser window, go to portal.azure.com, and then sign is as Student01@Hexelo62880149x3.onmicrosoft.com by using password InitialPwd!-6256170 as the password, and then when prompted, change the password to muma8tDz.

If prompted to stay signed in, select No.

Want to learn more? Review the documentation for guidance on Azure Portal supported browser devices.

You should be presented with a More information required window.You will provide the MFA information in the following step.

• In the InPrivate or Incognito browser window logged in as Student01, configure the additional security verification information for MFA, continue to authenticate to Azure by using the Microsoft Authenticator app.

Want to learn more? Review the documentation on using the Microsoft Authenticator app.

If prompted to stay signed in, select No.

If shown a Welcome to Microsoft Azure. We are glad you are here. window, select Cancel. Dismiss all other prompts.

Because there is no subscription associated with the directory tenant, the Welcome to Azure! home page will display.

• In Microsoft Entra ID, attempt to reset the password for Student02.

You cannot reset the password for student02 because you do not have sufficient administrative permissions.

Want to learn more? Review the documentation for guidance on resetting a password.

• Close the InPrivate or Incognito browser window, and then switch back to the browser window that is open to the Microsoft Entra admin center signed in using your administrative account LabAdmin@Hexelo62880149x3.onmicrosoft.com.

• Create a new Microsoft Entra administrative unit named IT Users, that has a description of Admin unit to delegate control over IT user accounts, and then assign Student01 the User Administrator role for the administrative unit.

Want to learn more? Review the documentation for guidance on creating an administrative unit

• Confirm that Student01 has been assigned the User Administrator role for the IT Users administrative unit, and then add Student02 as a member of the IT Users administrative unit.

Administrative units are used for delegation. If you assigned the User Administrator role to Student01 in the default directory, Student01 would be able to manage all user accounts in your Microsoft Entra ID. By creating the IT Users administrative unit and assigning the role only to that administrative unit, Student01 will only be able to manage users you add to the IT Users administrative unit.

more...

Want to learn more? Review the documentation for guidance on adding a user to an administrative unit..

• Open a new InPrivate or Incognito browser window, go to portal.azure.com, and then sign is as Student01@Hexelo62880149x3.onmicrosoft.com using muma8tDz as the password.

If prompted to stay signed in, select No.

Now that you have setup MFA for Student01, you should receive an MFA request via the Microsoft Authenticator app.

• In Microsoft Entra ID, reset the password for Student02.

Student01 should now be able to reset the password for Student02. This is because Student01 has User Administrator rights but only for the User members of the IT Users administrative unit.