User account

What it is

A user account is a Microsoft Entra identity record that represents a person who can sign in. It has a unique object ID in a tenant, sign-in information, and properties such as name and department. A user account proves who someone is; it does not automatically give that person permission to manage Azure resources.

Why it exists

People need a consistent identity to sign in, use applications, reset passwords, and receive access through groups or assignments. Microsoft Entra authenticates the identity; resource services decide what that identity is allowed to do.

Key ideas

• UPN is a sign-in-style name such as [email protected]. It is not the immutable object ID and should not be confused with an email address or a resource permission.
• Cloud-only and synchronized accounts have different sources of authority. A cloud-only account is managed in Entra; changes for an account synchronized from on-premises Active Directory usually originate in that on-premises directory.
• Member and guest are directory user types, not permission levels. An external collaborator can be an external guest or external member depending on the scenario. Either still needs appropriate app, group, or Azure RBAC access.
• Directory roles and Azure roles differ. An Entra directory role can allow identity administration. An Azure RBAC role authorizes actions on Azure resources at a scope such as a subscription or resource group.
• Account lifecycle matters. Administrators can block sign-in, remove access, or delete an account. Deleted users remain restorable for a limited period, so offboarding should also remove group and resource access deliberately.

Northwind example

Maya creates an account for Luis, a new Northwind app owner, with the UPN [email protected]. Adding Luis to the Order-App-Operators group gives him the application role the group was designed to grant. It does not make him an Azure subscription administrator. Maya separately assigns the minimum Azure RBAC role at the order application’s resource group. When a partner joins for a short review, Maya invites them as a guest and grants only the specific group or resource access they need.

How it fits (diagram)

Exam notes

• Authentication identifies the user; Azure RBAC authorizes resource actions.
• A UPN is a user property, while the object ID is the durable identifier useful in investigations.
• Guest/member type does not replace least-privilege group, application, or Azure RBAC assignments.

Related

entraid · groups · tenant · service-principal · mfa

📘 Source: Microsoft Learn — Create, invite, and delete users