Quartz 5

Lab: manage Entra user and group properties

Properties1
tagslab, az-104, entraid, users, groups

5 min read

Lab: manage Entra user and group properties

Outcome

Create a cloud-only training user and security group, change the user’s job properties and the group’s ownership/membership, verify the object IDs and effective membership, then diagnose a dynamic-group rule mismatch. This lab uses a training tenant; do not edit identities synchronized from on-premises Active Directory.

Before you begin

Sign in to the Microsoft Entra admin center with the least directory role that permits the task. The current Microsoft guidance identifies User Administrator for cloud-user creation and Groups Administrator or User Administrator for group membership. Use a unique training UPN in a verified domain, such as azlearn-lifecycle-<suffix>@<verified-domain>.

Do

  1. Go to Entra ID > Users > New user > Create new user. Create a cloud-only training member with an autogenerated temporary password. Do not share its password.
  2. Open the new user’s Properties. Set a clearly reversible job title and department, for example Azure learning trainee and Training. Save, then record the user’s Object ID, UPN, account-enabled state, department, and source of authority.
  3. Go to Entra ID > Groups > All groups > New group. Create an assigned Security group named azlearn-lifecycle-operators-<suffix>. Add the training user as a member and a separate training administrator as an owner.
  4. Open the group’s Members, Owners, and Properties pages. Record the group Object ID, membership type, one member, and one owner. Remove and re-add the training member to prove that an assigned group accepts manual membership changes.
  5. If your tenant supports the required dynamic-group capability, create a second training security group with a dynamic user rule matching the training department. Use Dynamic membership rules > Validate rules to test the user before relying on asynchronous group processing. Record the rule and validation result. If the feature is unavailable, document the tenant constraint and perform the validation exercise in a training tenant where it is available; do not fake a dynamic result with an assigned group.

Verify

Capture the two object IDs, the changed user properties, group owner/member lists, and—where available—the dynamic-rule validation output. You should now understand: a user property is data on an identity; an assigned group has administrators-managed membership; a dynamic group evaluates a rule and does not accept manual member changes.

Add and remove a training license

Use this extension only when a tenant administrator has reserved a disposable license seat. Do not consume a production entitlement. In Microsoft 365 admin center, open Billing > Licenses > Assign licenses, select the assigned training group, choose the reserved subscription, and leave only the planned training service plans enabled. Confirm that the cloud-only training user has a usage location before assignment. In Entra ID, open the user’s Licenses page and record the assignment path and effective services.

Remove the user from the licensed group, wait for the directory to process the change, and confirm that the inherited license disappears. Re-add the user only if you need to continue the exercise. If the group assignment reports insufficient licenses, conflicting service plans, or a missing location, capture the group/user error details, correct the specific prerequisite or use a reserved seat, and reprocess—do not assign a broader administrative role or a random paid subscription.

Break and fix

  1. Change the test user’s department so it no longer matches the dynamic rule. Use Validate rules to inspect which expression excludes the user. Restore the original department and validate again. Do not add the user manually to the dynamic group.
  2. Try to edit an identity, contact, or job property on a synchronized training user. The authoritative source is on-premises Active Directory, so stop and record the read-only/source-of-authority evidence. Fix the property at the source, then wait for the synchronization cycle; use the cloud-only training user for this lab’s edits.
  3. Attempt to add a member or owner with an account that lacks the required directory role. Capture the authorization failure, then use the designated training administrator. Do not grant a broad role merely to avoid learning the boundary.
  4. Attempt the group license assignment before setting the training user’s location, where the tenant presents that requirement. Capture the specific result, set the correct training location, and retry with the reserved license. Then remove the assignment during cleanup.

Scenario practice

  1. Configure: A help-desk team needs an access group whose membership follows department=Support. Choose assigned or dynamic membership and state who can safely edit the attribute.
  2. Diagnose: A user whose department appears correct is absent from a dynamic group. Which evidence distinguishes a rule expression error, an unprocessed update, and an on-premises source-of-authority issue?
  3. Distinguish: Contrast a group owner, a group member, a Microsoft Entra directory role, and an Azure RBAC role assignment. Which one grants the ability to manage the group object?
  4. Distinguish: Contrast a Microsoft Entra license, an Entra directory role, and Azure RBAC. Which grants a product entitlement, which permits directory administration, and which authorizes an Azure resource action?

Clean up

Delete the dynamic and assigned training groups, then delete the cloud-only training user. Confirm that no production role assignment, license, or application ownership remains. Do not delete a synchronized user from Entra as a substitute for deleting it from its on-premises source.

Sources and re-audit

Re-audit when Entra roles, source-of-authority behavior, group feature licensing, or the admin-center workflow changes.

User account · Microsoft Entra groups · Microsoft Entra ID · Security group · Identity path · All labs

Graph View

Backlinks