Manage Azure Identities and Governance
Manage Microsoft Entra users and groups, assign RBAC roles, and apply governance controls like Azure Policy and management groups.
Microsoft Entra ID: users, groups, and licenses
Microsoft Entra ID (formerly Azure AD) is the identity store behind every Azure subscription. Administering it is the first responsibility of an Azure Administrator, separate from managing resources themselves.
Core objects
- User: a single identity, either cloud-only or synced from on-premises Active Directory via Microsoft Entra Connect.
- Group: a collection of users (or devices) used to assign access or licenses in bulk instead of one at a time.
- Assigned group: members are added and removed manually.
- Dynamic group: membership is driven by a rule evaluated against user or device attributes.
Bulk operations
- Bulk create, invite, and delete users through CSV templates in the Entra admin center.
- Guest users (B2B) let external accounts sign in and be assigned access without creating a managed identity for them.
Common confusion
- A group license assignment applies to every current and future member automatically; direct user license assignment does not follow group membership changes.
Role-based access control (RBAC)
RBAC controls *what* an already-authenticated identity can do on Azure resources. It is layered on top of authentication, not a replacement for it.
Key concepts
- Role definition: a collection of permissions, such as Reader, Contributor, Owner, or a custom role.
- Role assignment: binds a security principal (user, group, or service principal) to a role definition at a scope.
- Scope: the boundary the assignment applies to — management group, subscription, resource group, or a single resource.
- Inheritance: a role assigned at a higher scope flows down to every child scope beneath it.
Built-in role comparison
- Owner: full access, including the ability to assign roles to others.
- Contributor: full access to manage resources, but cannot grant access to others.
- Reader: can view resources but not change them.
- User Access Administrator: manages role assignments without managing the resources themselves.
Design principle
Assign roles at the highest scope that makes sense and no higher — a subscription-wide Contributor assignment is harder to audit and reason about than one scoped to a single resource group.
Azure Policy, management groups, and resource locks
Governance tools constrain *how* resources can be configured, on top of RBAC's control over *who* can act on them.
Management hierarchy
- Management groups sit above subscriptions and let policies and RBAC roles apply across many subscriptions at once.
- Subscriptions contain resource groups; resource groups contain resources.
Azure Policy
- A policy definition evaluates resources against a rule, for example requiring a specific region or tag.
- Effects include Deny (block non-compliant requests), Audit (log but allow), and Append (add a missing field automatically).
- An initiative groups related policy definitions so they can be assigned together.
Resource locks
- CanNotDelete: resources can still be read and modified, but not deleted.
- ReadOnly: no changes or deletions are permitted, including by an Owner, until the lock is removed.
- Locks apply at the scope they're set on and inherit downward, independent of RBAC permissions.