Manage Microsoft Entra users, groups, access, and subscriptions.
Covers managing Microsoft Entra users and groups, managing access to Azure resources using RBAC, and managing Azure subscriptions and governance policies.
5 minutes
5 Questions
Managing Azure identities and governance is the foundational domain of the Azure Administrator Associate (AZ-104) certification, accounting for approximately 15-20% of the exam. It focuses on securing access and maintaining control over the cloud environment through Microsoft Entra ID (formerly Azure Active Directory) and various governance tools.
First, identity management involves handling the lifecycle of users and groups. Administrators must know how to create internal and guest users (B2B), assign licenses efficiently using group-based licensing, and configure Self-Service Password Reset (SSPR). Security is enforced via Conditional Access policies and Multi-Factor Authentication (MFA) to protect identities from unauthorized access.
Second, access control is managed via Role-Based Access Control (RBAC). This requires applying the principle of least privilege by assigning roles (Owner, Contributor, Reader, or custom roles) at appropriate scopes, ranging from Management Groups down to individual resources. You must understand how permissions inherit and combine effectively.
Third, governance ensures compliance and organization. Azure Policy allows administrators to enforce rules, such as restricting resource deployment to specific regions or enforcing naming standards. To organize the hierarchy, Management Groups allow for the application of policies and access controls across multiple subscriptions simultaneously.
Finally, resource management involves using Tags for logical organization and cost billing, and applying Resource Locks (Read-Only or CanNotDelete) to prevent accidental modification or deletion of critical assets. Mastering these components ensures an Azure environment remains secure, compliant, and operationally efficient.Managing Azure identities and governance is the foundational domain of the Azure Administrator Associate (AZ-104) certification, accounting for approximately 15-20% of the exam. It focuses on securing access and maintaining control over the cloud environment through Microsoft Entra ID (formerly Azu…