SC-300 Identity Management: Users, Groups, Devices & Licensing Guide

[ Music ] WALEED MIR: Hello. My name is Waleed Mir.

I'm a Microsoft Technical Trainer, specializing in Azure infrastructure, security and compliance, security operations, AI, and Copilot courses.

I'm here to walk through the Microsoft SC-300 Identity and Access Administrator Associate course with you. Welcome to the next step

in mastering identity management with SC-300. In today's digital world, identity is everything. This module is your gateway

to understanding how modern organizations protect access, empower users, and enable secure collaboration, whether in the cloud, on premises,

or across hybrid environments. Here is what you'll get in this series, the essentials of creating, configuring, and managing identities,

a deep dive into Microsoft Entra ID, the backbone of secure access, how to manage users, groups, and devices with confidence, the secret to external

and hybrid identity management, so you can work seamlessly with partners and vendors, why licensing and custom security attributes matter

for every IT professional. If you want to boost your skills, stay ahead of security threats and become the go-to experts

for identity and access, you're in the right place. Let's get started and make identity management your competitive edge.

So let's begin our journey into Entra ID looking at how do we go and manage users by creating and configuring some settings around that.

And this is where we can have an overview of all the users that we have in our environment. Now, to do this, we are going to jump

onto the portal for the Entra. This is our Entra admin portal, so all I am looking at is entra.microsoft.com, and we are landing

into Microsoft Entra Admin Center. And we'll be working within this portal for pretty much most of the course in this series.

Now, one of the first things that we are going to start our journey with is looking at the user details in our setup.

So I'll simply jump onto Entra ID on the blade and look for the users. And this gives me an overview of all the users that I have

in my current tenant in this environment that I'm working on as a demo environment. Now, typically by a quick look I can see I have currently 62

users that I'm working with in my environment. Again, all of them are users, with some details of the user or user principal names listed for me, and also suggesting

that these are my member users. We'll discuss details about different types of users very, very shortly.

I can also, at a quick overview, see if there were end users that were synchronized from on-premises environments. This is where I will have my hybrid identities.

If I had any visible to me, they will be mentioned over here by simply a "yes," suggesting that there were synchronized using --

my on-prem users using Entra Connect, which we'll cover a bit later on in the course. And also, if I have any external users that are a part

of my setup, they typically appear up as "guest" on my environment, and again, we'll talk a little bit more about different identities like the external

and hybrid identities a bit later in this series. For now, let's have a quick look at some more details around the users.

One of the first things that we are going to do is start looking at how to create a user account. And for us to do that, let's start with the tab on the top

that says, "New User." For this, we'll click on a "New User" option, and we'll start creating a new user.

Now, for you to create a new user account in your Entra, there are four mandatory fields that you need to complete, and this is the bare minimum that you are required

to complete to create a user account. All of these are marked with an asterisk next to it, so you know that you must complete these four key areas

to create a user account. For us let's start with an ADEM account. Let's create an account.

Let's give it a name called "Frank Adams", and that's the user account that we are creating in my setup. Now, as you see, the -- what I'm creating,

the user principal name, which will uniquely identify this user in my entire setup, you see it comes up with some details on the domain name that's registered to my setup.

Now, in my demo environment my primary domain that's been registered to me is this. As mentioned in one of the previous videos, that typically

when you create your tenant or set up your details, your administrator has to choose a primary domain detail, and it always ends on microsoft.com.

We'll talk a little bit later in one of the other videos on how we can change some of this if we're required to add other details to it, but for now we'll work

with the existing primary domain detail that we have. Now, apart from adding the user principal name, I have a second option over here that says, "Mail Nickname."

Now, this is currently giving me an option to derive it from the user principal name, so it looks exactly the same. But if for any reason in your organization you have different

mechanisms of creating the mail nickname, maybe because you are shortening people's names, someone prefers their name to be shortened,

like "Alexandria" could be "Alex", "Thomas" could be "Tom", if they prefer their email address or mail nickname a bit like that, this is something that you can choose.

Sometimes organizations also take away part of the name. For example, we could use in here as "F. Adams" as their name for the email, but again, it all comes

down to what you prefer in your organization. So it's another mandatory field that we need to create. For me, I will keep this as derived

from the user principal name so it looks exactly the same. Now, the next thing I want to do is also create their display name.

Now, this is an interesting part to look at because how would I want their name to appear in my environment?

This is where you'd define that. And again, obviously, I will like to give them a space in between.

I just realized that instead of "Frank" we've got "Fank" there. Let's change that to "Frank Adams", and that's the name that we want for them, so we'll work with

"Frank Adams" in that manner. So we have "Frank Adams" as their display name up here as well.

Now, just to kind of explain how this looks like, if you have a look at my screen and check the details on the side of my screen --

let's go quickly zooming into this for a minute and see if I can highlight onto this. If you check the naming details on that, it tells me I'm logged

in as admin@ my primary domain detail. But when you look at the name in there, "name" comes up as "system administrator", and my email comes

up as my email ID, which is "admin@". So these are some of the details that we are currently configuring for this user

as well, so the display name would be the name that appears up and across your entire setup as -- and when you hover onto the details of the user,

that's the name that will pop up on that screen. Currently my password is registered as -- or configured as "autogenerate password".

I'll take that off for now. We'll create a password for this. And doing that simply because ideally when you're working

with user accounts, the administrator shouldn't necessarily have access to any user account or user passwords.

At the very first login this user will be asked to reset their password. So even if the administrator did know it, they shouldn't

after the user has started logging into their account. Ideally, they shouldn't know anyone's password in their environment.

The last thing that I have on here, which is not a mandatory field, is asking me to enable this account as when it's created.

We can disable this account for now, we can disable it later as well, depending on our need. Now, mentioning zero-trust, we spoke about giving just

in time access to something. Now, this is where this becomes very important. Now, if this user doesn't start for another week or two weeks

from now, and I'm being proactive and I'm creating their account, maybe I would keep their account disabled.

So I want to uncheck that box that says, "Enabled," and it can become disabled. So I've created account, is in a disabled state,

and it stays there until the user is ready to start working, and I simply go in and enable their account. So it could be a good thing to implement zero-trust

at all stages with a newer implementation, even when you're creating a user account. Now, that's pretty much everything I have for you in the

"Basic" tab when you're creating a user account. There are, however, other tabs that we are going to very quickly touch on, things like properties

for this user account. For the properties, there are quite a few details that are available for you to complete.

We recommend that you complete them as many possible details as you can in your environment, simply because these options or these properties come, then you use in many other features

within your Entra environment, and they will become very, very useful for you to implement policies and other controls that can be automated.

And they can look at some of these details for you to ensure some sort of automation can be performed on -- with the users.

Now, I'll give you some examples a bit later on. Maybe you can carry on watching some of the other parts of the series to look at things like conditional access

or dynamic users, and we'll cover some more details on how these properties will become useful. For now let's move on.

Now, under the "User Type", I am simply going with the member account. Now, typically, a member user is someone that's working

in your organization, hired by your organization as a fulltime employee, as a colleague that you will be working with,

and that's what a member user would look like. So we'll create this as a member user for now. Now, for the job title, again, please provide

as many details as you can. I'm going to try to complete some of these and leave the others out.

Like I said, ideally you would like to complete as many as you possibly can. Let's assume this is my senior developer in the job role.

And the company name is "Contoso", and the department that they're working for is DevOps. And again, if I can type in.

All right, "DevOps". Now, for most of the other things I am going to leave blank.

But like I said, very, very important to remember that you are going to try and complete as many possible options that are in here

to provide details for that user. They will get used later on for a lot of different security features

that you have in your environment. Now, one last thing that I have at the very, very bottom of the screen is under

"Settings" tab, "Usage Location". Now, this is not a mandatory field, so I can create this user account

without creating a usage location, or adding the usage location for this user. However, it's important to understand that if

in future I am going to look into assigning this user some sort of a license so they can carry on working with their resources,

maybe an M365 license so they can have access to Microsoft 365's base resources, they would need a usage location assigned to them.

Now, with that, the usage location, we will keep on getting error messages about this user being assigned a license

if they were assigned this license directly or individually. However, there is a possibility that if they become a member

of a group they can inherit this license, and if you don't have usage location allocated for that user at that point, the system

or Entra will automatically assign their usage location to the usage location of where the Entra was registered, which might not be correct.

And based on this usage location, the user ends up seeing the features that are available for them in the region that they belong to and certain features will only unlock

of they are in that region. So it's important to understand that you must assign a usage location if you plan

to assign licensing to this user. For now, let's go and quickly add a usage location for this user.

I'll bring this user down to one of the regions. Let's pick one from the list. And I will simply go and allocate --

let's do United Arab Emirates. And that's the usage location that I'm assigning to this user. Now, for the rest of the details, I'll leave them

as they are, blank for now, but again, like I mentioned a few times already, important to complete as many.

Can't stress that enough. For their next part, we have an area to go and create assignments in here.

And within the assignments we have a few different areas that we will look at. Now, I'll leave these out for a later session to cover,

where we can now add this user into a group, add different roles to this user. Now, if you already know what you are going to do

with this user or what this user is going to be doing, assign them appropriate permissions now, or you could do this at a later stage

and that's not necessarily a problem at all. So for just now, we'll leave this out, but we'll, again, touch on some of these in later videos.

And pretty much that's all you need to do to create a user account in your setup. Now, I'll simply hit "Create"

and this should start creating this user account. Within a few seconds we should be able to see "Frank" appearing up in my setup.

So if I try typing in "Frank," and I see "Frank Adams" is already available for me to look at, and this is where I could start going

into the details of Frank's account and understanding what's going on. Now, this is me now managing how a user account would look like

and things I can do for a user account. Now, let's take a step back out for a minute. Let's go into all my Entra users that I have in here.

So within my Entra ID if I am back into my "User" menu, I should be able to see all my users that are here. I can filter them down based on their names.

I can add other filters to find out what type of user I'm looking for, based on some of the options that are visible for me on the screen.

Again, this might make it easier for you to highlight users in a particular organization, department, or a different region in your company, and filter them based

on that, just to see who they are and what you can do with them. Now, once you have these users available

in your environments -- let's go back into Frank's profile one more time. And if I look at the details in Frank's profile,

suddenly I can see that the system is populating some details for Frank. For example, Frank has already gotten membership of a group,

again, something that we'll talk about in another session. For now, just quickly checking the properties of -- as a quick overview of what we see under Frank's profile.

Some details such as UPN, the user principal name, that's listed there. We created this earlier as creating a user.

The user gets a unique object ID that uniquely identifies this for Entra, so Entra knows this user unique by this object, and again, when it was created and the details.

Now, if I scroll further down, just to have a quick look, I can see the account status currently is in enabled. And this is where I mentioned that you can simply go and click

on "edit" and disable this account or if initially I started off with this account being disabled,

this is where I will go in and enable the account as when the user is ready to do different things. Now, one more thing that we can talk about in terms

of management of the users, apart from configuring some of the details that are on the blade for the user account, which we'll touch on in the next few videos,

let's take a step back out into the users one more time. And from here what I want to look at is we saw how to create a user.

How do we delete a user if we no longer need that user in my environment? Now, for instance, let's go and pick up one of the users

that I have on my system. We have Arnold Doe, that's in here. This user is no longer part of my setup,

and they have left the organization. I don't need this user any more. The easiest way of me managing this is simply going

and deleting the user account. And to do this, all I'm going to do is highlight the user and simply hit on a "delete" button, and say "Okay" to this.

Now, this starts the process of deleting this user from my tenants, from my Entra ID. And if I go and look at the user blade on the left-hand side,

right here under the "Deleted Users", I should be able to see all the deleted users that I have. Now, this user stays in the deleted state for 30 days.

Unless somebody goes into the deleted account and deletes them permanently, they will stay here for 30 days. After 30 days, they are automatically removed from here

as well permanently and there will be no information about that user after 30 days. Now, within the 30 days when you restore this user back out,

they come back to their original state as if they were never deleted. However, once they are deleted and permanently gone

from your system, there's no way to bring that information back out. So there's no backup that you can restore

to bring that information out. That information is deleted. And the only way around that would be for you to simply go

and create a new user account for the person if they did decide to join back into your organization after over a 30-day period.

All right, with that, let's stop here to create user accounts, and let's move on to the next topic, which is managing groups. Now, in this part of the session, we are going to look

at creating, configuring, and managing groups. Now, Microsoft Entra ID groups help you in organizing your users, which can make it easier for you

to manage permissions and also group people based on similarities. These could be their departments,

this could be their job roles, this could be projects that they're working on. So you could have different reasons to put people

in different groups to manage different actors or permissions for them. Now, for us to have a look at groups, there are two main types

of groups that we will be discussing in this course. One of them is called a "security group" and the other one is called an "M365 group".

Now, a very general understanding between these two groups is if I am working with M365 related resources, for instance,

I'm looking to create a shared mailbox, a shared calendar, or if I'm looking to add people as a group to a SharePoint online site, then most likely

in the back end I am going to look at creating an M365 group for them. Now, for my resources that I'm looking to manage

in my environment, things like access to applications, or managing licensing, I might be looking at creating a security group.

Now let's have a look at the portal to see how do we create them and we'll dive into a bit more detail in between the difference

between the two groups, and I'll show this on the portal. Right. Back into the portal, under the Entra Admin Center at going onto entra.microsoft.com.

On the blade I am going to simply click on "groups" to have a quick overview of currently what I have in my demo environment.

As a quick overview, I can see total number of groups that I have is 24. And if I look at some other details,

I have some dynamic groups. I have M365 groups, I have security groups, and again, it's checking if I have some cloud groups

and on-premises groups. And again, that's also if I had them synchronized from on-prem. Now, currently if I go back into the blade for the groups,

click on all the groups, this is where I can see all the groups that I currently have in my environments and how I could work with them.

Now, as part of this, what we are going to do is going to create a group. And during the creation of the group,

we'll touch on some more details that are important to understand the difference between the types of groups and the type of membership that you could have for a group.

Now, to do this, let's begin our journey by creating a new group. Right. Now, just before we start creating a new group, one of the first options that I am asked is

to choose a group type. And this is where I can choose the group to be an M365 or security group.

As mentioned before, we can see the details on the screen as well to confirm that if I'm looking to create a group based on tools like the M365 collaboration tools,

that might be for me to manage shared mailbox, shared calendars, files, or look at SharePoint online sites and similar other M365 suites, then it might be better for me

to create an M365 group. However, if I'm looking to manage my resources, like applications and other resources, or managing licensing

to be assigned, then I could look into creating a security group. Now, few other details that are very, very important.

For my M365 group we can only have users as a member of that group, so you can't add anything else apart from users to be in M365 group.

Whereas, for my security group, that changes. I can bring in users to that group, I can have devices, I could have service principals, which is an identity

for my applications, and I can also bring in other security groups to that. That means group nesting is allowed as long as it's done

for security groups in your environment. Remember, M365 groups don't allow nesting, and won't be nested inside of a security group for that reason.

So good-to-know information when you're creating the groups. Now, let's -- for this demo let's choose a security group and let's work with that.

Now, we need to give a name to our group, a name that is going to be unique for my tenant or my environment. So let's pick up a name here.

Let's call this "Identity Admin". So that's the name of the group that we are working with, if I can spell.

There we go. So "Identity Admin" is the name of the group that I'm creating today.

Now, this is where I could provide some description to saying, "All the identity -- -- admins to be added to this group."

Now, again, where we find descriptions it's very important to provide some details there. Very likely in your organization you might not be the only person

managing or working with this, so it's likely that someone else looking at this name might not be able to relate to understand who becomes a member of this group

or why should I make them a member of this group. Your descriptions here is what will help them in understanding if they are choosing the right group to assign someone to.

Now, just underneath that I can see I have an option here that says, "Microsoft Entra Roles". Now, this tells me that I can assign Entra roles

to this at this point. And that's maybe good to understand that if I am managing my roles based on a group,

we can do that, right, by choosing this option to toggle it to "yes". If I don't want that, I can leave that to a "no".

Now, again, just as a quick explanation of this, I create a group. This group is going to be for my identity admins I'm creating.

Now, it could be worth that all the people that are going to become a member of this group they automatically get some sort of a role assigned to them, maybe a user administrator,

or identity administrator, or something similar, that might be assigned to them. However, they only get that role when they are a member

of this group, and when they are not, they're -- they'll lose that particular role assignment to them. So it's something that you can manage

by simply toggling this box to a "yes" at this point in time. Now, a few things change when I do that. So if you keep an eye onto the bottom part of the screen

for now, currently I have an option to cover members and owners over here. But if I say "yes" to this,

it adds one more option there that's to go and define what role I'm adding to this particular part of the session.

Also, my membership type changes, becomes grayed-out, and I can't change that. Which means that I can't have users to be a member

of this group automatically, because of the default setup that it has. Someone needs to be adding these people to this group

so they become the administrator role that I'm going to look at assigning here. Now, I will leave this out for today.

In this demo we'll leave this out. However, one thing that's very important to remember is that this particular menu that you see in front

of you right now for adding roles, this cannot be edited later. If I leave this "no", I can't change this to "yes".

If I say "yes" to it, I can't say "no" to it later on. The only way around it is to maybe get rid of the group and recreate a new one with different settings.

So important to remember that you can't change this once a group is created. Then further down we have options

to define membership types in here. I could use this -- or leave this to be assigned, which simply means that an administrator will be manually

adding users to this group when they are ready, or we could go into "Dynamic" options. Now, this is a security group so I have options

for both dynamic users and devices, as the security groups can allow devices to be part of that or member of that, so we can use

that to become a dynamic user or dynamic device. Now, if I switch this to a dynamic user, straightaway -- not that menu.

Let's try that again. So as soon as I switch this to a dynamic user, one thing that changes for me here right

in the bottom is this, instead of seeing the members now, which we were seeing a few seconds ago, we are seeing an option that says, "Add a dynamic query."

Now, this query is what will define how a user becomes a member of this group, and your admins are no longer able to add someone manually to this group any more.

Now, let's have a quick look at how this query looks like, just to explain how this would work for me in my environment. For instance, when we are looking at this query,

the details I'm looking at for now is under the dynamic users. So the properties that it mentions for me right here are talking about

or mentioning user properties that we were looking about -- we were discussing earlier on when we were creating a user in the previous session.

Now, these properties, again, if they are well-defined in the user profile, will always help them in terms of authenticating themselves against different resources.

This is where we could also bring them into a group membership of different groups based on some of these properties.

For instance, let's start creating one. If I go and start picking up details, for example, let's say the job title, and let's pick one

of the operators here. Let's say, "Starts with -- " and I can here define "Dev," or let's say, "Dev," just that, "Starts with 'dev'."

Now, if -- let's break this down to understand in terms of the syntax. Now, for this particular course, you're not expected

to know the syntax rules by heart, but you're expected to be able to look at it to understand what's going on within it.

So it's nice to see currently if you see the details really defined on how that looks like. So for instance, right now it's saying user --

property of the user that we chose, which was "job title", then with an operator that says, "It starts with," and "dev". Now, if this is true for any user in my environment,

they automatically become a member of this group. However, we can add many other expressions in here to make this as compliant to what our needs are.

Maybe just that one statement there isn't enough, so we could bring in other expressions. Now, as soon as we stop bringing other expressions in,

one more thing comes to play in here, and that is to choose between "and" and "or" in between your statements. Now, let's take an example of both of them in the scenario

and let's discuss what they would do. I'll start with "and" first. And in this case we are going to add one more property

and suggest that if their job title is -- starts with "dev" and let's say their department is equal to -- and here we can define "DevOps".

All right. Now, let's see what happens in the statement, and that's the second statement that we've just added now here.

Now, what's happening as when we stop adding the "and" in my statement, what does this actually do? It's actually looking at making sure

that both these statements are correct for the overall outcome of this particular syntax that we've got here. So for instance, right now for someone to be a member

of this group, there should be -- the job title should start with "dev" and their department should be "DevOps".

So there could be a possibility that I have other people in DevOps department, but their job title doesn't start with "dev", could be other things in there in the job title

so they don't become a member of this group. So both these statements have to be true for them to become a member of this group.

And that's where the "and" comes in. You could consider "and" as like adding between both statements so first statement and second statement have

to be true for this to happen. Whereas, if I add one more expression -- this time let's change the "and" to "or",

we'll pick up company name in this case and stopped doing this and we'll say, "If their company name is -- " let's go into saying, "-- not equal to --

" and let's type in "Contoso," and that's the statement I'm adding. Now, let's have a quick overlook --

a quick view at what currently we have for our syntax for the dynamic query. And in this case if I look at it,

we've just covered the two parts over here, which is this user if their job title starts with "dev" and their department is DevOps,

they become a member of this group. So that's one thing that we spoke about already. Now, adding the "or" statement,

this is where things look a little different. What this will do is will stop here and suggest, "Okay, hold on, whatever you said over here, if that's correct,

that's your one statement altogether." Now we are looking at a second statement, suggesting that if their company name is not equal to "Contoso",

so as long as their company is not Contoso, they become a member of this group as well. Regardless of if their job title starts with "dev",

their department is DevOps, or it's not, as long as their company is not equal to "Contoso", now they become a member of this group.

So this is where the "or" becomes really, really interesting. And again, it's the recommendation

that if you are using too many "ors", just make sure you understand what the syntax looks like, because it can negate something that you've defined

in the previous statement, so be aware of using too many "ors" in your environment. So this is how you can define a dynamic query

to automatically bring users to be a member of your groups. Now, we'll hit "save" to this and come back out of that. And the last few parts that we have for my creation

of a group is looking at creating an owner. Now, typically when you are managing your Entra environment, for you to allow someone to be able to manage different things

like create a user account or create groups and add users to groups, typically you're required to have an admin role. A role like user administrator would be minimum requirement

for you to have to manage this. However, when we speak about zero-trust, we want to ensure that we don't give more than what people require to be able

to perform their tasks. Giving someone, a user, administrator, just because I want them to manage the access to a group,

might not be good enough. Again, this is going against the least privileged access that we might want to create.

How can I do that? Well, I can add you as an owner of a group. What that does is allows you to manage users

that are a member of that group. You could add or remove them and it doesn't give you any other admin rights to work

within my environment, but still ability to manage your groups. So adding an owner sometimes can make your life much easier if you are getting asked by a lot of different teams

to add people on and remove people on, maybe you can make them an owner of that group. If they are the project manager, the team leader,

the manager of a team, maybe make them an owner of a group so they can manage that group by themselves. And that's pretty much everything that we need to do

in terms of creating a group. And once a group is ready, we're going to hit -- simply hit, "Create", and this group should get created

literally within a few seconds. Now, let's have a quick look at the script. So we've just created "identity".

All right. All right, that would help if I spell it correctly, "Identity Admin" group.

And you can see that Identity Admin group is available for us to look at, and currently we can see this is the group. Now, again, some basic details from the overview,

it's a dynamic group because we added a query to it. It's created in the cloud so it's not on-prem or coming from on-prem so it's not in a hybrid, it's a security group,

and currently we have no users added to this. Now, as and when the users are ready, based on the creator that we have added to this, they will get populated

to this group when they're ready. Now, just taking a step back into my entire set of groups that I have, just to highlight a few more things to cover,

let's pick up another group that I have in my environment, and that is not a dynamic group, and it's an assigned group. So what I am going to do is pick up a group called

"Apps", right from there. This is an assigned group. It's a security group still, so we can see that detail here,

this is an assigned group. Now, if I'm looking to manage users to be a member of this, typically I would go into my "Members" on the blade

for my user groups -- sorry, from my groups. This is my security group. And currently I can see that I have a service principal added

to this, a group -- another group being added to this, and I have devices added to this group as well -- or one device added to this group.

I can manually click on "Add Members", and within this I can bring in anyone or a resource, like my groups, or devices, or apps to be a member

of this group if there was a need for it. All I need to do is simply go into clicking on the resource that I need and simply selecting it,

and that adds them to that group. And that's pretty much how you would make a member or remove a member from the group, by simply click on them

and hitting the "Remove" button on the top, and you simply remove them from being a member of a group. Now, this is your manual assignment and manual management

of your users, or members of your group. How do you change that? Well, we had an example of a dynamic group just a minute ago.

So if I go back into the dynamic group that we've just created, which we called "Identity Admin", and if I look at the same settings again one more time under here,

I can go into the members of this group and check out who the current members are. Now, I have quite a few members, 55 users added

to this group automatically, because it's a dynamic group. And the reason behind that is the statement that we created somewhat would match these users that I have

or their profiles, and they are being added into this environment. Now, let's have a quick look on things that we did before.

Can I quickly click on "Add a Member" to this? And for me to do this, maybe let's check, first of all, do we have Frank added to this already?

All right, so Frank is not a member of this group currently. So if I go back in here and say, "Hey, I want to add Frank to this group -- " if I can spell "Frank".

And I can see "Frank Adams" that we created in one of the previous sessions. I can say, "Hey, I want to add Frank to this group."

Now, straight away, I get an error message that suggests that I have insufficient privileges to add a selected member.

Now, I am currently logged in with the highest level for access in this environment, which should allow me to be able to do that.

The only reason it's giving me that error message is because I can't manually add users to a dynamic group. This is a dynamic group.

The only way we can manage this is ensuring that the rule that we've created for the dynamic query is written correctly.

If I need to modify that, I can always go down to the blade of the group and look for dynamic membership rule and check what the rule currently states,

and if it's not done properly, I can refine that rule again, just to make sure that we have -- or it captures all the right people or resources

in my environment to be a member of this. Now, for the dynamic users, this is going to be only adding users automatically.

If I had dynamic devices, then I can add devices to a group automatically. Now, this is where a very important point comes to mind.

When we are creating security groups, as I mentioned before, that you can nest another security group inside of a security group.

There are, however, two situations where that can't be possible. One of those situations is when you have a dynamic group,

and the second situation is when you enable the role assignment onto a group. Now, let's have a quick discussion

about this on a whiteboard. Right. I'm back onto the whiteboard, and just a very quick conversation

around the group nesting. Now, when we are talk about group nesting, first of all, it's important to understand that group nesting only happens

for security groups in Azure environment or my Entra ID environment. And for us to have this discussion, we are looking at --

let's assume three groups. We'll call them "Security Group One", and I'll create another group

over here called "Security Group Two". And let's start with these two first. Now, as we said before, security group two can become a member

of security group one because they're both security groups. Again, if there was no rules defined, such as dynamic groups, it wouldn't work, also a dynamic user or dynamic devices.

Now, this is one exception that we can have. For now, let's talk about this. Imagine my security group two was a dynamic group.

And if that was the case, then if I was to start looking at another group -- let's call this "Security Group Three", then in this case, I should -- or I would not be able to bring

in security group three to be nested under security group two. So this is not allowed. Because security group two has -- or is a dynamic group.

It wouldn't allow another group to be added to it. However, security group two can still be added to security group one.

So it can be nested, it won't allow nesting inside of it. So that's one exception. The second exception is if, for instance,

let's assume we did not make this a dynamic group -- let's keep that for a minute in a box so let's assume it's not a dynamic group,

but we went into creating role assignments onto this group. So we are now suggesting security group two is an assigned group and we enable a role assignment onto this.

Maybe we added a group -- let's assume a user administrator role to this, so whoever becomes a member of this group becomes a user administrator.

In that case, again, the same issue that we will have is we won't be able to bring any other group. For instance, the SG3, or security group three,

still can't be a member of a group that's in that kind of setup, simply because once a role assignment is enabled, it doesn't allow a group to be nested inside.

However, this group can still be nested in SG1. So remember the terminology, it can be nested but won't allow nesting inside of it.

So these are the two exceptions that you will need to know for your group nesting when you're creating security groups. In this part of the session, we are going

to discuss how we can configure and manage device identities in Entra ID. Let's start talking

about different options that we have in here. One of the first options that we are looking at is called "Microsoft Entra registered devices".

Now, with Microsoft Entra registered devices, this allows users to have the flexibility of bringing their own device to be able to use for their work.

For instance, you want to check your emails from work on your personal mobile phone, you should be able to do it so if they were right settings or configurations completed

within their organization. For instance, let's have a look at this diagram. Imagine this is your personal mobile phone

and your company allows you to use this mobile phone to access or gain access to your work resources, including your emails, then in that case, the least requirement

that you would have is to be able to register this device under your Entra. Now, once you do that in your mobile device,

you might be asked to go and configure a new account for work or school, and when you do that it will simply create a part of your device that's going to be now under a secure access,

which should follow the company policies that they have implemented for you to be able to register this device.

Typically, you will see mobile device management tools used in an organization to allow you to be able to register your device.

Things like Microsoft Intune might be used in registering these devices with policies on how and how not to.

Maybe the device status or health that might need to be at a certain point or with some security settings like a basic PIN or a facial recognition before you unlock

your phone could be added as part of security to ensure your work data is not left in the personal device visible to anyone that gets hold of it.

Now, one thing that your administrators can do, they can simply access the part of the device that has the work details onto it, well,

in a sense that they should be able to manage that remotely. If, for instance, this user loses their device or leaves the company, for whatever reason,

they can simply send a remote signal to wipe the work setup from their device and simply manage that area or aspect for their organization.

However, the other part of this device would still belong to the user where they will have their personal information or personal pictures or details, and that part stays

with the user and the user is responsible for managing that part. And again, they can use similar other services

where they can remotely log in and wipe or manage their own device if they had lost or stolen that device.

Otherwise, if they leave the organization, your administrator can simply remove the work profile from it, and they could carry on using their device

as a personal device. Now for this, you can use a lot -- a variety of operating systems to be added on.

Things like Windows 10, Windows 11, iOS, I O S, Android, and macOS devices can be all added to your environment as a registered device.

Now, the other option that organizations have is to add a device as an Entra Identity join device. Now, this is a device that your company owns

and they have full control over that device. And simply adding the device to your organization or your setup that you have in your cloud makes this device available

for your Entra ID to fully manage it in your environment. Now, you can simply push down lots of different policies using your device management services,

including creating policies in your Entra using conditional access to allow and control what users can do with this device and work

within your environment. Now, typically, when you are bringing your devices, this would allow you to have Windows 10

and Windows 11 devices to be added as part of Entra ID joined. Home editions are typically not supported

for any networking solutions, including adding them to your joined Entra ID join as well. Now, one of the last options that I have on the list

over here to bring my devices, managed devices, it's called "Entra hybrid joined device". Now, this is a scenario where I might want

to manage the devices on-prem under an active directory and still have that device presence in the cloud. One might think for question at this point thinking,

"Why can I not move all my devices to the cloud? Wouldn't that be easier for me to manage?" And you are right, that can be the case.

If I could move all my devices to be Entra ID joined, that might be an easier solution for me to work with. However, if there are certain restraints,

things like I am working with a legacy application such as Win32 app, in my environment that cannot be migrated to a cloud,

or I don't have a better solution for it, and I can manage that on-prem. Maybe it's a line of business application.

In that case, I might be limited in -- or restricted in doing a complete cloud migration directly by using Entra Identity joined devices.

So that device could then possibly be brought into the cloud by using the hybrid joined solution. Now, similarly, there are a couple of other scenarios

that we could use this. If there was a reason for your administrator on-prem to be able to manage those devices that are on-prem using group policy

objects, then they should be able to do that under hybrid joined environments, simply because group policies don't exist in Entra ID,

and if your administrators are adamant that they want to implement that for whatever reasons, they can control their on-prem environment using group policies

and add those devices as a hybrid joined, not Entra ID joined. Finally, we could look at a solution where you

or your administrators might want to manage different images on these devices that are on-prem. And if they are looking to deploy different variations

of these images, then in that case the best solution for you might be to look at hybrid joined devices rather than moving them into cloud simply

because of the deployment solution for the images could work better if they were on-prem. Now for this, you could use operating systems that start

from Windows 8.1 and going all the way up to Windows 11. Again, it can cater for Windows server editions as well to work with, so please make sure you have the correct

versions available for you to configure these in your environment, just to make sure they are compatible. Even though some of the operating systems are no longer

in support, they could still be onboarded onto this process. With that, we'll stop with the conversation around devices and we'll resume back with the next topic.

Now, in this part of the session, we are going to talk about licensing and why is that important. And we will also look at how we manage them.

Now, to begin, first of all, it's important to understand that we would need licensing for us to manage our Entra ID. Now, earlier on, in previous sessions, we've spoken

about how assigning users or creating groups might be important for you and your organization.

But one other important part is to understand when you create your company's existing in the cloud, which is your tenant, you might be given an option

to add different licenses to your Entra. The very simple option that you might want to go with is to keep it free.

Now, that is only possible if you have other cloud services running, like M365, or you have Azure access.

In that case, you might already have an Entra ID running in the background for you, which would be under free edition. Now, the free edition is good enough if you are not going

to be doing different -- or consuming different features that are available in Entra ID and you just want that as a service running in the background.

However, if you are looking to add additional features, things like adding dynamic groups and looking at other security features, you might need to upgrade

that Entra ID license from free to a P1 or P2. So both of these are premium licenses that give you a lot of different features for you to work with.

Now, by all means, refer to the documentation that you could find on Entra portal or your Learn portal, which will give you a comparison between the different licensing

and to understand if you are looking for a certain feature if that will be available for you under P1 or would you need P2 for certain users to work

with different service -- different features. Now, one thing that we will cover a bit later on in this course is talking

about identity governance license. Now, Entra has its own set of identity governance license, which is referred as "Entra Suite",

which covers pretty much most of your solutions under your privileged identity management and looking at other entitlement management as part

of your identity governance. And for that, you could have certain features of that available for you under P2.

However, for most of those features, you are required to use an Entra identity governance license or the Entra Suite license for that to work.

Now, apart from all of that, your users could also be looking at getting various different types of licenses. Now, in this session, we are not covering the whole depth

of all different types of licenses that could be available. But just as a quick overview, you could look

at assigning users an M365 version of licenses to them. If that's the case, you might be looking at licenses that might be -- for instance, in comparison to P1 and P2

that we spoke about, we are looking at licenses that could be things like E3, that covers everything within P1, and licenses like E5, that has everything

that P2 offers for you as part of your M365 version of licensing. Again, good to know about these two simply, because a lot

of documentation will refer to these licenses in your course so it's good to know about these two, E3 and E5, which are, like I said, equivalent to P1 and P2 in your environment.

Now, let's zoom back onto the portal and have a look at how do we go and manage licenses in my Entra environment?

All right, I'm back into the portal, and I'm looking at my Entra Admin Center as a quick overview of Entra at the moment.

Now, just as a quick to highlight, currently my setup, my demo environment, has an Entra ID P2 license added to it. That's something that I am working on in my environment.

Again, this could vary for your organization, so it's good to know where you can find where your overall licensing for your Entra looks like.

Now, apart from this, we are going to look into assigning users licenses. And if I stay within my Entra portal,

which is entra.microsoft.com, and go into a user and pick a user from the list -- let's go back into "Frank", we created "Frank" in one of the earlier sessions,

and go into Frank's profile -- again this is part of the user profile management along with managing the license aspects of this.

So if I look at the details on the blade, I have an option there called "Licensing". Now, in the past, I would simply click on the licensing here

and manage all aspects of licensing for a user under here. However, this has changed. Now, the portal does mention that to me at this point saying,

"Hey, this is still available for you to do, however, you can't do that from in here, you have to simply go into doing this from an M365 admin center."

Now, how do I get to that, and what is that admin center like? So we are simply going to jump onto the portal called admin.microsoft.com.

And by clicking that link, it should open up a new tab with that link for us. Now, just to highlight, this is taking us to -- let's zoom in.

All right, so if I highlight that for everyone, this is admin.microsoft.com as us logging into that portal. Now, this is now referred as "M365 Admin Center".

And within this, I have quite a few different options that I can go and configure. However, just for today's session, we are only focusing

on licensing, and from now on if you're ever looking to manage licensing in your environment, you have to do this from your M365 admin center.

And the link to that is admin.microsoft.com. Now, coming back to this again, I currently have an E5 license -- or M365 E5 license,

like I mentioned before, equivalent to P2, with some changes to this, but we'll leave the details out on the licensing for now.

Let's talk about how do I go into managing my license? Now, if I go into looking at that license, I currently in my demo environment have five of those,

three already used, so I can see some users that have been assigned that license. I can simply go into assigning this license to others as well.

All I need to do is click on "Assign License" and this is where I could start giving license to users in my environment.

We'll start with giving Frank the license for today, and all I'm going to do is hit "Frank". Now, one very, very interesting thing to look at here is

with my E5 license, the one that I currently have, it comes along with quite a few different features. All these features are highlighted over here

that are available for me under the setup right now. And again, just assigning this user this license makes this available for them.

However, if for any reason in your organization you don't use certain services or features, or you don't want this user to be able to do --

use them, by all means, you could come in here and uncheck them. Maybe I don't want them to use Loop, I could come in,

uncheck that from here. Or maybe in our organization, we don't use Yammer, we do -- we use something else that's equivalent to that,

so we don't want people to work on Yammer for now until we get ready for that. So I could uncheck them.

And that's perfectly fine. Even if they have the E5 license, which would give them all access to all resources,

now I'm taking away some of them that I don't want them to work on. And I simply click on "Assign", and that's as simple

as me assigning a license manually to a user, and it gives you Frank Adams is now added to the list. I could send them an email to tell them, or inform them

as well, "Hey, Frank, you are now added to a new license -- " or, "A license has been added to your profile and you could start working with that."

And this is where an email is now being sent to Frank to suggest that they have a new license added. Now, I -- simply if I want to remove someone from the license,

I can click on that and unassign license from them. And that's a straightforward process from here. I have another option to add license to an entire group.

And this is something that can become interesting, where if I want users to be able to get licenses only if they're a member of a group, then this is a way for me

to manage this in my environment by doing licensing to the group over here. So I go and choose a group that we might have created before.

And let's go into a group that we tried called "Identity". All right, so we created "Identity Admin" as a group, and I can select that group from here.

Now, again, same process goes along within this, you can enable, disable different features that come as part of this license, even though if you're assigning this

to your group, and I can simply go and say, "Assign a license." Now, one thing that you might need to be very, very careful of is you must have enough licenses assigned

in your environment -- or available in your environment to be able to assign to someone. Now, it tells me a few things already.

It says, "Licenses are being assigned following the groups -- to -- " sorry, "-- to the forming group." But just to kind of understand that I can see it tells me,

"Hey, Frank Adams has already got a license. Frank Adams might also be part of the group called 'Identity Admin'," so it's something

that I need to be aware of, again, to be able to manage this. Now, I only have one license available,

but I believe we have 55 users in that group that we added in here. Now, ideally, I must have enough licenses for the group

that I'm adding to the license in here. If I don't, you will see things like I have on the screens here, errors and issues.

It's asking me to resolve errors and issues. And there are two different things that are going on in my environments.

First of all, if I see the issue that we have here is that I don't have enough licenses to assign to everyone in here, so it says, "Not enough licenses to be available

to assign it to someone." Apart from that, if, for instance, in my environment we manage to give or have enough licenses

to assign to people, Frank also gets a license from a group membership, being a member of this group, but Frank is already being assigned a license manually,

which we did earlier. So in this case, Frank has two different -- two licenses given to same user, which maybe we don't want.

And again, this is something that we can go in here and simply go into managing that from here and removing -- typically you'll remove the direct assignment of a license

and leave the group assignments on. Now, I am going to simply unassign this group for now because I don't have sufficient licenses

for it to create this demo. And just to avoid any issues, let's try that again, let's refresh this, and we have just simply removed

or unassigned -- oh, it's not done. Let's click on that and say, "Unassign -- unassign group," and that should remove that group for me

from that environment. And once you've done that -- by all means, you can manage the licensing from in here,

I can simply go back into my Entra portal, which is entra.microsoft.com. Now, under Frank's profile, under the licenses,

if I refresh this, it should suggest, "Hey, Frank has an active license that we've just assigned to Frank," and under the services that we had, out of 80 Frank only has 78

because we disabled two. So you can see that under the user profile. However, you can no longer manage that in here.

You have to go to M365 admin center to be able to assign licenses and manage licenses from there. With that, we've come to the end to our licensing topic.

In this session, we are going to look at custom security attributes. Now, custom security attributes

in Microsoft Entra ID allows organizations to define and assign business-specific information, such as project codes, clearance level, or department types,

to users, groups, and other directory objects. These attributes help extend user profiles, enable more granular access control,

and support advanced scenarios like conditional access policies and resource governance. By leveraging custom security attributes,

organizations can tailor identity management to fit unique business requirements and improve security posture.

Let's have a look at that in the portal. All right, we're back into the portal, and we are going to look into implementing custom security attributes.

Just as a reminder, this is also a P1, P2 feature. So you must have the right Entra license to be able to implement custom security attributes.

Now, before we actually go and start creating custom security attributes, we should be able to -- aware --

we should be aware of the Entra roles that you must have to be able to do some of this. For instance, right now I'm on my Entra portal looking

at entra.microsoft.com within my Entra Admin Center. If I scroll the blade on this down and look at custom security attributes,

I could see there are some options already available for me to work with. Now, by default, if you are a global administrator,

you won't be able to look at any of this. You need to have certain roles assigned to you to be able to manage some of these in your environment.

Now, what are these roles? Let's have a quick look at that on another browser. Now, let's open a new tab.

I'll take you to learn.microsoft.com and we'll try going into some documentation. And from here I am simply going to type in --

All right, try "documentation -- " -- and type in, "Custom security attributes." And we are clicking on a link that says,

"What are 'custom security attributes'?" Now, this document is quite nice, talks a little bit about what they are and how you use them,

typically a key value pair that we are going to create just in a minute in every demo, and we'll have a look at that. Now, what I am looking to do is click on the link that's

down here, which says, "Manage access to attributes." And this part of the document explains a little bit more with a scenario.

Just might be nice to have a look at on how you can go and configure them. But the important part that we are discussing right now is the

roles that we need to have to be able to create and work with these solutions. Now ideally, there are four different roles

that we should be aware of, starting off with an attribute definition administrator. And that's the first thing we are about to do,

we are about to create a new definition. So defining a new custom security attribute, you must have at least a definition administrator role

to be able to create them in your Entra environment. Then if I need to assign these to a user, or a group, or an app, in that case, I must have the second role,

which is the assignment administrator role. Without these roles, I won't be able to either assign them or create them in my environment.

So by default, my global administrator, which would have the highest level of access in Entra, they are not able to see them or assign them to people.

You must have these roles assigned to an administrator that's managing these settings for you. Again, if you want to assign, for instance, an HR person

to be able to see a custom security attribute added to someone's profile, maybe like their pay grade or their benefits package that they get, in that case,

you don't necessarily need to assign them as an administrator role, which would then allow them to change that, maybe you just want them to be able to look

at their profile and read that. And this is where you can start looking at roles like a definition reader or an assignment reader.

A definition reader would be able to read all the definitions that you've created to see under "Benefits" what type of benefits I have, under "Projects" what type

of projects levels I have, under "Security Clearance", what level of security clearances we have. Also, if you look at an assignment reader,

they can go into your user profile to read what has been assigned to them under a different level, given that they have the right level

of access assigned for them. Now, again, all of that information is very nicely defined in that table right below that explains right level

of roles you need to enable or assign someone to be able to do this. So let's zoom back onto the portal

and start creating a new custom security attribute. Now, for me to create this, I'll hit "Add Attribute Set", and we'll come up with a name that we want to give.

You can see I already have a few names already used in my environment. So for now, I will start creating a new one called

"Security Clearance -- -- Level". Again, this is one I'm trying to make up right now.

So it's called "Security Clearance Level". And here I can define this is, "Access control for HR team." All right, this is, again, my description for me to understand

where am I applying these and who is going to be using them, and I can remind myself or any other administrators in my environment.

Now, once I have the attribute defined, let's go into it and create some more details around it. And again, like I said,

make sure you have the right role assigned. So this is where a definition "administrative role" is what we are doing right now to be able

to create some of these definitions. So let's go create our new attributes. In here, let's go ahead and define a new attribute setting.

And we are going to call this "Security Clearance Level". And that's the naming I'm coming up with. And a description we can say,

"This is to assign HR security clearance level." All right, now, I'll leave this as a string. I'm not going to allow multiple values, so a user won't be able

to -- or a user won't be given multiple clearance levels like level one, two, or three. I don't want them to have one and two together.

If that's the case you want, you want people to have multiple options, you could say "yes" to that, but I'll leave that as "no".

We have options to create predefined values. Let's go with that, so let's go and add a new predefined value. In here we can start with saying, "Level one --

" again, that would mean you have some sort of understanding of what that means. Now, we can call it, "Low," "medium," "high,"

or the other way around, level one is the high, or whatever that you consider. So we'll create it level one as "low" and we'll add.

Again, the definition is up to you on what you define them, so it makes some sense to you and your organization. Let's create level two.

We'll call this "Medium". And we'll create one more, we'll create our level three -- -- and give this a high level access.

All right, and this is how we can create or define our attributes in our environment. So this is just creating custom security attributes

in my environment and just having them in my environment. Now, how do you assign this to something like a group or a user?

Let's go back and have a look at that. So earlier on, we -- in one of the previous videos, we were creating users and we went

into creating a user called "Frank". Now we are going back into Frank's profile and simply looking at Frank.

So Frank Adams, let's go into Frank's profile. And under the "User Profile" -- again, this is part of the user management and looking

at the blade for it we are simply going down into looking for custom security attributes. And I can now assign Frank a particular security attribute.

And like I said before, these are hidden away from any other user administrators or global administrators.

They're not able to see these once you assign them to user profile. Someone needs to have an attribute reader role at least

to be able to read these. Then what we are doing right now, we are now assigning the attribute.

So earlier, we created it, this is where we need to have the assignment admin role enabled to be able to do the next part that we are about to do.

So we are going to simply go and add here. We can select what attribute we are picking from. We were looking at "Security Clearance Level".

We can define it was part of my SC level. Again, I might have multiple projects within it. And in here we are going to pick up and say, "Hey,

we're giving Frank level one. This is what the -- what level Frank sits on in the -- in terms of a job role."

And this is how you would assign a custom security attribute in your environment. Now, we can take a step further from here to then go

into creating some sort of conditional access policies that suggest, "If the user is about to log into the HR app, check their filter.

There is a session to understand if they have the security clearance level. And if their level is medium or high,

then allow them to do this. If it's low, them allow them to do that, or don't let them see this app if they are not medium or high,"

so we can then build on from here to allow control over different solutions, applications, or different resources that I might have in my environment.

And with that, we'll come to end on what custom security attributes are. This concludes our session.

We encourage you to review the reference modules, check your knowledge with additional study materials, watch other videos in this course,

or search out your next favorite topic on [email protected]/learn. Thanks for watching, and see you in the next video.