Microsoft Entra ID, Users, Groups and Azure RBAC: Complete Beginner Guide

Azure Learning Path - Stage 1, Chapter 5. Azure security starts with identity. Microsoft Entra ID manages identities such as users, groups and applications, while Azure role-based access control determines what authenticated identities can do to Azure resources.

This chapter explains the difference between authentication and authorization, how users and groups are managed, how Azure RBAC scopes work, why least privilege matters, and how to assign access safely.

What You Will Learn#

• What Microsoft Entra ID is.
• Users, groups, service principals and managed identities.
• Authentication vs authorization.
• Microsoft Entra roles vs Azure RBAC roles.
• Azure RBAC scope and inheritance.
• Built-in roles such as Reader, Contributor and Owner.
• CLI examples and a least-privilege lab.

1. What Is Microsoft Entra ID?#

Microsoft Entra ID is Microsoft's cloud identity and access platform. It stores and manages identities used to authenticate to Azure and many Microsoft and third-party services.

A user existing in Microsoft Entra ID does not automatically mean that user can modify Azure resources. Resource authorization is controlled separately through Azure RBAC.

2. Common Identity Objects#

3. Why Groups Are Better Than Repeated User Assignments#

Suppose 25 engineers need Reader access to a production subscription. Assigning the role individually creates repetitive administration. A better pattern is to add users to a security group and assign the role to that group.

4. Authentication vs Authorization#

5. Microsoft Entra Roles vs Azure RBAC Roles#

Do not assume that being a directory administrator automatically grants broad Azure subscription access.

6. Azure RBAC Model#

• Security principal: the identity receiving access, such as a user, group, service principal or managed identity.
• Role definition: a collection of allowed management actions.
• Scope: the Azure boundary where the permissions apply.

7. Azure RBAC Scopes#

A role assignment at a parent scope can be inherited by resources below it. Assigning access at the narrowest practical scope reduces unnecessary permissions.

8. Common Built-In Azure Roles#

Azure also provides service-specific roles such as Storage Blob Data Reader and Virtual Machine Contributor. Prefer a specialized role when it meets the actual requirement.

9. Least Privilege#

Least privilege means granting only the access required for the task, at the smallest useful scope, for only as long as necessary.

10. Azure CLI: Inspect Identity and Access#

11. Create a Security Group Example#

In enterprise environments, group naming, ownership and lifecycle should follow identity governance standards.

12. Assign Reader at Resource-Group Scope#

13. Managed Identities#

Applications frequently need access to Azure services. Hard-coding usernames, passwords or client secrets in source code is risky. Managed identities allow supported Azure resources to obtain an Azure-managed identity and request tokens without storing a credential in application configuration.

14. Security Best Practices#

• Require multifactor authentication according to organizational policy.
• Use groups for repeatable access management.
• Prefer least-privileged built-in roles.
• Avoid permanent Owner assignments where they are unnecessary.
• Use managed identities for Azure-hosted workloads where supported.
• Review role assignments regularly.
• Separate directory-administration privileges from Azure-resource privileges.
• Do not share user accounts.

15. Common Mistakes#

• Confusing Microsoft Entra roles with Azure RBAC roles.
• Giving Contributor when Reader is enough.
• Assigning roles at subscription scope for a single-resource requirement.
• Using individual user assignments everywhere instead of groups.
• Putting application secrets in source control.
• Assuming a newly created user automatically has subscription access.

16. Hands-On Lab#

1. Create or identify a test resource group.
2. Create a test security group if permitted.
3. Add a test user only if your tenant policy allows it.
4. Assign the group Reader at the test resource-group scope.
5. Inspect the role assignment from the portal and CLI.
6. Compare inherited and direct role assignments.
7. Remove test role assignments and groups when finished if appropriate.

17. Interview Questions#

1. What is Microsoft Entra ID?
2. What is the difference between authentication and authorization?
3. How are Microsoft Entra roles different from Azure RBAC roles?
4. What three components make up an Azure RBAC role assignment?
5. Why are groups useful for access management?
6. What is least privilege?
7. What is a managed identity and why is it useful?
8. What is the difference between Contributor and Owner?

Official References#

• Microsoft Learn: Entra user management
• Microsoft Learn: Azure role-based access control
• Microsoft Learn: Microsoft Entra role-based access control