AZ-104
Deep Dive
The central identity directory in Azure. The AZ-104 tests practical administration: creating users, groups, domains, syncing with on-premises AD, and managing licenses.
Contents
Microsoft Entra ID is Microsoft's cloud-based identity and access service (formerly known as Azure Active Directory; the AZ-104 exam exclusively uses the name Microsoft Entra ID). It is the central directory that authenticates and authorizes access to Azure, Microsoft 365, SaaS applications, and custom apps.
Not to be confused with AD DS (Active Directory Domain Services) — these are distinct products with distinct protocols.
| Dimension | AD DS (on-premises) | Microsoft Entra ID |
|---|---|---|
| Protocol | LDAP, Kerberos, NTLM | OAuth 2.0, OIDC, SAML 2.0, WS-Fed |
| Structure | OUs, GPOs, domain trees | Flat: users, groups, apps, devices |
| Devices | Domain join (Windows) | Azure AD Join, Hybrid Join, Register |
| Native MFA | No (requires NPS Extension) | Yes, built in |
| Conditional Access | No | Yes |
| External access | Cross-domain trusts | Native B2B / B2C |
| Scaling | Manual (add DCs) | Automatic, global, 99.99% SLA |
| Administration | ADUC, PowerShell (RSAT) | Azure Portal, MS Graph, Entra admin center |
Tenant (directory)
A dedicated Entra ID instance for your organization. Created when you sign up with Microsoft. Has a unique ID (GUID) and an initial *.onmicrosoft.com domain.
An org can have multiple tenants (e.g., one for prod, one for dev). A tenant can have multiple subscriptions.
Azure Subscription
Azure billing unit and resource limit boundary. Each subscription trusts exactly ONE Entra ID tenant for authentication.
You can move a subscription to another tenant. The tenant is the parent of the subscription, not the other way around.
Management Group
A container that groups multiple subscriptions. Lets you apply policies and RBAC to all of them with a single assignment. They inherit from the tenant root.
Maximum depth of 6 levels. A root Management Group automatically exists in every tenant.
User types in Entra ID
Member
Organization employeesA user created directly in the tenant. Has its own domain (e.g., user@contoso.com). Broader default permissions than guest accounts.
Guest
Partners, consultants, auditorsAn external user invited via B2B. Their account exists in another tenant or provider (Google, email). The UPN includes #EXT#, e.g., user_extdomain.com#EXT#@contoso.onmicrosoft.com.
Service Principal
Applications that need to access Azure APIsAn identity for an application registered in Entra ID. Similar to a "service account" for apps. Has a Client ID + Client Secret or certificate.
Creating and managing users — admin tasks
Azure Portal
Entra ID → Users → New user → Create user / Invite external user
One at a time. Not recommended for bulk operations.
Bulk operations (CSV)
Users → Bulk operations → Bulk create / Bulk invite / Bulk delete → download the CSV template, fill it in, upload it
Up to 50,000 users per file. Asynchronous processing.
Microsoft Graph API
POST /users with a JSON body. Requires the User.ReadWrite.All permission on the app.
No practical limit. Ideal for automation.
PowerShell (Az module)
New-AzADUser or (via Graph SDK) New-MgUser -DisplayName ... -MailNickname ...
Scriptable. Can be combined with CSVs and loops.
Key user properties
Security Group
Control access to resources (RBAC, apps). CANNOT have an email address.
Allowed members
Users, other groups, service principals, devices
Microsoft 365 Group
Collaboration: has a shared mailbox, SharePoint, Teams. Visible in Exchange.
Allowed members
Users only (no service principals or devices)
Membership types
Assigned (manual)
The admin manually adds/removes members. Full control, but doesn't scale well.
When: Small groups, stable membership, exceptional access.
Dynamic User
Automatic membership based on user attributes (department, jobTitle, country, etc.). Uses rules with syntax like: (user.department -eq "Finance").
When: Automatic licensing, access based on department/HR role.
Dynamic Device
Like Dynamic User but for devices. Rules based on device attributes (OS, compliance, etc.).
When: Automatic Intune policies based on device type.
The Entra ID tier determines which features are available. Knowing what requires P1 vs P2 is critical for the exam.
| Feature | Free | P1 | P2 |
|---|---|---|---|
| Basic users and groups | ✓ | ✓ | ✓ |
| SSO to SaaS apps | ✓ | ✓ | ✓ |
| Per-user MFA (legacy) | ✓ | ✓ | ✓ |
| Conditional Access policies | ✗ | ✓ | ✓ |
| Dynamic Groups | ✗ | ✓ | ✓ |
| SSPR (self-service password reset) | ✗ | ✓ | ✓ |
| Entra Connect (hybrid) | ✗ | ✓ | ✓ |
| App Proxy (on-prem apps via cloud) | ✗ | ✓ | ✓ |
| Sign-in logs (30-day retention) | ✗ | ✓ | ✓ |
| Identity Protection (risk policies) | ✗ | ✗ | ✓ |
| Privileged Identity Management (PIM) | ✗ | ✗ | ✓ |
| Access Reviews | ✗ | ✗ | ✓ |
| Entitlement Management | ✗ | ✗ | ✓ |
License assignment — best practices
Adding a custom domain
UPN Suffix and alternates
The UPN (User Principal Name) is the login identifier. The suffix is the domain after the @.
Gotcha: You cannot delete the initial *.onmicrosoft.com domain. And you cannot change the domain of a tenant that's already been created.
Entra Connect syncs identities from on-premises Active Directory Domain Services to Entra ID. It's the bridge for hybrid scenarios.
Synchronization modes
Password Hash Sync (PHS)
Syncs the password hash from AD DS to Entra ID. The user authenticates directly against Entra ID. Simplest mode with the best resiliency (works without on-prem connectivity).
✓ Recommended for most
Pass-through Authentication (PTA)
Entra ID forwards authentication to the on-premises AD DS in real time via lightweight agents. The password never leaves the domain. Requires continuous connectivity.
✓ If the hash cannot leave for compliance reasons
Federation (AD FS)
All authentication redirects to on-premises AD FS. Maximum control and options. Higher complexity: requires highly available AD FS infrastructure.
⚠ Only if there are very specific requirements
Synced object vs cloud-only
Writeback — reverse direction
Password Writeback: SSPR writes the new password back to on-prem AD DS. Requires P1.
Group Writeback: M365 Groups are synced back to AD DS as distribution groups.
Device Writeback: Devices registered in Entra ID are written back to AD DS.
Administrative Units (AUs) let you restrict the scope of Entra ID roles to a subset of users, groups, or devices. A global User Administrator can manage ALL users; with AUs you can create a "User Administrator for the HR department only."
How to configure
Roles that can be scoped to an AU
Important limitations
Real case: a company with 4 regions
You create 4 AUs (EMEA, AMERICAS, APAC, LATAM). Each AU has a local helpdesk with a "Helpdesk Administrator" role scoped only to its AU. The LATAM helpdesk can only reset passwords for the 200 users in its AU — it cannot see or touch the 2,000 global users.
B2B Collaboration lets you invite external users (partners, auditors, customers) to access resources in your tenant using their own credentials (Entra ID, Google, email OTP).
B2B invitation flow
Cross-tenant access settings
Inbound (who can access YOUR tenant):
• B2B collaboration: which users/groups from other tenants can be invited
• B2B direct connect: access without invitation to shared resources (e.g., Teams Connect)
• Trust settings: trust MFA and compliant devices from the external tenant
Outbound (what YOUR users can do in other tenants):
• Control whether your users can be invited into external tenants
Default guest restrictions
Guests have restricted directory permissions by default:
• Cannot enumerate all directory users
• Cannot see groups they don't belong to
• Cannot register apps (unless explicitly allowed)
• Configurable in Entra ID → External Identities → External collaboration settings
| Identity provider | Description | Authentication flow |
|---|---|---|
| Entra ID (another tenant) | The user has an account in another Azure tenant | Redirect to source tenant → authentication → SAML/OIDC token → access |
| Microsoft Account (MSA) | Outlook, Hotmail, Live | Redirect to login.live.com → authentication → token → access |
| Gmail, Google Workspace | Federated with Google Identity → OAuth → token → access | |
| Email OTP | Any email without Entra ID or Google | Azure sends a 6-digit code to the email → user enters it → temporary access |
| SAML/WS-Fed (custom) | Own corporate IdP with SAML | Redirect to the configured federated IdP → SAML assertion → access |
The join type determines how the device identifies itself to Entra ID, which policies it receives, and what the user can do from that device.
| Dimension | Entra ID Registered | Entra ID Joined | Hybrid Entra Joined |
|---|---|---|---|
| Scenario | BYOD — personal device | Cloud-only — new corporate devices | Devices already joined to on-prem AD DS |
| Supported OS | Windows 10+, iOS, Android, macOS | Windows 10+ and 11 | Windows 10/11 (and Server 2016+) |
| Requires | Just registering — the user adds their corporate account | Windows Out-of-box Experience (OOBE) or Autopilot | Entra Connect + an active AD DS domain |
| Login with | Device's personal account + registered corporate account | Entra ID account as the device principal | AD DS domain account (accesses cloud resources via token) |
| Intune policies | Partial (optional MDM enrollment) | Full (Intune MDM + MAM) | Full if enrolled in Intune |
| SSO to cloud resources | With Authenticator app or registered SSPR | Native via PRT (Primary Refresh Token) | Native via PRT (requires line of sight to a DC or Entra Connect) |
| On-prem resource access | With corporate VPN | Cloud only (no on-prem domain join) | Yes — has a Kerberos ticket from AD DS |
| Typical case | Employee uses their personal iPhone or Mac for corporate email. | Cloud-native company with no on-prem AD DS | Company with legacy on-prem apps that also wants cloud access |
Primary Refresh Token (PRT)
The PRT is a special token issued by Entra ID to Entra Joined and Hybrid Joined devices. It lasts up to 14 days and renews automatically. It enables silent SSO to all apps integrated with Entra ID without re-authenticating. It's like Kerberos's "TGT" but for the cloud world. If a CA policy requires a compliant device, it's verified using the PRT.
Microsoft offers two tools for syncing on-premises AD DS with Entra ID. The AZ-104 tests when to use each one.
| Dimension | Entra Connect (classic) | Entra Connect Cloud Sync |
|---|---|---|
| Architecture | Full sync server (Windows Server) with an internal sync engine | Lightweight agent (~150 MB) installed on Windows Server, sync logic in the cloud |
| Multiple forests | Supports multiple forests but from the same server | Multiple disconnected forests — one independent agent per forest |
| Staging server (HA) | Yes — you can have a staging-mode server for failover | Multiple agents in the same forest for automatic HA |
| Password hash sync | Yes | Yes |
| Password writeback | Yes (configured in the wizard) | Yes (via configuration in the cloud portal) |
| Group writeback | Yes — M365 Groups → AD DS distribution groups | Yes (v2 — security groups too) |
| Exchange hybrid | Yes — full Exchange attributes | Limited support — not all Exchange attributes |
| Custom sync rules | Yes — very flexible with the Synchronization Rules Editor | Limited — basic transformations in the portal |
| On-demand provisioning | No (full sync cycle) | Yes — sync a specific user on demand for testing |
| Best for | Complex environments: Exchange hybrid, custom sync rules, single large forest | Simple scenarios, multiple disconnected forests, new deployments |
Which to choose? — quick decision tree
→ Do you have on-premises Exchange and need hybrid? → Classic Entra Connect
→ Do you have multiple disconnected AD DS forests? → Cloud Sync
→ Do you need complex sync rules or transformations? → Classic Entra Connect
→ New deployment with no specific Exchange requirements? → Cloud Sync
→ Need to migrate gradually from classic Entra Connect? → You can coexist, using Cloud Sync for new OUs/forests
Did you get this topic?
Test what you just learned
What is the main difference between Microsoft Entra ID and traditional Active Directory Domain Services (AD DS)?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.