The first group in AZ-104 domain 1 is "manage Microsoft Entra users and groups." It covers creating users and groups, managing their properties, managing licenses, managing external users, and configuring self-service password reset (SSPR), and in our question bank it carries a lot of weight with 24 questions. Practical questions come up often: "License assignment fails with an error," "New sales hires should get the right group and license automatically," "Only users from the partner company's domain may be invited."
This article walks through those tasks in order: ways to create users and how to restore deleted ones, group types and dynamic membership rules, group-based licensing and license errors, inviting external users and external collaboration settings, SSPR configuration and licensing, and administrative units that split administrative scope. The basics of Entra ID are covered first in Identity and Governance.
---
Creating Users: Internal and External
People join a company in one of two ways: they're hired and get an employee badge, or they come from a partner and get a visitor pass. Entra ID likewise distinguishes users you create inside the organization from guests you invite from outside.
| Method | Result | When to use | |------|------|------| | Create a new user | A member user with a UPN in your tenant's domain | Employee accounts | | Invite an external user | A guest user (B2B) who signs in with their own organization's account | Partner and customer contacts | | Bulk operations (CSV) | Create, invite, or delete many users at once | Onboarding a batch of new hires | | Sync from on-premises | Users whose AD accounts are synchronized to Entra ID | Hybrid environments |
Three user properties appear often on the exam. Usage location must be set before a license can be assigned; attributes such as department, job title, and country drive dynamic group rules; and manager is used for org charts and approval flows.
A deleted user doesn't disappear right away; the account stays in a suspended state for 30 days. During that window you can restore it with all its properties. After 30 days, or after a permanent delete, it can't be recovered.
Exam tip: "Bring back a user deleted by mistake yesterday, along with their group memberships" means restoring from Deleted users in the Entra admin center. Creating a new account makes a different object, and the old permissions don't come with it.
---
Group Types and Membership Types
Groups vary along two axes: what they're used for, and how members are decided.
| Axis | Type | Characteristics | |------|------|------| | Group type | Security group | Manages access to resources (RBAC, app assignment, licenses); users and devices can both be members | | Group type | Microsoft 365 group | For collaboration with a shared mailbox, team site, and calendar; only users can be members | | Membership | Assigned | An admin or owner adds and removes members directly | | Membership | Dynamic user | Members added and removed automatically by a user attribute rule | | Membership | Dynamic device | Members added and removed automatically by a device attribute rule; security groups only |
A dynamic group rule is an expression that compares user attributes. For example, makes every user whose department is Sales and whose country is Korea a member. When a user's department changes, the rule is reevaluated and the user drops out of the group automatically.
Each user in a dynamic group needs a Microsoft Entra ID P1 (or Intune for Education) license You can't add or remove members of a dynamic group manually A single rule can't mix users and devices, and device rules can reference only device attributes A tenant can have up to 15,000 dynamic groups
Exam tip: "Add one executive to the dynamic group as an exception" is an impossible requirement. Change the rule, or create a separate assigned group. If you need "a group with devices as members," it must be a security group, not a Microsoft 365 group.
---
Managing Licenses: Usage Location and Group-Based Licensing
You can assign a license to each user directly, or assign it to a group so that every member receives it. Combine group-based licensing with a dynamic group, and changing a user attribute is enough for the group and the license to follow automatically.
!Change a user attribute, and the dynamic group and group-based license follow automatically
Some Microsoft services aren't available in every country, so a user's usage location must be set before a license is assigned With group-based licensing, users without a usage location inherit the tenant's location Group-based licensing doesn't support nested groups, so users in a group inside the group don't receive the license Current Microsoft documentation directs group license assignment to Billing > Licenses in the Microsoft 365 admin center (Microsoft Graph PowerShell also works) Direct and group assignments can coexist, and a group-assigned license is removed automatically when the user leaves the group
Group-based licensing doesn't show errors immediately; it records them on the user object. The typical errors are:
| Error | Cause | Fix | |------|------|------| | Not enough licenses | Fewer licenses purchased than group members | Buy more licenses or clean up membership | | Conflicting service plans | A service overlaps with another license the user already has | Disable the overlapping service plan in the assignment | | Other products depend on this license | Removing a service that another product needs | Resolve the dependency first | | Usage location isn't allowed | Usage location is missing or set to a country where the service isn't available | Fix the user's usage location |
Exam tip: When a question says "a license can't be assigned to the user," the first property to check is usage location. "Licenses were assigned to a nested group, but some users didn't get them" is caused by the lack of nested group support.
---
Managing External Users (B2B Guests)
When you invite an external user, they sign in to your apps and resources with their own organization's account or a personal account. An object with user type Guest appears in your tenant, and the person can sign in only after accepting (redeeming) the invitation. Who can invite and what guests can see are set in external collaboration settings.
| Setting | Options | Clues in a question | |------|------|------| | Guest user access | Same access as members · limited access (default) · only their own objects (most restrictive) | "Guests must not see the list of other users" | | Guest invite settings | Anyone · members and specific admin roles · only specific admin roles · no one | "Regular employees can't invite; only designated people can" | | Collaboration restrictions | Allow only specific domains, or block specific domains | "Invitations only to partner contoso.com" | | Cross-tenant access settings | Per-organization B2B inbound and outbound allowances, trust MFA from the partner tenant | "Accept MFA the partner company already performed" |
Exam tip: "Only a few specific employees may invite guests" means setting guest invite settings to "only users assigned to specific admin roles" and giving those employees the Guest Inviter role. A requirement to allow or block by domain is a collaboration restriction.
---
Self-Service Password Reset (SSPR)
SSPR lets users who forgot their password reset it themselves without the help desk. You need both the settings and the licensing to answer questions.
| Setting | What it covers | |------|------| | Scope | None · Selected (one group) · All | | Authentication methods | Choose which to allow: Authenticator notification or code, email, mobile phone, office phone, security questions | | Number of methods required | 1 or 2 to reset | | Registration | Require registration at sign-in, and set how often users reconfirm their information | | Notifications | Notify users and admins when a password is reset | | On-premises writeback | Writes a synchronized user's new password back to on-premises AD |
Administrator accounts always have SSPR enabled with a separate two-gate policy that requires two pieces of authentication data and prohibits security questions; it can't be changed Microsoft Entra ID Free allows only password change for cloud users; password reset needs Microsoft 365 Business Standard or higher, or P1 or P2 On-premises writeback needs P1 or P2, or Microsoft 365 Business Premium Security questions are scheduled to be retired from SSPR in March 2027
Exam tip: "Pilot SSPR with the sales team first" means setting the scope to Selected and choosing the sales team group. The admin center allows only one group, but nested groups are supported, so for several teams you select a parent group that has each team's group as a member.
---
Splitting Administrative Scope With Administrative Units
In a company with branches across the country, it's a problem if the Seoul help desk can reset passwords for employees in Busan. Administrative units narrow the scope of an Entra role to part of the organization.
Put Seoul branch users in a "Seoul" administrative unit, and assign the help desk staff the Helpdesk Administrator role scoped to that administrative unit Adding a group to an administrative unit brings only the group itself (name, membership) into scope, not the properties of its member users Each administrator who receives a role scoped to an administrative unit needs a Microsoft Entra ID P1 license
Exam tip: "Regional help desks may reset passwords only for users in their own region" means administrative units plus scoped role assignments. Azure RBAC resource groups can't split Entra users.
---
Exam Quick Reference
Key points to check one last time before the exam.
| Topic | What to remember | |------|------| | User types | Members you create vs guests you invite (B2B) | | Deleted users | Rest