Microsoft Certified: Azure Administrator Associate Manage Azure Identities and Governance Syllabus

Manage Azure Identities and Governance syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Manage Azure Identities and Governance in Microsoft Certified: Azure Administrator Associate, not a summary of it.

1. 1

   Microsoft Entra ID Users and Groups

   4 topics

   • Creating and managing user accounts
     • Member vs guest (B2B) users
     • Bulk user operations via CSV import/export
     • Soft-delete and restoring deleted users
   • Configuring and managing groups
     • Security groups vs Microsoft 365 groups
     • Assigned vs dynamic membership
     • Dynamic membership rules and syntax
   • Managing licenses in Microsoft Entra ID
     • Group-based license assignment
     • Resolving license assignment errors
   • Self-service password reset (SSPR)
2. 2

   Role-Based Access Control (RBAC)

   5 topics

   • Built-in Azure roles
     • Owner, Contributor, Reader, User Access Administrator
     • Service-specific built-in roles
   • Creating and assigning custom roles
     • Actions, NotActions, DataActions, NotDataActions
     • AssignableScopes definition
   • Scope and inheritance of role assignments
     • Management group, subscription, resource group, resource scope
   • Azure RBAC vs Microsoft Entra roles
     • Differentiating control-plane and directory roles
   • Interpreting effective permissions
3. 3

   Subscriptions and Governance

   5 topics

   • Management groups and hierarchy design
   • Azure Policy
     • Policy definitions, initiatives, and effects
     • Assignment scope and exclusions
     • Remediation tasks for non-compliant resources
   • Resource locks (CanNotDelete and ReadOnly)
   • Resource tags for organization and cost tracking
     • Applying and enforcing tags with policy
     • Tag inheritance considerations
   • Cost Management and budgets
     • Cost analysis and alerts
     • Creating budgets at scope

Manage Azure Identities and Governance flashcards for Microsoft Certified: Azure Administrator Associate

22 of 54 cards from the Manage Azure Identities and Governance deck — real questions with worked answers.

1. In Microsoft Entra ID, what are the three main types of user accounts you can create?

   Cloud (internal/native) accounts created directly in Entra ID; Directory-synchronized accounts synced from on-premises AD via Entra Connect; and Guest (external/B2B) accounts invited from outside the organization.

2. What is the difference between deleting and permanently removing a user in Microsoft Entra ID, and what is the restore window?

   A deleted user is soft-deleted and moved to the 'Deleted users' container where it can be restored for 30 days. After 30 days it is permanently (hard) deleted and cannot be recovered.

3. What two methods can you use to bulk create user accounts in Microsoft Entra ID?

   A CSV bulk-import operation in the Entra admin center, or scripting with PowerShell (e.g., New-MgUser) / Microsoft Graph API.

4. What is the User Principal Name (UPN) and what format does it take in Microsoft Entra ID?

   The UPN is the unique sign-in identifier for a user, formatted as an email-style name@domain (e.g., user@contoso.com), where the domain must be a verified domain in the tenant.

5. In Microsoft Entra ID, what are the two group types and how do they differ?

   Security groups manage access to resources and apps for users/devices; Microsoft 365 groups provide collaboration features (shared mailbox, calendar, SharePoint, Teams) and can include external users.

6. What are the two membership types for Microsoft Entra groups?

   Assigned (members added/removed manually) and Dynamic (membership automatically determined by rules evaluating user or device attributes).

7. What license is required to use dynamic group membership in Microsoft Entra ID?

   Microsoft Entra ID P1 (or higher) is required for each user that is a member of one or more dynamic groups.

8. What is a dynamic membership rule and give an example syntax for users in a specific department.

   A rule that auto-populates group membership from attributes. Example: (user.department -eq "Sales") adds all users whose department equals Sales.

9. What does 'group nesting' mean in Microsoft Entra ID and what is a key limitation for licensing?

   Group nesting is adding a group as a member of another group so it inherits assignments. However, group-based license assignment does NOT support nested groups—only direct members of a licensed group receive licenses.

10. In Microsoft Entra ID, what are the two prerequisites before you can assign a license to a user?

    The tenant must have available licenses (from a subscription/SKU), and the user must have a Usage Location set (required because some services are not available in all regions).

11. What is group-based licensing in Microsoft Entra ID?

    Assigning a license (SKU) to a group so all members automatically inherit it; users added to the group get licensed and users removed have it revoked. Requires Entra ID P1.

12. What happens to a user's license-dependent service data when their license is removed in Microsoft Entra ID?

    Service data enters a grace period and is eventually deleted; for example, removing an Exchange Online license deletes the mailbox after a 30-day grace period.

13. What is Self-Service Password Reset (SSPR) in Microsoft Entra ID?

    A feature that lets users reset or unlock their own password/account without help-desk involvement, using pre-registered authentication methods.

14. What are the three SSPR availability scopes an administrator can configure?

    None (disabled), Selected (enabled for a specific group), and All (enabled for every user in the tenant).

15. In SSPR, what is the difference between the 'number of methods required to reset' settings, and what is the minimum?

    Admins choose whether 1 or 2 authentication methods are required to reset a password. The minimum is one method; two methods is the more secure default.

16. What is the difference between SSPR and self-service password change?

    Password change is when a signed-in user who knows their current password changes it; SSPR (reset) is when a user who has forgotten/been locked out resets it using verified authentication methods without knowing the current password.

17. What is password writeback in the context of SSPR, and when is it needed?

    Password writeback synchronizes password changes made in the cloud (via SSPR) back to on-premises Active Directory. It is required for hybrid (synced) users and needs Entra ID P1 plus Entra Connect.

18. What is Azure Role-Based Access Control (Azure RBAC)?

    An authorization system built on Azure Resource Manager that provides fine-grained access management to Azure resources by assigning roles (sets of permissions) to security principals at a specific scope.

19. What are the three elements that make up an Azure RBAC role assignment?

    Security principal (user, group, service principal, or managed identity), Role definition (the set of permissions), and Scope (the boundary the access applies to).

20. What are the four scope levels in Azure RBAC, from broadest to narrowest?

    Management group, Subscription, Resource group, and Resource.

21. Name the three fundamental built-in Azure roles and what each grants.

    Owner: full access including the ability to delegate access to others; Contributor: full access to manage resources but cannot grant access to others; Reader: view-only access to resources.

22. What does the built-in 'User Access Administrator' role allow?

    It allows managing user access to Azure resources—specifically creating and managing role assignments—without granting the ability to manage the resources themselves.

See more Manage Azure Identities and Governance flashcards →

Planning Manage Azure Identities and Governance for Microsoft Certified: Azure Administrator Associate

Manage Azure Identities and Governance (Microsoft Certified: Azure Administrator Associate) FAQ