CertifyDeckCargando contenido…
The official Microsoft Identity and Access Administrator syllabus, organized by domain. Check off each point as you review it.
Inicia sesión para guardar tu progreso entre sesiones.
Configure and manage a Microsoft Entra tenant
Built-in roles have a fixed set of permissions that can't be modified; custom roles are a collection of permissions you pick from a preset list. Granting access is a two-step process: define the role, then assign it to a security principal (user, group or service principal) at a scope such as the tenant, an administrative unit or a resource.
Overview of Microsoft Entra role-based access control (RBAC) ↗Create a custom role in Microsoft Entra ID ↗
Administrative units restrict the permissions of a role to the part of the organization you define, such as a region or a school, and can't be nested. When sensitive objects must be protected even from tenant-level administrators, use a restricted management administrative unit, which must be created with that setting from the start.
Administrative units in Microsoft Entra ID ↗Restricted management administrative units in Microsoft Entra ID ↗
A Privileged Role Administrator creates administrative units in the Microsoft Entra admin center, PowerShell or Microsoft Graph, adds users, groups or devices as members, and assigns roles scoped to the unit. Membership can be assigned or dynamic (users or devices, not both), and role assignments are removed before a unit is deleted.
Create or delete administrative units ↗Manage users or devices for an administrative unit with rules for dynamic membership groups ↗
Effective permissions result from all role assignments that apply to a user, direct or through groups, and from their scope: tenant, administrative unit or resource. A unit-scoped role acts only on the unit's members and on users without administrator roles, not on tenant-wide settings. Some actions on accounts that hold roles require more privileged roles.
Overview of Microsoft Entra role-based access control (RBAC) ↗Privileged roles and permissions in Microsoft Entra ID ↗
Domain Name Administrator is the least privileged role for managing domains. A custom domain is verified with a TXT or MX record at the registrar and can be verified in only one directory; subdomains are verified with the root domain. To delete a domain, remove its references first, or use ForceDelete, which renames them to the initial domain.
Add your custom domain ↗Add and verify custom domain names ↗
Organizational Branding Administrator is the minimum role to customize company branding in Microsoft Entra custom branding: background, logos, text, footer and template, with optional entries per browser language. It doesn't apply to personal Microsoft accounts, and in multitenant apps branding shows after the email is typed unless the whr parameter is used.
Tenant properties include the technical contact, global privacy contact and privacy statement URL. User settings (app registration, guest access, administration portal) require Global Administrator. The group naming policy and Microsoft 365 group expiration are managed by Groups Administrator; device settings by Cloud Device Administrator.
Add your organization's privacy information ↗Manage devices in Microsoft Entra ID using the Microsoft Entra admin center ↗
Create, configure, and manage Microsoft Entra identities
Users are created in Entra ID > Users as internal members, internal guests, external members or external guests. User Administrator is the least-privileged role to create users, and Guest Inviter can invite external guests. A deleted user stays in Deleted users for 30 days, where it can be restored, and its licenses become available to others.
How to create, invite, and delete users in Microsoft Entra ID ↗
Security groups manage access and can contain users, devices and service principals; Microsoft 365 groups contain only users but can include external guests. Membership can be assigned or dynamic (for users or for devices, never both). Role-assignable groups must be created as such, use assigned membership and do not support nesting.
Learn About Groups, Group Membership, and Access ↗How to manage groups - Microsoft Entra ↗
Custom security attributes are key-value pairs, organized into attribute sets, that you define and assign to users and enterprise applications. Global Administrator has no permissions by default: Attribute Definition Administrator defines and Attribute Assignment Administrator assigns. Attributes are never deleted, only deactivated, and they cannot be used in dynamic group rules.
What are custom security attributes in Microsoft Entra ID? ↗Manage access to custom security attributes in Microsoft Entra ID ↗
In the admin center, a User Administrator can bulk create, delete and invite users, and a Groups Administrator or the group owner can import members, always using CSV templates kept exactly as downloaded. Per-row errors appear in Bulk operation results. When portal jobs time out on large tenants, use Microsoft Graph PowerShell cmdlets.
Bulk create users in the Azure portal - Microsoft Entra ID ↗Bulk operations service limitations - Microsoft Entra ↗
A device gets an identity through registration (BYOD and mobile), Microsoft Entra join (organization-owned devices with work-account sign-in) or hybrid join (on-premises Active Directory plus Microsoft Entra). Device settings control who can join or register, MFA, the per-user limit and local administrators; Cloud Device Administrator can read and change them.
What is device identity in Microsoft Entra ID? ↗Manage devices in Microsoft Entra ID using the Microsoft Entra admin center ↗
Licenses are assigned to users directly or to groups (group-based licensing); License Administrator or User Administrator can do it, and Groups Administrator can for groups. The user's location must be set first. Nested groups are not supported for group licensing. The errors tab lets you review and reprocess failures; in PowerShell use Get-MgSubscribedSku, Set-MgGroupLicense and Set-MgUserLicense.
Assign or unassign licenses to a group in the Microsoft 365 admin center ↗PowerShell examples for group-based licensing ↗
Implement and manage identities for external users and tenants
External collaboration settings define what guests can see in the directory (same access as members, limited by default, or only their own profile), who can invite guests (everyone, members and admin roles, only roles such as User Administrator or Guest Inviter, or no one), self-service sign-up, external user leave and domain restrictions (an allow list or a block list, never both).
Configure external collaboration - Microsoft Entra External ID ↗Allow or block invitations - Microsoft Entra External ID ↗
An external user is invited from the Users area with at least the User Administrator role; a Guest account is created immediately in a pending acceptance state, and the invitation does not expire but can be resent. Groups and roles can be assigned at creation (roles require Privileged Role Administrator). For many users, bulk invite uses a CSV template whose first two rows must not be modified.
Add B2B collaboration users - Microsoft Entra External ID ↗Bulk invite B2B users - Microsoft Entra External ID ↗
A guest is a user object whose UserType (Guest or Member) is independent of how the user signs in, which the Identities property shows. Resetting redemption status (at least Helpdesk Administrator) lets you change the email or provider while keeping the object, groups and assignments. Internal accounts can be converted to B2B, and external users can leave the organization according to the leave setting.
B2B guest user properties - Microsoft Entra External ID ↗Reset guest redemption status - Microsoft Entra External ID ↗
Cross-tenant access controls B2B collaboration and B2B direct connect with other Microsoft Entra organizations through inbound, outbound and trust settings (MFA and device claims). Defaults allow B2B collaboration and block direct connect, and organizational settings take precedence over them. It is configured with at least Security Administrator, and automatic redemption must be selected in both tenants.
Cross-tenant access overview - Microsoft Entra External ID ↗Cross-tenant access settings - Microsoft Entra External ID ↗
Cross-tenant synchronization pushes internal users from a source tenant into a target tenant as B2B users, with external member as the default. The target allows synchronization in its inbound settings and both tenants enable automatic redemption; the configuration, scope and attribute mappings are defined in the source. Removing a user from scope soft deletes the user in the target.
What is cross-tenant synchronization in Microsoft Entra ID? ↗Configure cross-tenant synchronization - Microsoft Entra ID ↗
Guests can use Microsoft Entra accounts, Microsoft accounts, Google (for Gmail), email one-time passcode, Facebook (self-service sign-up only) or their own SAML or WS-Fed provider. SAML/WS-Fed federation needs an issuer, an https passive endpoint and a certificate; a metadata URL allows the certificate to be renewed. It is configured with at least External Identity Provider Administrator.
Add a SAML/WS-Fed identity provider - Microsoft Entra External ID ↗Identity providers for workforce tenants - Microsoft Entra External ID ↗
Implement and manage hybrid identity
Microsoft Entra Connect Sync is the on-premises sync engine of Microsoft Entra Connect: it creates and maintains users, groups and other objects and synchronizes password hashes. Only one server can be active; a second server in staging mode imports and synchronizes but does not export, and is used for fault tolerance and to test changes before it is made active.
Microsoft Entra Connect Sync: Understand and customize synchronization ↗Microsoft Entra Connect Sync: Operational tasks and considerations ↗
Cloud Sync synchronizes users, groups and contacts from Active Directory to Microsoft Entra ID through lightweight provisioning agents that only make outbound connections, with the configuration managed in the cloud. It supports several active agents with failover and disconnected forests. It offers scoping filters, attribute mapping, on-demand provisioning and accidental delete protection.
What is Microsoft Entra Cloud sync? ↗Microsoft Entra Cloud Sync new agent configuration ↗
Password hash synchronization sends Microsoft Entra ID a hash derived from the hash of the on-premises password, so users have the same password in the cloud, and it enables leaked credential detection. On-premises complexity rules override the cloud ones and, by default, the cloud password never expires. It can also serve as a backup when AD FS federation is used.
What is password hash synchronization with Microsoft Entra ID? ↗Implement password hash synchronization with Microsoft Entra Connect Sync ↗
Pass-through authentication validates the password directly against Active Directory through lightweight agents that only make outbound connections, without storing passwords in the cloud or needing a perimeter network. It works with Conditional Access. For high availability, more agents are installed on other servers (one per server); there is no automatic failover to password hash synchronization.
Microsoft Entra Connect: Pass-through Authentication ↗Microsoft Entra pass-through authentication - Quickstart ↗
Seamless SSO signs users in automatically on domain-joined devices inside the corporate network, with no additional on-premises components. It is combined with password hash synchronization or pass-through authentication, not with AD FS. It creates the AZUREADSSOACC account in each forest and requires adding the autologon URL to the Local intranet zone; its Kerberos key should be rolled over regularly.
Microsoft Entra Connect: Seamless single sign-on ↗Quickstart: Microsoft Entra seamless single sign-on ↗
To move from AD FS to cloud authentication (password hash synchronization or pass-through authentication), pilot with staged rollout using security groups that are neither nested nor dynamic, then convert each domain from federated to managed. Review Conditional Access and federated MFA behavior, and migrate applications with the AD FS application migration report before removing the relying party trust.
Migrate from federation to cloud authentication in Microsoft Entra ID ↗Microsoft Entra Connect: Cloud authentication via Staged Rollout ↗
Microsoft Entra Connect Health monitors the on-premises identity infrastructure (sync, AD FS and AD DS) with an agent installed on each server, providing alerts, performance data, usage analytics and sync errors. Email notifications are on by default and access is delegated with the Owner, Contributor and Reader roles. Deleting a server from the service does not uninstall its agent.
What is Microsoft Entra Connect and Connect Health ↗Microsoft Entra Connect Health operations ↗