Microsoft Entra Users, Groups, and Azure RBAC
Read and analyze Microsoft Entra user and group exports, then plan and audit Azure RBAC role assignments scoped to a lab resource group using the Azure CLI.
Lab Overview
Practice the identity and access administration skills the AZ-104 exam expects, designed to run inside a Contributor-scoped lab subscription.
Microsoft Entra tenant-admin rights are usually not available in a shared lab subscription, and the Contributor role cannot create role assignments, so this lab teaches Entra user and group concepts through static directory exports and scenario reasoning, then has you perform live read and review work with Azure RBAC scoped to your lab resource group. You will analyze exported Entra users and groups, map people to least-privilege roles, inspect role definitions, review and audit existing role assignments at resource-group scope, author a role-assignment plan, and design a custom role definition.
What You'll Learn
Prepare an Azure CLI workspace for identity and access administration
Interpret Microsoft Entra user and group exports without tenant-admin rights
Map users and groups to least-privilege Azure built-in roles
Plan and audit Azure RBAC role assignments scoped to a resource group
Design a custom role definition that follows least-privilege principles
Prerequisites
Basic command line familiarity
Basic understanding of Azure resource groups and subscriptions
Basic JSON reading experience
Technologies Covered
Part of a Course
This lab is part of the Microsoft Azure Administrator (AZ-104) course
View All CoursesChoose your plan
Simple, Transparent Pricing
Unlock full access to TeKanAid courses, labs, and bootcamps
Just exploring? Start free below. Want the full experience? Try Premium free for 7 days (card required, $0 today).
Pro
All courses, with lab scripts to run on your own machine
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Full access to all courses
- Lab scripts to download and run on your own machine (hosted labs not included)
- Progress tracking
- Certificate of completion
- Community access
- Bootcamp participation
- New content access
Premium
Full access, including unlimited hosted labs
Renews automatically. Cancel anytime.
Final price verified at checkout.
- Everything in Pro
- Unlimited hands-on labs, fully hosted on TeKanAid Academy (nothing to set up)
- Lab AI Assistant
- Accelerator bootcamps with live office hours
- Priority support
Prefer a single course?
Purchase individual courses for a one-time fee of $79. Full access to course content, quizzes, certificates, and community features, lab access is not included.
Browse CoursesJust exploring? Start free, no account needed
Three free ways to start. All bridge into the paid Premium catalog when you're ready.
Not ready to commit? The crash course is email-only. No academy account required.
Ready to Get Started?
Start this hands-on lab and build real-world Platform Engineering skills
Get Access Now