Implement an identity management solution

Module 1

Implement initial configuration of Microsoft Entra ID


    Introduction

    In this module, you learn how to configure and manage a Microsoft Entra tenant. You explore Microsoft Entra roles, custom domains, and company branding options. In addition, you learn how to configure delegation by using administrative units and configure several tenant-wide settings within Microsoft Entra ID.

    Configure company brand


    You can add your company logo, colors, and background to the sign-in page so it looks like your own.

    • Needs Entra ID Premium P1/P2 or Office 365 license.

    • Go to Azure Portal → Entra ID → Company Branding to set it up.

    SettingDescription
    LanguageThe language is automatically set as your default and can't be changed.
    Sign-in page background imageSelect a .png or .jpg image file for the background of your sign-in pages. The image is anchored to the center of the browser, and scales to the size of the viewable space. You can't select an image larger than 1920x1080 pixels in size or that has a file size more than 300,000 bytes.
    Banner logoSelect a .png or .jpg version of your logo to appear on the sign-in page after the user enters a username and on the My Apps portal page.
    Username hintType the hint text that appears to users if they forget their username. This text must be Unicode, without links or code, and can't exceed 64 characters. If guests sign in to your app, we suggest not adding this hint.
    Sign-in page text and formattingType the text that appears on the bottom of the sign-in page. You can use this text to communicate additional information, such as the phone number to your help desk or a legal statement. This text must be Unicode and not exceed 1,024 characters.

    Configure and manage Microsoft Entra roles

    It’s Microsoft’s cloud identity and access management service that helps users sign in and access resources.

    • External resources: Microsoft 365, Azure portal, and other SaaS apps.

    • Internal resources: Company network apps, intranet, and your own cloud apps.

    Who uses Microsoft Entra ID?

    1. IT Admins:

      • Control access to apps and data.

      • Set up multi-factor authentication (MFA).

      • Automate user provisioning between on-prem AD and cloud apps.

      • Protect user identities and manage access governance.

    2. App Developers:

      • Add Single Sign-On (SSO) to apps.

      • Use APIs to create personalized experiences with organizational data.

    3. Microsoft 365 / Azure / Dynamics users:

      • Already use Entra ID automatically — each tenant includes it.

      • Can manage access to all connected cloud apps.

    If a user needs to manage Entra resources, assign them a proper role (like Azure roles or Entra roles).

    Microsoft Entra roles 

    Microsoft Entra roles are used to manage resources in your organization’s Entra directory.
    They let you do tasks like:

    • Create or edit users

    • Reset passwords

    • Assign licenses

    • Manage domains

    • Delegate admin roles

    These roles help control who can do what inside Microsoft Entra ID.

    Microsoft Entra rolePermissionsNotes
    Global AdministratorManage access to all administrative features in Microsoft Entra ID, and services that federate to Microsoft Entra IDThe person who signs up for the Microsoft Entra tenant becomes the first Global Administrator.
    Assign administrator roles to others
    Reset the password for any user and all other administrators
    User AdministratorCreate and manage all aspects of users and groups
    Manage support tickets
    Monitor service health
    Change passwords for users, Helpdesk administrators, and other User Administrators
    Billing AdministratorMake purchases
    Manage subscriptions
    Manage support tickets
    Monitors service health

    In the Azure portal, you can see the list of Microsoft Entra roles on the Roles and administrators screen.

    Differences between Azure roles and Microsoft Entra roles

    At a high level, Azure roles control permissions to manage Azure resources, while Microsoft Entra roles control permissions to manage Microsoft Entra resources. The following table compares some of the differences.

    Azure rolesMicrosoft Entra roles
    Manage access to Azure resourcesManage access to Microsoft Entra resources
    Supports custom rolesSupports custom roles
    Scope can be specified at multiple levels (management group, subscription, resource group, resource)Scope is at the tenant level or can be applied to an Administrative Unit
    Role information can be accessed in Azure portal, Azure CLI, Azure PowerShell, Azure Resource Manager templates, REST APIRole information can be accessed in Azure admin portal, Microsoft 365 admin center, Microsoft Graph, and PowerShell

    Do Azure roles and Microsoft Entra roles overlap? 

    • Normally, they don’t overlap.
      Azure roles manage Azure resources (like VMs, storage, etc.), while Entra roles manage identity-related tasks (like users, groups, and licenses).

    • Exception:
      If a Global Administrator turns on “Access management for Azure resources” in the Azure portal, they temporarily get the User Access Administrator role in Azure — allowing them to manage access to Azure resources.

    • Some Entra roles, like Global Administrator and User Administrator, also apply to Microsoft 365 services (Exchange, SharePoint, etc.), but not to Azure by default.

    🔒 Best practice: Avoid using the Global Administrator role often — follow the principle of least privilege.

    Assign roles 

    You can assign roles in different ways, depending on what you need:

    1. To a user or group:

      • Go to Entra ID → Roles and administrators → Select a role → + Add assignment

    2. From a user or group view:

      • Entra ID → Users (or Groups) → Select user/group → Assigned roles → + Add assignment

    3. To a broader scope (like Subscription, Resource Group, or Management Group):

      • Use Access control (IAM) in that resource’s settings.

    4. Using PowerShell or Microsoft Graph API

      • For automation or scripting.

    5. Using Privileged Identity Management (PIM):

      • For just-in-time or temporary admin access.

    ⚠️ Be careful — there are no built-in restrictions. Assigning roles carelessly can give unwanted admin rights or open security risks. Always follow proper identity governance.

    Example - using PIM to assign a role

    A common way to assign Microsoft Entra roles to a user is on the Assigned roles page for a user. You can also configure the user eligibility to be elevated just-in-time into a role using Privileged Identity Management (PIM).

     Note

    If you have a Microsoft Entra ID Premium P2 license plan and already use PIM, all role management tasks are performed in the Privileged Identity Management experience. This feature is currently limited to assigning only one role at a time. You can't currently select multiple roles and assign them to a user all at once.

    Screenshot of Privileged Identity Manager for users assigned Global Admin and have a Premium P2 license.

    Create and assign a custom role in Microsoft Entra ID

    This section describes how to create new custom roles in Microsoft Entra ID. For the basics of custom roles, see the custom roles overview. The role can be assigned either at the directory-level scope or an app registration resource scope only.

    Custom roles can be created in the Roles and administrators tab on the Microsoft Entra ID overview page.

    1. Select Microsoft Entra ID - Roles and administrators - New custom role.

      Screenshot of Create or edit custom roles from the Roles and administrators page.

    2. On the Basics tab, provide a name and description for the role and then select Next.

      Screenshot of the basics tab. You provide a name and description for a custom role on the Basics tab.

    3. On the Permissions tab, select the permissions necessary to manage basic properties and credential properties of app registrations.

    4. First, enter "credentials" in the search bar and select the microsoft.directory/applications/credentials/update permission.

      Screenshot of the Select the permissions for a custom role on the Permissions tab.

    5. Next, enter "basic" in the search bar, select the microsoft.directory/applications/basic/update permission, and then select Next.

    6. On the Review + create tab, review the permissions and select Create.

    Your custom role shows up in the list of available roles to assign. 

    Exercise manage users roles

    You need to assign extra permissions to one of your newly created administrators. In this exercise, you'll create a user account to use in the exercises.

    Create an Azure account and add Microsoft Entra ID Premium P2 trial licenses

    The tasks in this exercise and the exercises in this learning path require you to already have an Azure subscription that you can use or to sign up for an Azure trial account. If you already have your own Azure subscription, you might skip this task and continue to the next.

    1. In a web browser, go to Azure portal.
    2. Scroll down through the page to learn more about the benefits and free services available.
    3. Select Start free.
    4. Use the wizard to sign up for your Azure trial subscription.
    5. You need to a Microsoft Entra ID P2 license to complete some of the exercises. In the organization you created, search for and then select Microsoft Entra ID.
    6. Select Licenses in the menu.
    7. In the right Quick tasks menu of the Licenses - Overview page, select Get a free trial
    8. Under Getting started with Microsoft Entra ID, select Get a free trial for Microsoft Entra ID Premium.
    9. In the Activate pane, under Microsoft Entra ID PREMIUM P2, select Free trial and then select Activate.
    10. In the navigation menu on the left, select Overview.
    11. Refresh the browser until you see Microsoft Entra ID Premium P2 under the organization name. It might take a couple of minutes.
    12. You might need to sign out and sign back into Microsoft Azure if you encounter any problems with expected features not being available.

    Add a new user

    Now, let's create a user account.

    1. Sign in to the Microsoft Entra admin center as a Global administrator

    2. In the menu on the left expand the Identity section.

    3. In the left navigation menu, under Users, select All Users, then select +New User.

    4. Create a user using the following information:

      SettingValue
      User principal nameAdeleV
      Mail nickname (you might have to uncheck the Derive from user principal name.AdeleV
      Display nameAdele Vance
      PasswordPass@word1

    5. Select Create. The user is now created and registered to your organization.

    Assign a role to a user

    Using Microsoft Entra ID, you can designate limited administrators to manage identity tasks in less-privileged roles. Administrators can be assigned for such purposes as adding or changing users, assigning administrative roles, resetting user passwords, managing user licenses, and managing domain names.

    1. In Microsoft Entra ID, All users screen, select Adele Vance.

    2. On the user’s profile page, select Assigned roles. The Assigned roles page appears.

    3. Select Add assignments, select the role to assign to the user (for example, Application administrator), and then select Add.

      Screenshot of the Assigned roles page Adele Vance.

    4. Select + Add Assignment.

      Screenshot of the Assigned roles page - showing the selected role of Application administrator.

    The newly assigned Application administrator role appears on the user’s Assigned roles page.

    Remove a role assignment

    If you need to remove the role assignment from a user, you can also do that from the Assigned roles page.

    To remove a role assignment from a user

    1. In Microsoft Entra ID, select Users - All User, and then select the user getting the role assignment removed. For example, Adele Vance.

    2. Select Assigned roles, then select the name of the role your wish to removed - Application Administrator.

    3. On the far right side of the screen, select Remove. Then select Yes option when prompted for confirmation.

      Screenshot of the Remove assignments dialog box with Yes highlighted.

    The Application administrator role is removed from the user and it no longer appears on the Adele Vance – Assigned roles page.

    Configure delegation by using administrative units

    • What they are:
      Administrative Units (AUs) are containers that hold users, groups, and devices within Microsoft Entra ID.

    • Purpose:
      They let you delegate admin roles to manage only specific parts of your organization — not the entire directory.

    • Example:
      Assign the Helpdesk Administrator role to regional staff so they can manage only users in their own region.

    • How to manage:
      You can configure AUs using the Azure portal, PowerShell, or Microsoft Graph API.

    What is an administrative unit? 

    An Administrative Unit (AU) in Microsoft Entra ID is a container used to limit the scope of admin permissions within a tenant.

    • Why it’s needed:
      By default, when you assign an admin role, that user can manage all users in the tenant. AUs help apply the principle of least privilege by narrowing that scope.

    • Example:
      You can create an AU for the Research Department in a hospital.

      • Add only research users and groups to it.

      • Assign a User Administrator role to “Admin-for-Research.”

      • This admin can manage only the research users, not the entire organization.

    👉 In short: Administrative Units let you delegate admin tasks safely to specific groups or regions within your organization.

    What admin roles are available for an administrative unit?

    You can have users in the following roles to manage your administrative unit:

    Authentication administrator

    Helpdesk administrator

    License administrator

    Password administrator

    User administrator

    Note

    If you're familiar with on-premises Active Directory, this capability was handled by setting up Organizational Units (OUs) in your directory and adding your users to the OU.

    Plan your administrative units 

    • Purpose: Use AUs to logically group resources like users, groups, and devices.

      • Example: Group by geography (regional IT teams) or suborganizations (semi-autonomous departments).

    • Guidelines:

      • Align AUs with your organization’s Microsoft 365 structure for maximum benefit.

      • Plan based on how resources and admin tasks are distributed.

    • Typical AU lifecycle:

      1. Initial adoption: Create AUs based on initial criteria; adjust as needed.

      2. Pruning: Delete AUs that are unnecessary after refining criteria.

      3. Stabilization: Structure is defined; AU numbers remain mostly stable.

    Proper planning ensures efficient delegation and least-privilege administration across the organization.

    Delegate administration in Microsoft Entra ID 

    As organizations grow, delegating administration helps reduce workload and maintain security by applying the least privilege principle.

    Ways to delegate application management:

    1. Restrict application creation:

      • By default, all users can register apps.

      • You can limit this permission to selected users only.

    2. Assign owners to an application:

      • Gives specific users full control over that application without affecting others.

    3. Use built-in admin roles:

      • Roles like Application Administrator let IT experts manage all app configurations without broader Entra access.

    4. Create custom roles:

      • Define specific permissions for users.

      • Can be assigned to individual apps (limited-owner) or all apps in the directory (limited-admin).

    Benefits:

    • Reduces administrative overhead.

    • Improves security by limiting permissions and potential unauthorized access.

    Plan for Delegation

    It's work to develop a delegation model that fits your needs. Developing a delegation model is an iterative design process, and we suggest you follow these steps:

    *Define the roles you need

    *Delegate app administration

    *Grant the ability to register applications

    *Delegate app ownership

    *Develop a security plan

    *Establish emergency accounts

    *Secure your administrator roles

    Make privileged elevation temporary

    Define roles 

    To define roles effectively:

    1. Identify directory tasks performed by administrators.

    2. Evaluate each task based on:

      • Frequency – How often it’s performed.

      • Importance/Risk – Potential impact if misused.

      • Difficulty/Skill required – Level of expertise needed.

    Guidelines for delegation:

    • Good for delegation: Routine, low-risk, and simple tasks.

    • Caution: Rare, high-risk, or complex tasks — better handled by temporary role elevation or reassignment.

    Proper role definition ensures least-privilege access and reduces security risks.

    Delegate app administration 

    When too many apps exist, relying on Global Administrators for app management increases overhead and risk. You can delegate using less-privileged roles:

    1. Application Administrator:

      • Can manage all applications in the directory.

      • Tasks include: registrations, SSO settings, user/group assignments, licensing, Application Proxy, and consent.

      • Cannot manage Conditional Access policies.

    2. Cloud Application Administrator:

      • Same as Application Administrator except no access to Application Proxy settings (no on-premises permissions).

    Delegating with these roles improves security and reduces administrative mistakes.

    Delegate app registration 

    By default, all users can register applications. To control this:

    1. Restrict who can register apps:

      • Go to User settings → Users can register applications → Set to No.

      • Assign selected users to the Application Developer role.

    2. Control app consent permissions:

      • Go to Enterprise apps → User settings → Users can consent to apps accessing company data → Set to No.

      • Assign selected users to the Application Developer role.

    • Note: When an Application Developer creates an app, they automatically become the first owner of that app.

    Delegate app ownership

    To give fine-grained control over applications, you can assign owners to individual enterprise applications.

    • Benefits:

      • Owners manage only the apps they own.

      • Multiple owners can exist per app, and a user can own multiple apps.

    App Owner Roles:

    1. Enterprise Application Owner:

      • Manage enterprise applications they own.

      • Can configure SSO, user/group assignments, and add more owners.

      • Cannot manage Application Proxy or Conditional Access.

    2. Application Registration Owner:

      • Manage application registrations they own.

      • Can edit the application manifest and add other owners.

    Assigning owners helps delegate responsibilities safely without giving broad administrative access.

     Develop a security plan

    Microsoft Entra ID provides an extensive guide to planning and executing a security plan on your Microsoft Entra admin roles, Securing privileged access for hybrid and cloud deployments.

    Establish emergency accounts

    To maintain access to your identity management store when issue arises, prepare emergency access accounts according to Create emergency-access administrative accounts.

    Secure your administrator roles

    Attackers who get control of privileged accounts can do tremendous damage. Always protect these accounts first. Use the Security Defaults feature that is available to all Microsoft Entra organizations. Security Defaults enforces multifactor authentication on privileged Microsoft Entra accounts.

    Analyze Microsoft Entra role permissions 

    • What is a permission?
      A permission is the authorization to perform a specific action. In Microsoft Entra ID, this ranges from:

      • Viewing settings

      • Changing settings

      • Adding or removing users

      • Managing other resources

    • Where permissions apply:

      1. User level – Directly assigned to a user.

      2. Group level – Assigned to a group; inherited by all members.

    All permissions eventually affect the user, either directly or via group membership. This helps define role capabilities and limits.

    Sample of the default permissions for users

    Member UsersGuest Users
    Enumerate list of users and their contactsRead own properties
    Invite guest usersInvite guest users
    Can create Security and Microsoft 365 GroupsCan search for non-hidden groups by name
    Register new applicationsRead properties of registered and enterprise applications

     Note

    This is just a small subset, to show differences. If you want a full list of the Default User Permissions 

    Controlling permissions - add and restrict

    User settingsRoles and administrators
    Screenshot of the Microsoft Entra ID user settings, where permissions can be restricted.Screenshot of the Roles and administrators screen in Microsoft Entra ID. List of roles that can be applied.

    You can use the User Settings inside of Microsoft Entra ID – Manage menu to restrict or control the default permissions of the default users. Or you can use Roles and administrators to add new permissions onto your users and group. Always use the concept of Least Privilege and make sure the users only have the rights they need. In User settings you can restrict the user's ability to:

    • Register applications
    • Access the Azure portal
    • Block LinkedIn connections
    • Manage settings for external collaboration

    By adding roles to a given user account or group, you can add permissions on to member users, guest users, and service principals. Adding roles gives permissions to perform specific activities. Actions are limited, which allows the rule of least privilege.

    Exploring available permissions

    Screenshot of the Attribute definition reader. You can see which permissions a built-in role grants.

    If possible, you only want to grant the minimum permissions a user needs. So be sure to know what all permissions are granted when you assign a role. You can see the list of permissions in the description of each role. To open, launch Microsoft Entra ID, then open the Roles and administrators screen. Next select a role, and open its description page from the ellipsis (...) menu. Depending on the role you chose, you'll see a large or small number of permissions. Two sets of permissions:

    • Role permissions
    • Guest and service principal basic read permissions

    Configure and manage custom domains 

      • Part of usernames/email addresses, group addresses, and sometimes app ID URIs.

      • Must be owned by your organization.

    • Who can manage domains:

      • Only a Global Administrator can add, verify, or manage custom domains in Entra ID.

    Custom domains help make user identities and resources reflect your organization’s branding.

    Set the primary domain name for your Microsoft Entra organization

    When your organization is created, the initial domain name, such as ‘contoso.onmicrosoft.com,’ is also the primary domain name.

    The person who creates the tenant is automatically the Global administrator for that tenant. The Global administrator can add other administrators to the tenant. When adding new administrators, always use the principle of least privilege.

    The primary domain is the default domain name for a new user when you create a new user. Setting a primary domain name streamlines the process for an administrator to create new users in the portal. To change the primary domain name:

    1. Sign in to the Azure portal with an account that's an Administrator for the organization.

    2. Select Microsoft Entra ID.

    3. Select Custom domain names.

      Screenshot of the Add custom user dialog box. Opening the user management page.

    4. Select the name of the domain that you want to be the primary domain.

    5. Select the Make primary command. Confirm your choice when prompted.

      Screenshot of the configure domain dialog. You can make a domain name the primary.

    You can change the primary domain name for your organization to be any verified custom domain that isn't federated. Changing the primary domain for your organization won't change the user name for any existing users.

    Add custom domain names to your Microsoft Entra organization

    You can add up to 900 managed domain names. If you're configuring all your domains for federation with on-premises Active Directory, you can add up to 450 domain names in each organization.

    Add subdomains of a custom domain 

    Adding Subdomains in Microsoft Entra ID

    • Steps to add a subdomain (e.g., europe.contoso.com):

      1. Add and verify the root domain first (e.g., contoso.com).

      2. The subdomain is automatically verified once the root domain is verified.

      3. Refresh the domain list in Entra ID to see the added subdomain.

    • Note:

      • You can verify a subdomain in a different Entra organization even if the root domain is already added elsewhere.

      • During the process, you may be prompted to add a TXT record in your DNS provider for verification.

    Subdomains allow flexible identity management across regions or departments

    What to do if you change the DNS registrar for your custom domain name

    If you change the DNS registrars, there are no additional configuration tasks in Microsoft Entra ID. You can continue using the domain name with Microsoft Entra ID without interruption. If you use your custom domain name with Microsoft 365, Intune, or other services that rely on custom domain names in Microsoft Entra ID, see the documentation for those services. 

    Delete a custom domain name 

    • When to delete:

      • The domain is no longer used.

      • You want to use the domain in another Entra ID tenant.

    • Requirements before deletion:
      You cannot delete a domain if it’s still used by:

      • Any user (username, email, or proxy address)

      • Any group (email or proxy address)

      • Any application (app ID URI)

    • Steps:

      1. Remove or update all users, groups, and apps using the domain.

      2. Once no resources reference it, delete the domain from Entra ID.

    Only a Global Administrator can delete custom domains.

    Force Delete option 

    The ForceDelete option allows you to remove a custom domain even if it’s still referenced by users, groups, or applications, by automatically updating all references to the default domain (e.g., user@contoso.onmicrosoft.com).

    How it works:

    • Can be used via the Entra admin center or Microsoft Graph API.

    • Updates references for:

      • Users: UPN, EmailAddress, ProxyAddress

      • Groups: EmailAddress

      • Applications: identifierUris

    Requirements & limitations:

    • Fewer than 1000 objects referencing the domain.

    • Any Exchange references must be updated or removed in the Exchange Admin Center.

    • Cannot be used if:

      • Domain was purchased via Microsoft 365 subscription.

      • You are a partner managing another organization.

    • Errors occur if:

      • Objects to rename > 1000

      • An app to rename is multitenant

    ForceDelete is an asynchronous operation and ensures all domain references are safely renamed to the default domain.

    Configure tenant-wide setting 

    Tenant-wide settings are configurations that apply to all resources in your tenant. They control the look, feel, and behavior of your directory and its users.

    Key Tenant-Wide Options:

    1. Tenant Properties:

      • Location: Identity → Overview → Properties

      • Purpose: Set the directory name and values like the primary contact.

    2. User Settings:

      • Location: Identity → Users → User Settings

      • Purpose: Define global rights for users, e.g., who can register applications.

    3. External Collaboration Settings:

      • Location: Identity → External Identities → User Settings → Manage external collaboration

      • Purpose: Control what external guest users can do, e.g., invite other guests.

    Tenant-wide settings ensure consistent policies and permissions across your organization.

    Configure tenant-wide user settings

    Screenshot of the User settings screen in Microsoft Entra ID. Use it to configure what users can do.

    In Microsoft Entra ID, all users are granted a set of default permissions. A user’s access consists of the type of user, their role assignments, and their ownership of individual objects. The default user permissions can be changed only in user settings in Microsoft Entra ID. 

    Member and guest users 

    • Member Users:

      • Native users of the tenant.

      • Default permissions include:

        • Register applications

        • Manage their profile photo and mobile number

        • Change their password

        • Invite B2B guest users

        • Read most directory information

    • Guest Users:

      • Users invited from another directory (B2B collaboration).

      • Default permissions are restricted:

        • Manage their own profile and password

        • Access limited info about other users, groups, and apps

        • Cannot read the entire directory

      • Can be assigned admin roles, gaining full permissions in that role

      • Can invite other guest users

    Members have broader default rights, while guests are limited by default but can be elevated via roles.

    The following default permissions for member users can be restricted in the following ways:

    PermissionSetting explanation
    Users can register applicationBy default, member users can register applications.
    Setting this option to No prevents users from creating application registrations. The ability can then be granted back to specific individuals by adding them to the Application Developer role.
    Restrict access to Microsoft Entra administration portalSetting this option to No lets non-administrators use the Microsoft Entra administration portal to read and manage Microsoft Entra resources. Yes restricts all non-administrators from accessing any Microsoft Entra data in the administration portal.
    This setting doesn't restrict access to Microsoft Entra data using PowerShell or other clients such as Visual Studio. When set to Yes, to grant a specific non-admin user the ability to use the Microsoft Entra administration portal assign any administrative role such as the Directory Readers role.
    This role allows reading basic directory information, which member users have by default (guests and service principals don't).

     Sign in with LinkedIn

    LinkedIn, with over 500 million members, can be used to enhance sign-in experiences for your apps and sites.

    Benefits:

    1. Reduce friction: Let users sign in with LinkedIn instead of creating a new account, increasing sign-ups.

    2. Save time and costs: Avoid building your own sign-in, identity, and password management system.

    3. Personalization: Access member profiles to tailor experiences in your apps or websites.

    Using LinkedIn sign-in leverages a trusted professional identity for smoother and safer user authentication.

    Manage security defaults 

    Security defaults help protect your organization from common identity attacks (password spray, phishing, replay attacks) by providing preconfigured security settings.

    Key Features:

    1. MFA for all users: Everyone must register for multi-factor authentication.

    2. MFA for administrators: Admins must perform MFA for extra protection.

    3. Block legacy authentication: Prevents older, less secure protocols.

    4. Step-up MFA when needed: Users must perform MFA for high-risk actions.

    5. Protect privileged activities: Safeguards access to critical resources like the Azure portal.

    Security defaults make it easy to enforce strong security policies without complex configuration.

    Availability

    Microsoft is making Security Defaults available to everyone. The goal is to ensure that all organizations have a basic level of security enabled at no extra cost. 

    Configure the external user options

    Screenshot of the Microsoft Entra ID manage external user settings dialog.

    Here you configure the actions that external users can take while using the cloud resources of your tenant.

    • Guest user access - Guest users can be given rights to where they operate almost as a full user, to restriction where they can only look at their own content.
    • Guest invite settings - Who can invite guests to join the organization; from guest themselves to only admins.
    • Guest self-service up - Allow guest to partake in self-service options for users.

    Configure tenant properties for the directory

    Screenshot of the Microsoft Entra ID properties dialog box. Configure the definition of your tenant.

    Set the basic values that define the look at feel of your tenant within Microsoft Entra ID.

    • Name - friendly name for your tenant, for use in the Azure portal
    • Country or region - location of your primary company and the Azure datacenters being used
    • Notification language - language used for sending notifications and alerts
    • Tenant ID - unique identifier for your tenant, used programatically
    • Technical contact - primary contact for the tenant (defaults to the user who created the tenant)
    • Global privacy contact - user or alias to contact for privacy concerns or issues
    • Privacy statement URL - link to a PDF or webpage containing the privacy rules for your cloud solutions

    Exercise - setting tenant-wide properties


    • 4 minutes

    Your goal is to change the tenant display name.

    1. Browse to the Azure portal and sign in using an Administrator account for the directory.

    2. Select the Show portal menu hamburger icon and then select Microsoft Entra ID.

      Screenshot of the Azure portal menu with Microsoft Entra ID selected.

    3. In the left navigation, in the Manage section, select Properties.

    4. In the Name box, change the tenant name. For example, Contoso Marketing Company can be changed to Contoso Marketing Company 2.

    5. Select Save to update the tenant properties.

    Find the Country / region associated with your tenant

    1. In the Microsoft Entra ID screen, in the Manage section, select Properties.

    2. Under Tenant properties, locate Country / region and review the information.

       Important

      When the tenant is created, the Country / region is specified at that time. This setting can't be changed later.

    Find the location associated with your tenant

    Just as the Country / region is found in the Microsoft Entra ID Properties dialog, so is the location information.

    1. In the Properties screen, under Tenant properties, locate Location and review the information.

      Screenshot of the Microsoft Entra ID Properties with the Country or region settings highlighted.

    Find the tenant ID

    Azure subscriptions have a trust relationship with Microsoft Entra ID. Microsoft Entra ID is trusted to authenticate users, services, and devices for the subscription. Each subscription has a tenant ID associated with it, and there are a few ways you can find the tenant ID for your subscription.

    1. In the Microsoft Entra ID screen, in the Manage section, select Properties.

    2. Under Tenant properties, locate Tenant ID. Tenant ID is your unique tenant identifier.

      Screenshot of the Tenant properties page with the Tenant ID box highlighted.

    Change the Technical contact, add your privacy info, Global privacy contact, and Privacy statement URL

    Microsoft strongly recommends you add both your global privacy contact and your organization's privacy statement, so your internal employees and external guests can review your policies. Because privacy statements are uniquely created and tailored for each business, we strongly recommend you contact a lawyer for assistance.

     Note

    For information about viewing or deleting personal data, see Azure Data Subject Requests. For more information, see the Service Trust portal.

    You add your organization's privacy information in the Properties area of Microsoft Entra ID. To access the Properties area and add your privacy information:

    1. In the Microsoft Entra ID screen, in the Manage section, select Properties.

    Screenshot of the tenant properties with the Technical contact, Global contact, and Privacy statement boxes highlighted.

    1. Add your privacy info for your employees:

    • Technical contact. Type the email address for the person to contact for technical support within your organization.

    • Global privacy contact. Type the email address for the person to contact for inquiries about personal data privacy. This person is also who Microsoft contacts if there's a data breach. If there's no person listed here, Microsoft contacts the administrator who owns the tenant.

    • Privacy statement URL. Type the link to your organization's document that describes how your organization handles both internal and external guest's data privacy.

      Screenshot of the B 2 B Collaboration Review permissions box with Accept / Cancel buttons.

    1. Select Save.









    Module 2
    Create, configure, and manage identities

    Comments

    Post a Comment

    Popular posts from this blog

    IAM Concepts Covered

     Explore identity in Microsoft Entra ID   Microsoft Entra ID controls secure access for users, devices, apps, and external users using Zero Trust principles Identity acts as the control plane for authentication, authorization, auditing, and licensing     2.Implement initial configuration of Microsoft Entra ID Customize the sign-in experience and configure tenant settings , including branding and custom domains Manage Microsoft Entra roles and permissions using least-privilege and administrative units for secure delegation      3.Create, configure, and manage identities Manage users, groups, and devices in Microsoft Entra ID Assign and control licenses for users and groups Use automation and security attributes to simplify identity management     4.Implement and manage external identities Enable secure guest access (B2B) for external users in Microsoft Entra ID Invite, manage, and control external users across Entra ID and Microsof...
    Read more

    Implement an Authentication and Access Management solution

    Image
      Module 1 Secure Microsoft Entra users with multifactor authentication    Introduction   As a  security engineer  in a manufacturing firm handling sensitive client designs: Threat:  Hackers want to access confidential designs via  user accounts . Even with a hardened network, a compromised username/password can bypass many defenses. Solution:   Multifactor Authentication (MFA) Adds an  extra layer of security  beyond just a password. Typically requires something you  know  (password) + something you  have  (phone, token) or  are  (biometric). Even if a hacker steals credentials, they cannot access accounts without the second factor. MFA is one of the  most effective ways  to prevent unauthorized access and protect sensitive data in Azure and other cloud services.   What is Microsoft Entra multifactor authentication? Protecting your cloud assets is one of the main goals for security group...
    Read more