Cram sheet — Manage Microsoft Entra users and groups

The examinable detail in this topic is rarely what a group is. It is what the platform refuses to let you change afterwards, what a feature costs in licensing, and which default is already switched on in a tenant nobody has configured.

Four user types, not two

A workforce tenant distinguishes where the account lives from what privileges it carries, and those are two independent axes rather than one:

External member is the one people forget. Such users authenticate with an external account but hold member access to your tenant, which is common in multitenant organizations. Guest and external are not synonyms.

Groups: the settings you cannot take back

• Creating a group needs at least the Groups Administrator or User Administrator role. Being a global reader or an owner of the resource is not enough.
• Turning on Microsoft Entra roles can be assigned to the group automatically selects Assigned as the membership type — and once that option is enabled, the membership type can no longer be changed. A role-assignable group is therefore never a dynamic group.
• Nesting is allowed for security groups, but a nested group does not gain access to resources and applications assigned to its parent. If the requirement is inherited access to an app, nesting is the wrong answer.

Dynamic membership is a licensed feature

• Dynamic membership groups require Microsoft Entra ID P1 — or an Intune for Education licence — for each unique user who is a member of one or more of them.
• The licences do not have to be assigned to those users individually; the organization simply has to hold enough of them to cover every such user. A thousand unique users across all dynamic groups means at least a thousand P1 licences.
• Device-based dynamic groups need no licence for the devices themselves.

External users

• A B2B guest signs in with their own credentials from their own organization, and appears in your directory as a user object whose user principal name contains the #EXT# identifier.
• By default, every user in the organization — including existing guests — can invite more guests. Restricting that is a configuration change, not the starting state.
• Two different settings are routinely confused. Cross-tenant access settings control whether users can authenticate with external Microsoft Entra tenants, inbound and outbound. External collaboration settings control which of your own users may send invitations at all.

Self-service password reset

• SSPR is not enabled for administrators by default — the tenant setting is for end users.
• If an Azure administrator role is assigned to the user, the strong two-gate password policy is enforced regardless of the tenant's own SSPR policy.
• The policy decides how many registered methods a reset needs — one or two — and a user who has not registered enough of them is told to contact an administrator rather than being let through.

Traps

Check yourself

Where these figures come from

Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.