Entra users, groups and readiness

Identity and eligibility

Start by distinguishing the requested operation: creating an identity, granting resource access, assigning a license or enabling password reset. These decisions are related, but one does not prove the others. A guest who accepted a B2B invitation still needs resource authorization.

An Azure RBAC role is not automatically a directory administration role. Record who administers the identity and who approves effective access.

Licenses and membership

For group licensing, check direct membership. Nesting a group does not automatically give all its members the parent group’s license. License availability is only one condition; also review conflicting plans and usage location.

When that location is missing, group assignment can use the tenant location. Do not confuse that fallback with confirmation of each person’s actual location.

Transition without service loss

When two groups serve exclusively for licensing, adding to the destination, confirming individual processing and only then removing from the source reduces service-loss risk. If groups also grant access, overlapping membership needs a separate privilege analysis.

Accepted membership changes do not guarantee every license was applied. Retain per-user outcomes and investigate errors without indiscriminately deleting groups or assignments.

SSPR and acceptance exercise

For an ordinary cloud user, confirm SSPR scope, allowed methods and the required number of registered methods. Requiring registration does not mean registration has happened. Earlier MFA sign-in does not automatically demonstrate readiness for the reset policy.

In a tabletop exercise, consider three records: a user outside scope, one with incomplete registration and one ready. Explain the next action for each before comparing answers. Administrators and writeback environments require specific analysis.

Common pitfalls

Do not use total membership as proof of licensing, accepted invitations as proof of authorization, or MFA success as proof of every SSPR method.