AZ-104 · Microsoft Entra users and groups

20 cards

Microsoft Entra Groups and Properties

Playback speed

Swipe, scroll or use ← →

Why groups exist at all

A Microsoft Entra group helps organize users, which makes permissions easier to manage. The resource owner — or the directory owner — assigns a set of access permissions to all the members of the group at once, instead of granting the rights to each person one by one.

That changes the unit of work. A group lets you define a security boundary, and from then on access is granted or denied by adding and removing specific users, with a minimum amount of effort.

Without groups	With a group
Every permission is granted per person	One permission set covers all members
Access changes mean editing each account	Access changes mean editing the membership
Nothing describes who belongs together	The group itself is the security boundary

Microsoft Entra ID goes one step further: membership can be defined by rules that read attributes such as the department a user works in or the job title they hold.

1 / 20

Quick check

What does putting users in a group actually change about permission management?
1. AEvery member keeps their own individual permission set as before
  
  The point of the group is that members stop needing individually granted rights for the shared resource.
2. BPermissions can be granted per person more quickly than before
  
  Granting rights one by one is exactly the work that the group is meant to replace, not to speed up.
3. COne permission set reaches all members, and access changes become membership changes
  
  Right. A group defines a security boundary, so one set of permissions covers its members and access is adjusted by adding or removing them.
2 / 20

Two group types, two jobs

Microsoft Entra ID lets you define two different types of groups, and the choice is about purpose rather than size.

	Security group	Microsoft 365 group
What it is for	Managing access to shared resources	Collaboration
What members get	Permissions on the resources the group protects	A shared mailbox, calendar, files, a SharePoint site, and more
Who can create it	It requires a Microsoft Entra administrator	Available to users and to administrators
People outside the organization	—	Can be given access to the group

Security groups are the most common type. A typical use is a group created for one security policy: the permissions are given to all its members at once, rather than being added to each member individually.

3 / 20

Quick check

A project team needs a shared mailbox, a calendar, files and a SharePoint site, and outside collaborators must be included. Which group type fits?
1. AA Microsoft 365 group, which provides those collaboration resources
  
  Right. Microsoft 365 groups exist to give members collaboration resources, and they can include people from outside the organization.
2. BA security group, which provides those collaboration resources
  
  A security group manages access to shared resources; it is not what supplies a mailbox, calendar or SharePoint site.
3. CAssigned membership, which provides those collaboration resources
  
  Assigned is a membership type, so it describes how a roster is filled rather than what the group provides.
4 / 20
Two group types, two jobs

The membership of a security group is not limited to people. Members can include users, devices, and service principals — which is why a security group is also the answer when a workload identity or a machine needs the access, not a person.

A Microsoft 365 group is described by what it hands its members. Shared mailboxes, calendars, files and SharePoint sites are collaboration resources; they are not access-control objects, and they are not the kind of thing a security group contains.

5 / 20
Quick check

Which list contains only things that can be members of a security group?
1. AUsers, devices and service principals
  
  Right. Security-group membership can include users, devices and service principals.
2. BShared mailboxes, calendars and SharePoint sites
  
  Those are collaboration resources that a Microsoft 365 group provides to its members, not objects placed inside a security group.
3. CDepartments, job titles and work locations
  
  Those are user attributes that a membership rule can evaluate; an attribute is not an object that joins a group.
6 / 20
Keep your progress in the app

That’s 3 of 10 quick checks. In the app they stay answered, and every lesson remembers where you left off.

Get the app Keep reading here

Create a group and set its properties

Groups live under Identity in the Microsoft Entra admin center: open Groups > All groups and select New group. A new deployment has no groups defined, so this list starts empty.

The form asks for five properties.

Property	What it decides
Group type	Security or Microsoft 365 — the purpose of the group
Group name	How the group is identified in the list
Membership type	How members are populated
Owners	Who governs the group
Members	Who is in it at creation time

Together, those properties determine the group's purpose, who governs it, and how its membership is populated. After creating the group, verify that it appears in All groups; the list may need refreshing a couple of times before a new group shows up.

7 / 20

Quick check

Which admin center path opens the creation of a group?
1. AIdentity, then Users and All users, then New user
  
  That path creates a user object; it never reaches the group properties.
2. BIdentity, then Users and Deleted users, then Restore user
  
  That path recovers an account deleted less than 30 days ago and creates nothing new.
3. CIdentity, then Groups and All groups, then New group
  
  Right. New group is offered from the Groups surface and opens the form for group type, name, membership type, owners and members.
8 / 20

The second property to look at: Membership type

Membership type specifies how individual members are added to the group. There are three, and they differ in who does the work.

Membership type	How members arrive	Applies to
Assigned	Members are added and maintained manually	Both group types
Dynamic User	Users are added and removed automatically by rules that evaluate user attributes such as department, job title or location	Both group types
Dynamic Device	Devices are added and removed automatically by rules that evaluate device attributes	Security groups only

That last row is the compatibility trap worth memorizing: Dynamic Device applies to security groups only, and Microsoft 365 groups support dynamic users but not dynamic devices.

9 / 20

Quick check

Which membership type leaves the roster in the administrator's hands, to be added and maintained manually?
1. ADynamic User membership
  
  Dynamic User fills the roster automatically from rules that read user attributes such as department or job title.
2. BAssigned membership
  
  Right. Assigned means members are added and maintained manually rather than by a rule.
3. CDynamic Device membership
  
  Dynamic Device fills the roster automatically from device attributes, and only for security groups.
10 / 20
How a dynamic group keeps itself current

With dynamic membership, Microsoft Entra ID adds or removes users or devices from a group based on rules you define. The rules are not evaluated once. When a member's attributes change — a user moves to a different department, for instance — all dynamic membership rules in the tenant are reevaluated and the object is added to or removed from groups accordingly.

For example, a rule can automatically add every user whose Department attribute equals Marketing to a Marketing security group. Membership then stays current without manual updates: a transfer into Marketing adds the person, and a transfer out removes them.

The attribute change does not turn the group into an Assigned one, and it does not turn a user into a device. It simply triggers the rule again.

11 / 20
Quick check

A user moves to a different department in a tenant that has dynamic membership rules. What happens next?
1. AExisting memberships stay fixed until an administrator edits each roster
  
  Not needing that manual pass is the whole purpose of a rule-driven roster.
2. BThe group switches to Assigned membership and waits for an approval
  
  A membership type is a property chosen for the group; an attribute change does not rewrite it.
3. CThe rules are reevaluated, and the user joins or leaves groups to match
  
  Right. A change to a relevant attribute causes the dynamic rules to be reevaluated and the membership to follow the new value.
12 / 20

How a dynamic group keeps itself current

Automation of this kind is licensed. Dynamic membership requires a Microsoft Entra ID P1 license, or Intune for Education for device-based rules.

That requirement is worth checking before a design depends on it, because it is the one part of the feature that cannot be worked around with configuration. Where the licence is not available, the same roster still exists — it just has to be Assigned and maintained by hand.

Requirement	What it needs
Rules over user attributes	Microsoft Entra ID P1
Rules over device attributes	Microsoft Entra ID P1, or Intune for Education
A manually maintained roster	No dynamic-rule licensing

Note what is not a licence: a directory role such as User Administrator grants permissions to an administrator, and Windows Server AD names where an identity originates.

13 / 20

Quick check

What does dynamic membership for user-based rules require?
1. AA User Administrator role assignment
  
  A directory role decides what an administrator may do; it does not license the dynamic membership feature.
2. BA Microsoft Entra ID P1 licence
  
  Right. Dynamic membership requires Microsoft Entra ID P1, with Intune for Education as the alternative for device-based rules.
3. CA Windows Server AD identity source
  
  That value describes where a synchronized identity originates and has nothing to do with licensing a membership rule.
14 / 20

Turn requirements into a group design

Two properties, chosen in the right order, answer almost any design question. First decide the group type from what the group is for; then decide the membership type from who should maintain the roster.

The central requirement	Group type	Membership type
Control access to a shared resource	Security	Depends on the roster
Membership must include devices or service principals	Security	Assigned, or Dynamic Device for devices
A collaboration workspace with mailbox, calendar, files or SharePoint	Microsoft 365	Depends on the roster
An administrator must explicitly maintain the roster	Either	Assigned
A supported attribute rule should keep the roster current	Either, within the compatibility rule	Dynamic User or Dynamic Device

Read the two columns independently and the impossible combinations disappear on their own: a Microsoft 365 group with Dynamic Device membership cannot be built, because that membership type applies to security groups only.

15 / 20

Quick check

A team must control access to a shared resource, include devices selected by their attributes, and never update the roster by hand. Which configuration fits?
1. AA Microsoft 365 group with Dynamic User membership
  
  A Microsoft 365 group is the collaboration type, and a user rule would not select devices by their attributes.
2. BA security group with Assigned membership
  
  A security group is right, but an assigned roster is exactly the manual maintenance the team wants to avoid.
3. CA security group with Dynamic Device membership
  
  Right. Access control selects the security group, and device attributes with no manual work select Dynamic Device.
16 / 20
Turn requirements into a group design
Requirements often pull the two properties apart, and that is where reading them separately pays off.

Take a project that needs a shared mailbox and a SharePoint site, must include external collaborators, and should pick up employees automatically when their Department equals Marketing. The collaboration resources and the outside participants both point to a Microsoft 365 group; the attribute rule over a user property points to Dynamic User membership. The two answers are compatible, so that is the design.
- A security group would not supply the mailbox or the SharePoint site.
- An assigned roster would not add the Marketing employees on its own.
- Dynamic Device is unavailable here, and devices are not what the rule selects.
17 / 20
Quick check

A project needs a shared mailbox and SharePoint site, must include external collaborators, and should add employees automatically when Department equals Marketing. What should be built?
1. AA security group using Dynamic User membership
  
  The rule would work, but a security group does not provide the mailbox and SharePoint site the project asks for.
2. BA Microsoft 365 group using Dynamic User membership
  
  Right. Collaboration resources and external participants select the Microsoft 365 group, and the Department rule selects Dynamic User.
3. CA Microsoft 365 group using Assigned membership
  
  The group type is right, but an assigned roster would have to be maintained by hand instead of following the attribute.
18 / 20
Key takeaways
- Groups replace per-person permissions. Rights are assigned once to the group and access is then managed by changing who belongs to it.
- Security group or Microsoft 365 group is a question of purpose. Security groups manage access to shared resources and can contain users, devices and service principals; Microsoft 365 groups provide a shared mailbox, calendar, files and a SharePoint site, can include people outside the organization, and are available to users as well as administrators.
- Creation lives at Identity > Groups > All groups > New group, where group type, name, membership type, owners and members are set.
- Membership type decides who maintains the roster. Assigned is manual; Dynamic User and Dynamic Device follow attribute rules, and Dynamic Device applies to security groups only.
- Dynamic rules are reevaluated when attributes change, and they require a Microsoft Entra ID P1 licence, or Intune for Education for device-based rules.
19 / 20
Quick check

An access boundary must contain service principals, every membership change needs explicit approval, and the design must not depend on dynamic-rule licensing. What should be used?
1. AA security group with Assigned membership and a designated owner
  
  Right. Security groups accept service principals and form access boundaries, and an assigned roster keeps every change manual and unlicensed.
2. BA security group with Dynamic Device membership and no manual roster
  
  A device rule would populate the group automatically, which removes the explicit approval and needs the licence being avoided.
3. CA Microsoft 365 group with Assigned membership and shared files
  
  A Microsoft 365 group is the collaboration type; it is not the access boundary described, and its members are not service principals.
20 / 20
10 quick checks · then the test

In the app, finishing the quick checks opens this lesson’s 10-question test, and the ones you miss come back exactly when you’re about to forget them.

Take this lesson’s test → Next lesson: Microsoft Entra Licenses and SSPR Get the app

← Previous Keep your progress · Get the app Next card →

The whole course, on your phone

Lessons you can read, audio you can listen to on the way to work, and practice that remembers what you got wrong.

Get the app