Manage Users and Groups in Microsoft Entra Id
To manage users and groups in Microsoft Entra ID, create directory accounts and group them by team role. Then link those groups to cloud roles and apps so staff only get the rights they need. Most teams start by syncing their directory with HR records or setting up accounts by hand. When admins grant broad group roles to save time, engineers get standing rights to production systems. How to manage users and groups in Microsoft Entra ID A clean directory setup starts with clear user profiles.
Microsoft Entra ID (Azure AD) + Just-in-Time Access: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To manage users and groups in Microsoft Entra ID, create directory accounts and group them by team role. Then link those groups to cloud roles and apps so staff only get the rights they need.
Most teams start by syncing their directory with HR records or setting up accounts by hand. When admins grant broad group roles to save time, engineers get standing rights to production systems.
How to manage users and groups in Microsoft Entra ID
A clean directory setup starts with clear user profiles. Each person in your company gets one account with basic attributes like department and job title. You can create accounts in the portal or sync them from an HR system. Guest accounts let external contractors log in with their own email addresses.
Groups let you grant rights to many people at once instead of one by one. Security groups control who can open apps, read cloud resources, and use database roles. Microsoft 365 groups help teams share files and calendars.
You can add people to a group by hand or use dynamic rules. Dynamic rules check user attributes like job title and add or remove accounts based on those values. When someone changes teams, the directory updates their group memberships right away.
Next, you link these security groups to roles in your cloud and apps. When a developer logs in, the identity provider checks their group list and issues a token. This token tells downstream systems which groups the person belongs to.
How directory roles and group rules work in practice
Directory roles decide who can change settings inside the identity system itself. Global admins hold full control over every account, group, and app in the tenant. Giving too many people this top role creates a huge security risk.
To reduce risk, assign smaller roles to specific staff members. A user admin can reset passwords and create accounts without touching cloud servers. A group admin can manage team lists without reading private company data.
Admin units let you split a large directory into smaller parts by region or division. You can let a local IT lead manage accounts only for their own branch office. This keeps local admins from changing settings for the whole company.
Microsoft Entra ID (Azure AD) + Just-in-Time Access: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Many teams also set up self-service group requests for day-to-day work. An engineer requests membership in a database group, and a team lead approves it. Expiration rules can remove the person from that group after a set number of days.
What directory groups solve and what they leave open
Microsoft Entra ID does a great job of proving who a person is. Group rules make sure only approved staff can log in to your servers and databases. When someone leaves the company, disabling their single account blocks their login right away.
Still, directory groups only control the initial login step and coarse role assignment. Once a database or server accepts the login token, the identity provider steps out of the way. It cannot see or control what the user does inside that active session.
For example, a group might grant a developer read and write rights to a production database. That developer can run a safe single-row update or drop a whole table by mistake. The directory sees both actions as the same valid login.
Static group memberships also leave standing rights open all day and night. Even with group expiration rules, an engineer often holds full database credentials for days at a time. In-flight queries can return raw emails, phone numbers, card numbers, and national IDs to their screen.
To close this gap, teams need controls that work at the command and query level. Checking every action in flight lets you approve risky commands and rewrite sensitive fields in results.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What is the difference between security groups and Microsoft 365 groups?
Security groups grant rights to apps, servers, and cloud roles for users and devices. Microsoft 365 groups give teams a shared space for email, files, and calendars.
When should we use dynamic groups instead of assigned groups?
Use dynamic groups when user attributes like department or title are clean and up to date. Use assigned groups for special projects or sensitive roles that need manual review by a manager.
Why is directory group control not enough for production databases?
Directory groups only decide who can log in to a database role. They do not inspect SQL queries, block destructive commands, or mask emails and card numbers in query results.