WGU D338 MANAGE AZURE AD OBJECTS: KEY SKILLS FOR EFFECTIVE
ADMINISTRATION | LATEST UPDATE WITH COMPLETE SOLUTIONS
Updated Notes for D338
Skill 1.1 - Manage Azure Active Directory (Azure AD Objects)
- Cloud-only users are created and managed exclusively in Azure AD and their attributes can be
updated directly in Azure AD. They can only be created through the Azure portal, Azure
PowerShell, and the Azure CLI.
- Must be Global Administrator or User Administrator to create new users.
- Only a username and the user’s name (given name and surname) are mandatory when creating
a new user.
- Group can contain groups, users, devices, or service principles.
- Security groups allow you to share Azure resource access to a group of users, devices, or service
principals.
- Office 365 group allows access to a shared mailbox, calendar, SharePoint site, and so on.
- Group Membership types -
o Assigned – Allows you to add and remove users manually
o Dynamic User – Allows you to use dynamic group rules to automatically add or remove
members
o Dynamic Device – Allows you to use dynamic group rules to automatically add and
remove devices
- Dynamic Groups require an Azure AD Premium P1 license
- You can change the membership type for a group after it has been created.
- Ways to manage devices -
o Browsing to your Azure AD tenant and selecting devices.
o Through the devices blade for an individual user
- To enable and disable devices you must be a global administrator.
- Disabling a device prevents it from accessing Azure AD resources. This does not prevent the user
from access resources in general, it only prevents the user from accessing resources from that
disabled device
- Must be global administrator to delete a device
- Deleting a device prevents it from accessing your Azure AD resources and removes all details
that are attached.
- Uploading users in bulk is a three-step process
o Download the CSV template
o Edit the CSV with bulk update values
o Upload the CSV and submit the operation
- All users and admins can invite a guest.
- Azure AD Join allows you to control devices, the applications installed and accessed from them,
and how those applications interact with your corporate data.
- Associating devices with Azure AD gives you three options –
o Registering a device – Appropriate for personal devices
o Joining a device – Useful for corporate-owned devices
o Hybrid AD joined – Devices that are joined to your on-premises AD and are registered
with your Azure AD tenant.
, - Devices associated with Azure AD allows you to manage a devices identity like SSO and securing
access using conditional access. Can be managed independently of the user’s identity.
- Azure AD Join is an extension of device registration that changes the local state of the device.
When a device is Azure AD-Joined, users can sign into the device using an organizational account
instead of a personal account.
- Registration of devices in Azure AD can be combined with MDM solutions.
- Non-hybrid Azure AD join is used for Windows 10 Pro and Windows 10 Enterprise.
- Hybrid Azure AD Join can use Windows 10, Windows 2016, Windows 7, Windows 8.1, Windows
2008, Windows 2008 R2, Windows 2012, and Windows 2012 R2.
- SSPR License Requirements
o Password Change – Cloud-user only, included in all editions of Azure AD
o Password Reset – Cloud-user only, Microsoft 365 Business Standard, Microsoft 365
Business Premium, Azure AD Premium P1, Azure AD Premium P2
o Password Change/Unlock/Reset - Hybrid-users, Microsoft 365 Business Premium, Azure
AD Premium P1, Azure AD Premium P2.
- Azure AD requires two authentication methods by default for SSPR for admins.
- Categories of Azure AD Roles -
o Azure AD-Specific Roles – These roles grant permissions to manage resources within
Azure AD only.
o Service-specific Roles – For major Microsoft 365 services (Non-Azure AD).
o Cross-Service Roles – Roles that span services. Global Administrator and Global reader.
All 365 services honor these roles.
- Azure AD License features
o Azure AD Free – User and group management, on-premises directory synchronization,
basic reports, self-service password change for cloud users, and SSO across Azure,
Microsoft 365, and many popular SaaS.
o Azure AD Premium P1 – Lets hybrid users' access both on-premises and cloud resources.
Also supports advanced administration, such as dynamic groups, self-service group
management, Microsoft Identity manager, and cloud write-back capabilities, which
allow self-service password to reset for your on-premises users.
o Azure AD Premium P2 – Offers Azure Active directory identity protection to help provide
risk-based Conditional Access to your apps and critical company data and Privileged
Identity Management to help discover, restrict, and monitor administrators and their
access to resources and to provide just-in-time access when needed.
- Built-in roles are used to delegate permissions to perform administrative tasks within Azure AD
administrative units.
- Azure CLI can be used to create and update Azure AD groups
- Email Address should be specified for each new guest account
Skill 1.2 - Manage Role-Based Access Control (RBAC)
- Role-based access control (RBAC) - Allows you to manage the entities, called “Security
Principals”, that have access to Azure resources and the actions that those entities can perform.
- RBAC access can be granted to users, groups, service principals, and managed identities through
role assignments.
, - Azure RBAC is applicable to the management of resources created in the Azure Resource
Manager (ARM) deployment model.
- A role is the definition of what actions are allowed and/or denied. RBAC is configured by
selecting a role and associated the role with a security principal, such as a user, group, or service
principal
- Most privileged access right takes precedence when you have overlapping assignments.
- Role definition contains the list of permissions or declared permissions and those permissions
define what actions can or cannot be performed against a type of resource, such as read, write,
or delete.
- RBAC roles are used to manage access and allow or restrict users to Azure resources, while
Azure AD administrative roles are used to allow or restrict admins to perform identity tasks,
such as creating new users, resetting passwords, and so on.
- Management groups are not applicable in all scenarios and in some cases a subscription will be
the highest scope you will work with when applying role assignments.
- Security Principals do not have access to Azure resources until a role assignment is made.
- Role assignments can be created and removed by people with the Owner or User Access
Administrator built-in roles.
- Azure Blueprints and resource locks can be used to make deny assignments at a child scope.
- Limit of 5,000 custom roles per directory, limit of 2,000 role assignments per subscription.
Custom roles can be created from existing built-in roles, starting from scratch, or with a JSON
file to define the custom permissions.
- Must have write permissions on all the items in a scope to create a custom role.
- Deny Assignments are set and controlled by applying a resource lock for resources created
through Azure Blueprints
- Built-in roles cannot be modified.
- A custom role definition is a collection of permissions that you add from a preset list. These
permissions are the same permissions used in the built-in roles.
- Security Principal – An identity, that gets permissions. It can be a user, group, or a service
principal.
- Role Assignments can be created and listed in the Portal, Azure AD PowerShell, or Microsoft
Graph API.
- Custom Roles can be created to provide a set of permissions that are not available when using
built-in roles.
- Built-in roles can be cloned and then modified for small tweaks to permissions.
Skill 1.3 - Manage Subscriptions and Governance
- A resource in Azure is a single service instance, which can be a virtual machine, a virtual
network, a storage account or any other Azure service.
- Resource groups are logical groupings of resource or those single-service instances
- Each resource in Azure can only exist in one resource group and resource groups cannot be
renamed.
- Azure Policy is an Azure service that can be used to create, assign, and manage policies that
enforce governance in your Azure environment. Includes the application of rules that allow or
deny a given resource type, apply tags automatically, and even enforce data sovereignty.
, - Azure Policy provides a mechanism to express how the environment is governed for all users at
a specified scope regardless of RBAC assignments.
- Azure RBAC is a default deny mechanism with an explicit allow mechanism, whereas Policy is a
default allow mechanism with an explicit deny system.
- Policy definition describes your desired behavior for Azure resources at the time resources are
created or updated. Through a policy definition, you declare what resources and resource
features are considered compliant within your Azure environment and what should happen
when a resource is non-compliant.
- Azure Policy Scope types -
o Management Groups
o Subscriptions
o Resource Groups
- When creating policy scopes, it is possible to configure excluded scopes. Allows you to model
your environment with rich declarations in the form of Policy definitions that are applied exactly
as required by your organizations governance needs.
- Azure Resource Locks (Sometimes called management locks) are used to prevent the accidental
deletion or modification of resources. The two lock types are
o CanNotDelete – Locks prevent the deletion of a resource. A CanNotDelete lock only
prevents deletion of a resource and does not impede the modification of a resource
o ReadOnly – Locks prevent users from modifying a resource, which includes updating or
deleting a resource.
- Resource Locks can be applied to a subscription, resource group, and resource scopes.
- Both ReadOnly and CanNotDelete locks are inherited by child resources.
- Resource Tags allow you to apply custom metadata to your Azure resources to logically organize
them and to build out custom taxonomies. A tag is a name and value pair.
- Common tag types include the environment with which a resource is associated, a cost center or
billing code, and resource owner.
- Tags must be applied at the resource scope to be visible in detailed usage exports. Tags applied
the resource group scope are not inherited by child resources.
- Azure Policy can be used to automatically apply tags to resources
- Azure Tag limitations -
o Resource Supports – Not all resources support tags
o Number of tags – Resources, resource groups, and subscriptions are limited to 50 tags.
Each resource can have different tags
o Tag Names – Tag names cannot exceed 512 characters. Storage account tag names are
limited to 128 characters.
o Tag Values – Cannot exceed 256 characters
o Virtual Machine Tags – VMs cannot exceed 2048 characters for all tag names and values
combined
o Tag Inheritance – Tags are not inherited by child resources. Tags applied to a resource
group are not applied to resources in that resource group
o Classic Resources – Only available for resources created in the Azure Resource Manager
model.
o Illegal Characters – Tag names cannot contain these characters, <, >, %, &, \, ?, /
ADMINISTRATION | LATEST UPDATE WITH COMPLETE SOLUTIONS
Updated Notes for D338
Skill 1.1 - Manage Azure Active Directory (Azure AD Objects)
- Cloud-only users are created and managed exclusively in Azure AD and their attributes can be
updated directly in Azure AD. They can only be created through the Azure portal, Azure
PowerShell, and the Azure CLI.
- Must be Global Administrator or User Administrator to create new users.
- Only a username and the user’s name (given name and surname) are mandatory when creating
a new user.
- Group can contain groups, users, devices, or service principles.
- Security groups allow you to share Azure resource access to a group of users, devices, or service
principals.
- Office 365 group allows access to a shared mailbox, calendar, SharePoint site, and so on.
- Group Membership types -
o Assigned – Allows you to add and remove users manually
o Dynamic User – Allows you to use dynamic group rules to automatically add or remove
members
o Dynamic Device – Allows you to use dynamic group rules to automatically add and
remove devices
- Dynamic Groups require an Azure AD Premium P1 license
- You can change the membership type for a group after it has been created.
- Ways to manage devices -
o Browsing to your Azure AD tenant and selecting devices.
o Through the devices blade for an individual user
- To enable and disable devices you must be a global administrator.
- Disabling a device prevents it from accessing Azure AD resources. This does not prevent the user
from access resources in general, it only prevents the user from accessing resources from that
disabled device
- Must be global administrator to delete a device
- Deleting a device prevents it from accessing your Azure AD resources and removes all details
that are attached.
- Uploading users in bulk is a three-step process
o Download the CSV template
o Edit the CSV with bulk update values
o Upload the CSV and submit the operation
- All users and admins can invite a guest.
- Azure AD Join allows you to control devices, the applications installed and accessed from them,
and how those applications interact with your corporate data.
- Associating devices with Azure AD gives you three options –
o Registering a device – Appropriate for personal devices
o Joining a device – Useful for corporate-owned devices
o Hybrid AD joined – Devices that are joined to your on-premises AD and are registered
with your Azure AD tenant.
, - Devices associated with Azure AD allows you to manage a devices identity like SSO and securing
access using conditional access. Can be managed independently of the user’s identity.
- Azure AD Join is an extension of device registration that changes the local state of the device.
When a device is Azure AD-Joined, users can sign into the device using an organizational account
instead of a personal account.
- Registration of devices in Azure AD can be combined with MDM solutions.
- Non-hybrid Azure AD join is used for Windows 10 Pro and Windows 10 Enterprise.
- Hybrid Azure AD Join can use Windows 10, Windows 2016, Windows 7, Windows 8.1, Windows
2008, Windows 2008 R2, Windows 2012, and Windows 2012 R2.
- SSPR License Requirements
o Password Change – Cloud-user only, included in all editions of Azure AD
o Password Reset – Cloud-user only, Microsoft 365 Business Standard, Microsoft 365
Business Premium, Azure AD Premium P1, Azure AD Premium P2
o Password Change/Unlock/Reset - Hybrid-users, Microsoft 365 Business Premium, Azure
AD Premium P1, Azure AD Premium P2.
- Azure AD requires two authentication methods by default for SSPR for admins.
- Categories of Azure AD Roles -
o Azure AD-Specific Roles – These roles grant permissions to manage resources within
Azure AD only.
o Service-specific Roles – For major Microsoft 365 services (Non-Azure AD).
o Cross-Service Roles – Roles that span services. Global Administrator and Global reader.
All 365 services honor these roles.
- Azure AD License features
o Azure AD Free – User and group management, on-premises directory synchronization,
basic reports, self-service password change for cloud users, and SSO across Azure,
Microsoft 365, and many popular SaaS.
o Azure AD Premium P1 – Lets hybrid users' access both on-premises and cloud resources.
Also supports advanced administration, such as dynamic groups, self-service group
management, Microsoft Identity manager, and cloud write-back capabilities, which
allow self-service password to reset for your on-premises users.
o Azure AD Premium P2 – Offers Azure Active directory identity protection to help provide
risk-based Conditional Access to your apps and critical company data and Privileged
Identity Management to help discover, restrict, and monitor administrators and their
access to resources and to provide just-in-time access when needed.
- Built-in roles are used to delegate permissions to perform administrative tasks within Azure AD
administrative units.
- Azure CLI can be used to create and update Azure AD groups
- Email Address should be specified for each new guest account
Skill 1.2 - Manage Role-Based Access Control (RBAC)
- Role-based access control (RBAC) - Allows you to manage the entities, called “Security
Principals”, that have access to Azure resources and the actions that those entities can perform.
- RBAC access can be granted to users, groups, service principals, and managed identities through
role assignments.
, - Azure RBAC is applicable to the management of resources created in the Azure Resource
Manager (ARM) deployment model.
- A role is the definition of what actions are allowed and/or denied. RBAC is configured by
selecting a role and associated the role with a security principal, such as a user, group, or service
principal
- Most privileged access right takes precedence when you have overlapping assignments.
- Role definition contains the list of permissions or declared permissions and those permissions
define what actions can or cannot be performed against a type of resource, such as read, write,
or delete.
- RBAC roles are used to manage access and allow or restrict users to Azure resources, while
Azure AD administrative roles are used to allow or restrict admins to perform identity tasks,
such as creating new users, resetting passwords, and so on.
- Management groups are not applicable in all scenarios and in some cases a subscription will be
the highest scope you will work with when applying role assignments.
- Security Principals do not have access to Azure resources until a role assignment is made.
- Role assignments can be created and removed by people with the Owner or User Access
Administrator built-in roles.
- Azure Blueprints and resource locks can be used to make deny assignments at a child scope.
- Limit of 5,000 custom roles per directory, limit of 2,000 role assignments per subscription.
Custom roles can be created from existing built-in roles, starting from scratch, or with a JSON
file to define the custom permissions.
- Must have write permissions on all the items in a scope to create a custom role.
- Deny Assignments are set and controlled by applying a resource lock for resources created
through Azure Blueprints
- Built-in roles cannot be modified.
- A custom role definition is a collection of permissions that you add from a preset list. These
permissions are the same permissions used in the built-in roles.
- Security Principal – An identity, that gets permissions. It can be a user, group, or a service
principal.
- Role Assignments can be created and listed in the Portal, Azure AD PowerShell, or Microsoft
Graph API.
- Custom Roles can be created to provide a set of permissions that are not available when using
built-in roles.
- Built-in roles can be cloned and then modified for small tweaks to permissions.
Skill 1.3 - Manage Subscriptions and Governance
- A resource in Azure is a single service instance, which can be a virtual machine, a virtual
network, a storage account or any other Azure service.
- Resource groups are logical groupings of resource or those single-service instances
- Each resource in Azure can only exist in one resource group and resource groups cannot be
renamed.
- Azure Policy is an Azure service that can be used to create, assign, and manage policies that
enforce governance in your Azure environment. Includes the application of rules that allow or
deny a given resource type, apply tags automatically, and even enforce data sovereignty.
, - Azure Policy provides a mechanism to express how the environment is governed for all users at
a specified scope regardless of RBAC assignments.
- Azure RBAC is a default deny mechanism with an explicit allow mechanism, whereas Policy is a
default allow mechanism with an explicit deny system.
- Policy definition describes your desired behavior for Azure resources at the time resources are
created or updated. Through a policy definition, you declare what resources and resource
features are considered compliant within your Azure environment and what should happen
when a resource is non-compliant.
- Azure Policy Scope types -
o Management Groups
o Subscriptions
o Resource Groups
- When creating policy scopes, it is possible to configure excluded scopes. Allows you to model
your environment with rich declarations in the form of Policy definitions that are applied exactly
as required by your organizations governance needs.
- Azure Resource Locks (Sometimes called management locks) are used to prevent the accidental
deletion or modification of resources. The two lock types are
o CanNotDelete – Locks prevent the deletion of a resource. A CanNotDelete lock only
prevents deletion of a resource and does not impede the modification of a resource
o ReadOnly – Locks prevent users from modifying a resource, which includes updating or
deleting a resource.
- Resource Locks can be applied to a subscription, resource group, and resource scopes.
- Both ReadOnly and CanNotDelete locks are inherited by child resources.
- Resource Tags allow you to apply custom metadata to your Azure resources to logically organize
them and to build out custom taxonomies. A tag is a name and value pair.
- Common tag types include the environment with which a resource is associated, a cost center or
billing code, and resource owner.
- Tags must be applied at the resource scope to be visible in detailed usage exports. Tags applied
the resource group scope are not inherited by child resources.
- Azure Policy can be used to automatically apply tags to resources
- Azure Tag limitations -
o Resource Supports – Not all resources support tags
o Number of tags – Resources, resource groups, and subscriptions are limited to 50 tags.
Each resource can have different tags
o Tag Names – Tag names cannot exceed 512 characters. Storage account tag names are
limited to 128 characters.
o Tag Values – Cannot exceed 256 characters
o Virtual Machine Tags – VMs cannot exceed 2048 characters for all tag names and values
combined
o Tag Inheritance – Tags are not inherited by child resources. Tags applied to a resource
group are not applied to resources in that resource group
o Classic Resources – Only available for resources created in the Azure Resource Manager
model.
o Illegal Characters – Tag names cannot contain these characters, <, >, %, &, \, ?, /
