Microsoft Entra ID Fundamentals Field Guide

What this guide covers

Most Entra ID problems are not bugs. They are gaps the portal will never warn you about. A P2 license sits unused because nobody set a user's Usage Location, the per-user country/region attribute Entra ID requires before it will assign a license. A dynamic group quietly turns into its own access control the moment it is built on an attribute the user can write. A Global Administrator elevates to Azure root scope and forgets to toggle it back. You open Identity Protection and get a blank page instead of an error, because the admin center will not tell you which plan you have before you try to use a feature.

The documentation covers all of this, scattered across dozens of pages that never quite connect. This book is the connected account: one practitioner's mental model of how the identity control plane behaves in production, with the failure modes named before you hit them. It treats Entra ID as the decision engine every sign-in passes through, not a user database with SSO bolted on, and it works the licensing maze, the object model, and the two control planes that never cross.

Every product specific is grounded against current Microsoft Learn and validated in a live Microsoft 365 E5 lab, so the limits and portal paths reflect what the product does today. You do not need a production tenant to follow along. A trial tenant and a single test device are enough to reproduce everything here.

Chapter map

1. Microsoft Entra ID as the Identity Control Plane
2. The Microsoft Entra Admin Center
3. Tenant Fundamentals, Structure, Settings, and Branding
4. Licensing, Free, P1, P2, Governance, and the Entra Suite
5. Creating and Managing Users
6. Groups, Security, Microsoft 365, Assigned, and Dynamic
7. Custom Security Attributes
8. Bulk Operations and Microsoft Graph PowerShell
9. Group-Based License Assignment
10. Device Identity and Join Types
11. Entra ID Roles, Built-In, Custom, and Least Privilege
12. Administrative Units and Scoped Delegation
13. Entra Roles vs. Azure RBAC, Effective Permissions, and the Production Checklist

Appendices: PowerShell and Graph Quick Reference; Build a Lab Tenant; Production Readiness Checklist.

Who it is for

This is for administrators and engineers who already run Entra ID and want the moving parts wired together rather than listed, for IT pros ramping onto the platform who need one coherent and production-focused reference, and for anyone studying the SC-300 certification who wants depth beyond exam cramming.

See where you are

7 questions from this guide's territory (3 easy, 4 medium), with the explanation after each. Nothing is stored and nothing is sent anywhere.

The rest of Microsoft Entra Field Guides

One product per book, a lab appendix in every one, and a companion page like this one for each.

• 
  Field guide

  Authentication and Conditional Access with Microsoft Entra ID

  Most sign-in lockouts and silent MFA gaps do not trace to one wrong setting.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  Hybrid Identity and Global Secure Access with Microsoft Entra ID

  Hybrid identity runs on two planes. Synchronization moves identity objects from Active Directory into Microsoft Entra ID; authentication decides whether a credential is valid at sign-in.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  Identity Governance with Microsoft Entra ID

  Knowing what each governance pillar does is the easy part. Knowing how the four break in production is the part the portal blades never tell you.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  Workload Identities and App Registrations with Microsoft Entra ID

  The breach rarely starts with a misconfigured Conditional Access policy. It starts with a three-year-old client secret sitting in a public repository, attached to an app nobody remembers registering.

  Kindle$12.99Get it on AmazonCompanion page

The hard set (1 question)

The hardest SC-300 questions this guide publishes, none of them repeated from the placement quiz above: the answer first, why every other option is wrong, and the Microsoft Learn page behind it. The practice book for this exam holds the full bank.

A company must guarantee that Helpdesk Administrators and even tenant-level Global Administrators cannot reset the passwords of C-level executive accounts or read their BitLocker keys, without stripping those admins of their tenant-wide roles. Only a small, explicitly designated set of administrators should be able to manage the executive accounts. Which Microsoft Entra capability meets this requirement?

Correct answer: B. A restricted management administrative unit containing the executive accounts, with a role scoped to that unit assigned only to the designated administrators

A restricted management administrative unit protects specific objects so that only administrators explicitly assigned a role at the scope of that unit can modify them. Even tenant-level Global Administrators and Privileged Role Administrators are blocked from modifying the objects unless they scope themselves to the unit, which is an auditable event. Placing the executive accounts in a restricted management administrative unit and assigning the trusted administrators a role (for example, Authentication Administrator) at that scope meets the requirement without removing anyone's tenant-wide roles.

Why the other options are wrong:

• A. Conditional Access governs sign-in access conditions, not which administrators may perform a password reset on an object. It cannot enforce this admin-scoping requirement.
• C. A regular (non-restricted) administrative unit narrows a scoped admin's reach, but it does not block tenant-level administrators. A Global Administrator, or a Helpdesk Administrator with tenant scope, could still reset the executives' passwords. Only a restricted management administrative unit blocks tenant-level admins.
• D. Privileged Role Administrator manages role assignments tenant-wide and does not restrict who can manage the executives' accounts. Assigning it to executives is both incorrect for the goal and a privilege-escalation risk.

Memory hook: Block even Global Admins from touching sensitive accounts, without removing their roles = Restricted Management AU. A regular AU does not stop tenant-level admins.

Microsoft Learn: Admin units restricted management