Azure AD tenants and directories - Commands & Configuration

Introduction

Azure Active Directory (Azure AD) tenants are like separate accounts that hold users, groups, and apps. Each tenant is a directory that keeps these identities safe and organized. This helps companies manage who can access their cloud resources.

When you want to keep user accounts and permissions separate for different companies or projects.

When you need to control access to cloud apps and services for your organization.

When you want to create a secure space for your employees to sign in and use Microsoft services.

When you want to manage multiple organizations or subsidiaries under one cloud platform.

When you need to set up single sign-on for your apps using a trusted identity provider.

Commands

This command logs you into your Azure account so you can manage your Azure AD tenants and directories.

Terminal

az login

Expected Output

To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code ABCD1234 to authenticate.



You have logged in. Now let us find all the subscriptions to which you have access...

This command lists all Azure AD tenants (directories) associated with your Azure account.

Terminal

az account tenant list

Expected Output

[

  {

    "tenantId": "11111111-2222-3333-4444-555555555555",

    "displayName": "Contoso Tenant"

  },

  {

    "tenantId": "66666666-7777-8888-9999-000000000000",

    "displayName": "Fabrikam Tenant"

  }

]

This command switches your current session to use the specified Azure AD tenant by its tenant ID.

Terminal

az account set --tenant 11111111-2222-3333-4444-555555555555

Expected Output

No output (command runs silently)

→

--tenant - Specifies the tenant ID to switch to

This command lists all users in the currently selected Azure AD tenant in a readable table format.

Terminal

az ad user list --output table

Expected Output

DisplayName          UserPrincipalName                  ObjectId

------------------- --------------------------------- ------------------------------------

Alice Johnson       [e-mail]         12345678-90ab-cdef-1234-567890abcdef

Bob Smith           [e-mail]             23456789-0abc-def1-2345-67890abcdef1

→

--output - Formats the output for easier reading

Key Concept

If you remember nothing else, remember that an Azure AD tenant is a secure container for identities and switching tenants changes the context of your Azure commands.

Common Mistakes

Trying to manage users without switching to the correct tenant first.

Commands will run against the wrong directory, causing confusion or errors.

Always use 'az account set --tenant <tenant-id>' to select the right tenant before managing its resources.

Assuming one Azure account has only one tenant.

Many users have access to multiple tenants, so commands might not affect the intended directory.

List all tenants with 'az account tenant list' and pick the correct one.

Summary

Use 'az login' to sign in to your Azure account.

List all Azure AD tenants with 'az account tenant list'.

Switch to the desired tenant using 'az account set --tenant <tenant-id>'.

Manage users and resources within the selected tenant.

Practice

1. What is an Azure AD tenant primarily used for?

easy

A. To store virtual machines in the cloud

B. To manage users and control access within an organization

C. To host websites publicly

D. To create databases for applications

Solution

1. Step 1: Understand Azure AD tenant purpose and identify correct use case

   An Azure AD tenant is a dedicated space for managing identities and access. It is not for hosting websites, storing VMs, or databases but for user and access management.

2. Final Answer:

   To manage users and control access within an organization -> Option B

3. Quick Check:

   Azure AD tenant = user and access management [OK]

Hint: Azure AD tenant = user and access management space [OK]

Common Mistakes:

• Confusing tenant with storage or hosting services
• Thinking tenant is a database service
• Assuming tenant manages virtual machines

2. Which of the following is the correct Azure CLI command to list all Azure AD tenants you have access to?

easy

A. az ad tenant list

B. az login tenant list

C. az tenant show

D. az account tenant list

Solution

1. Step 1: Recall Azure CLI commands for tenants and identify correct one

   The command to list tenants is under 'az account' namespace, not 'az ad'. 'az account tenant list' lists all tenants you have access to.

2. Final Answer:

   az account tenant list -> Option D

3. Quick Check:

   List tenants = az account tenant list [OK]

Hint: Use 'az account tenant list' to see all tenants [OK]

Common Mistakes:

• Using 'az ad tenant list' which is invalid
• Confusing 'az login' with tenant listing
• Using 'az tenant show' which does not exist

3. Given the following Azure CLI output snippet after running az account tenant list:

[{"tenantId": "1111-2222-3333-4444", "isDefault": true}, {"tenantId": "5555-6666-7777-8888", "isDefault": false}]

What does the isDefault field indicate?

medium

A. The tenant that is deleted

B. The tenant with the most users

C. The tenant currently active for your Azure session

D. The tenant with the highest subscription cost

Solution

1. Step 1: Understand 'isDefault' meaning and eliminate incorrect options

   'isDefault' marks which tenant is currently active in your Azure CLI session. It does not relate to user count, cost, or deletion status.

2. Final Answer:

   The tenant currently active for your Azure session -> Option C

3. Quick Check:

   isDefault = active tenant [OK]

Hint: 'isDefault' means active tenant in session [OK]

Common Mistakes:

• Thinking 'isDefault' means largest tenant
• Assuming it means deleted tenant
• Confusing it with billing or cost info

4. You run the command az ad tenant list but get an error saying the command is not found. What is the most likely cause?

medium

A. The Azure CLI does not have a direct 'az ad tenant list' command

B. You are not logged in to Azure CLI

C. Your account has no tenants

D. The Azure CLI version is too new

Solution

1. Step 1: Check command availability and verify other causes

   'az ad tenant list' is not a valid Azure CLI command; tenant listing is under 'az account'. Login issues or no tenants would give different errors; CLI version too new is unlikely to remove commands.

2. Final Answer:

   The Azure CLI does not have a direct 'az ad tenant list' command -> Option A

3. Quick Check:

   Invalid command = no 'az ad tenant list' [OK]

Hint: Tenant list is under 'az account', not 'az ad' [OK]

Common Mistakes:

• Assuming login error causes command not found
• Thinking no tenants causes command error
• Blaming CLI version without checking command docs

5. You want to create a new Azure AD tenant for a subsidiary company and assign a custom domain name. Which steps should you follow to do this correctly?

hard

A. Create a new tenant in Azure portal, then add and verify the custom domain in that tenant

B. Add the custom domain to your current tenant, then create a new subscription for the subsidiary

C. Create a new subscription, which automatically creates a tenant with the custom domain

D. Use Azure CLI to rename your existing tenant to the subsidiary's domain

Solution

1. Step 1: Create new Azure AD tenant and add custom domain

   Use the Azure portal to create a separate tenant for the subsidiary company. Within the new tenant, add the subsidiary's custom domain and verify ownership.

2. Final Answer:

   Create a new tenant in Azure portal, then add and verify the custom domain in that tenant -> Option A

3. Quick Check:

   New tenant + verify domain = correct process [OK]

Hint: New tenant first, then add custom domain inside it [OK]

Common Mistakes:

• Adding domain to wrong tenant
• Assuming subscription creation creates tenant with domain
• Trying to rename existing tenant domain