Azure AD tenants and directories - Step-by-Step Execution

Process Flow - Azure AD tenants and directories

Create Azure Account

↓

Create Azure AD Tenant

↓

Tenant = Directory

↓

Add Users & Groups

↓

Assign Roles & Permissions

↓

Use Tenant for Cloud Services

This flow shows how you start with an Azure account, create an Azure AD tenant (which is a directory), add users, assign roles, and then use it to manage cloud services.

Execution Sample

Azure

1. Create Azure AD tenant named 'Contoso'
2. Add user 'Alice' to Contoso tenant
3. Assign 'Global Administrator' role to Alice
4. Use Contoso tenant to manage Azure resources

This example shows creating a tenant, adding a user, assigning a role, and using the tenant to manage resources.

Process Table

Step	Action	Result	State Change
1	Create Azure AD tenant 'Contoso'	Tenant 'Contoso' created	Tenant list: ['Contoso']
2	Add user 'Alice' to 'Contoso'	User 'Alice' added	Users in 'Contoso': ['Alice']
3	Assign 'Global Administrator' role to 'Alice'	Role assigned	Roles for 'Alice': ['Global Administrator']
4	Use 'Contoso' tenant to manage Azure resources	Management enabled	Tenant 'Contoso' active for resource management
5	End of process	No further actions	Process complete

💡 Process ends after tenant setup, user addition, role assignment, and resource management enabled

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Tenants	[]	['Contoso']	['Contoso']	['Contoso']	['Contoso']	['Contoso']
Users in 'Contoso'	[]	[]	['Alice']	['Alice']	['Alice']	['Alice']
Roles for 'Alice'	[]	[]	[]	['Global Administrator']	['Global Administrator']	['Global Administrator']
Tenant Active	None	None	None	None	'Contoso'	'Contoso'

Key Moments - 3 Insights

Why is the Azure AD tenant called a directory?

Because the tenant acts like a container that holds users, groups, and roles, similar to a directory that organizes files. See Step 1 in execution_table where creating a tenant sets up this container.

Can a user exist without being assigned a role?

Yes, a user can be added without a role, but they won't have permissions to manage resources until a role is assigned. Step 2 shows user added, Step 3 shows role assignment.

What happens if you try to manage resources without an active tenant?

You cannot manage resources without an active tenant because the tenant defines the security boundary. Step 4 shows enabling management after tenant and roles are set.

Visual Quiz - 3 Questions

Look at the execution_table, after which step is the user 'Alice' added to the tenant?

A Step 1

B Step 3

C Step 2

D Step 4

💡 Hint

Check the 'Action' and 'Result' columns in execution_table row for Step 2.

At which step does the tenant become active for resource management?

A Step 2

B Step 4

C Step 3

D Step 5

💡 Hint

Look at the 'State Change' column in execution_table for when tenant is active.

If the role assignment in Step 3 was skipped, what would be the roles for 'Alice' after Step 4?

A []

B ['Global Administrator']

C ['User']

D ['Contributor']

💡 Hint

Refer to variable_tracker row 'Roles for Alice' and imagine skipping Step 3.

Concept Snapshot

Azure AD tenant is a directory that holds users and groups.
Create a tenant to start managing identities.
Add users to the tenant to give access.
Assign roles to users to grant permissions.
Use the tenant to control access to Azure resources.

Full Transcript

Azure AD tenants and directories start with creating a tenant, which acts as a container for users and groups. After creating the tenant, you add users like 'Alice'. Then you assign roles such as 'Global Administrator' to users to give them permissions. Finally, the tenant is used to manage Azure resources securely. This process ensures organized identity and access management in Azure.

Practice

1. What is an Azure AD tenant primarily used for?

easy

A. To store virtual machines in the cloud

B. To manage users and control access within an organization

C. To host websites publicly

D. To create databases for applications

Solution

1. Step 1: Understand Azure AD tenant purpose and identify correct use case

   An Azure AD tenant is a dedicated space for managing identities and access. It is not for hosting websites, storing VMs, or databases but for user and access management.

2. Final Answer:

   To manage users and control access within an organization -> Option B

3. Quick Check:

   Azure AD tenant = user and access management [OK]

Hint: Azure AD tenant = user and access management space [OK]

Common Mistakes:

• Confusing tenant with storage or hosting services
• Thinking tenant is a database service
• Assuming tenant manages virtual machines

2. Which of the following is the correct Azure CLI command to list all Azure AD tenants you have access to?

easy

A. az ad tenant list

B. az login tenant list

C. az tenant show

D. az account tenant list

Solution

1. Step 1: Recall Azure CLI commands for tenants and identify correct one

   The command to list tenants is under 'az account' namespace, not 'az ad'. 'az account tenant list' lists all tenants you have access to.

2. Final Answer:

   az account tenant list -> Option D

3. Quick Check:

   List tenants = az account tenant list [OK]

Hint: Use 'az account tenant list' to see all tenants [OK]

Common Mistakes:

• Using 'az ad tenant list' which is invalid
• Confusing 'az login' with tenant listing
• Using 'az tenant show' which does not exist

3. Given the following Azure CLI output snippet after running az account tenant list:

[{"tenantId": "1111-2222-3333-4444", "isDefault": true}, {"tenantId": "5555-6666-7777-8888", "isDefault": false}]

What does the isDefault field indicate?

medium

A. The tenant that is deleted

B. The tenant with the most users

C. The tenant currently active for your Azure session

D. The tenant with the highest subscription cost

Solution

1. Step 1: Understand 'isDefault' meaning and eliminate incorrect options

   'isDefault' marks which tenant is currently active in your Azure CLI session. It does not relate to user count, cost, or deletion status.

2. Final Answer:

   The tenant currently active for your Azure session -> Option C

3. Quick Check:

   isDefault = active tenant [OK]

Hint: 'isDefault' means active tenant in session [OK]

Common Mistakes:

• Thinking 'isDefault' means largest tenant
• Assuming it means deleted tenant
• Confusing it with billing or cost info

4. You run the command az ad tenant list but get an error saying the command is not found. What is the most likely cause?

medium

A. The Azure CLI does not have a direct 'az ad tenant list' command

B. You are not logged in to Azure CLI

C. Your account has no tenants

D. The Azure CLI version is too new

Solution

1. Step 1: Check command availability and verify other causes

   'az ad tenant list' is not a valid Azure CLI command; tenant listing is under 'az account'. Login issues or no tenants would give different errors; CLI version too new is unlikely to remove commands.

2. Final Answer:

   The Azure CLI does not have a direct 'az ad tenant list' command -> Option A

3. Quick Check:

   Invalid command = no 'az ad tenant list' [OK]

Hint: Tenant list is under 'az account', not 'az ad' [OK]

Common Mistakes:

• Assuming login error causes command not found
• Thinking no tenants causes command error
• Blaming CLI version without checking command docs

5. You want to create a new Azure AD tenant for a subsidiary company and assign a custom domain name. Which steps should you follow to do this correctly?

hard

A. Create a new tenant in Azure portal, then add and verify the custom domain in that tenant

B. Add the custom domain to your current tenant, then create a new subscription for the subsidiary

C. Create a new subscription, which automatically creates a tenant with the custom domain

D. Use Azure CLI to rename your existing tenant to the subsidiary's domain

Solution

1. Step 1: Create new Azure AD tenant and add custom domain

   Use the Azure portal to create a separate tenant for the subsidiary company. Within the new tenant, add the subsidiary's custom domain and verify ownership.

2. Final Answer:

   Create a new tenant in Azure portal, then add and verify the custom domain in that tenant -> Option A

3. Quick Check:

   New tenant + verify domain = correct process [OK]

Hint: New tenant first, then add custom domain inside it [OK]

Common Mistakes:

• Adding domain to wrong tenant
• Assuming subscription creation creates tenant with domain
• Trying to rename existing tenant domain