Users and groups in Azure - Step-by-Step Execution

Process Flow - Users and groups

Create User

↓

Create Group

↓

Add User to Group

↓

Assign Permissions to Group

↓

User inherits Group Permissions

↓

User accesses resources with permissions

This flow shows how a user is created, added to a group, and inherits permissions assigned to that group.

Execution Sample

Azure

az ad user create --display-name "Alice" --user-principal-name [e-mail] --force-change-password-next-login
az ad group create --display-name "Developers" --mail-nickname developers
az ad group member add --group Developers --member-id alice-object-id

Creates a user Alice, a group Developers, and adds Alice to the Developers group.

Process Table

Step	Action	Input	Result	State Change
1	Create User	DisplayName=Alice, UPN=[e-mail]	User Alice created with objectId=alice-object-id	Users: {Alice}
2	Create Group	DisplayName=Developers, MailNickname=developers	Group Developers created with objectId=dev-group-id	Groups: {Developers}
3	Add User to Group	Group=Developers, Member=alice-object-id	Alice added to Developers group	Group Members: Developers -> {Alice}
4	Assign Permissions	Group=Developers, Permissions=Read, Write	Permissions assigned to Developers group	Permissions: Developers -> {Read, Write}
5	User Access	User=Alice	Alice inherits Developers permissions	Effective Permissions: Alice -> {Read, Write}
6	Exit	N/A	Process complete	Final State: Users={Alice}, Groups={Developers}, Permissions assigned

💡 All steps completed successfully; user Alice is in Developers group with assigned permissions.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Users	{}	{Alice}	{Alice}	{Alice}	{Alice}	{Alice}
Groups	{}	{}	{Developers}	{Developers}	{Developers}	{Developers}
Group Members (Developers)	{}	{}	{}	{Alice}	{Alice}	{Alice}
Permissions (Developers)	{}	{}	{}	{}	{Read, Write}	{Read, Write}
Effective Permissions (Alice)	{}	{}	{}	{}	{}	{Read, Write}

Key Moments - 3 Insights

Why does Alice get permissions even though we assigned them only to the Developers group?

Because Alice is added as a member of the Developers group (see step 3), she inherits all permissions assigned to that group (step 5).

What happens if we assign permissions directly to Alice instead of the group?

Alice would have those direct permissions in addition to any inherited from groups. This is not shown here but is possible.

Can a user belong to multiple groups and combine permissions?

Yes, a user can be in multiple groups and their effective permissions are the union of all group permissions.

Visual Quiz - 3 Questions

Look at the execution table, what is the state of group members after step 3?

A Alice is not in any group

B Developers group has Alice as a member

C Developers group is empty

D Developers group has no members

💡 Hint

Check the 'Group Members (Developers)' variable in variable_tracker after step 3

At which step are permissions assigned to the Developers group?

A Step 3

B Step 2

C Step 4

D Step 5

💡 Hint

Look at the 'Action' column in the execution_table for permission assignment

If Alice was not added to the Developers group, what would her effective permissions be at step 5?

A No permissions

B Read and Write

C Only Read

D Only Write

💡 Hint

Refer to the 'Effective Permissions (Alice)' variable in variable_tracker and the importance of group membership

Concept Snapshot

Users and groups in Azure:
- Create users and groups separately.
- Add users to groups to inherit permissions.
- Assign permissions to groups, not individual users.
- Users gain effective permissions from all groups they belong to.
- This simplifies managing access for many users.

Full Transcript

This visual execution traces creating a user named Alice and a group called Developers in Azure Active Directory. Alice is added to the Developers group, which is then assigned Read and Write permissions. The execution table shows each step, including user and group creation, adding the user to the group, assigning permissions, and how Alice inherits those permissions through group membership. The variable tracker highlights the state changes of users, groups, group members, and permissions after each step. Key moments clarify why permissions assigned to groups affect users and how multiple group memberships combine permissions. The quiz tests understanding of group membership, permission assignment timing, and the effect of missing group membership on user permissions. The snapshot summarizes the core concept of managing users and groups to control access efficiently in Azure.