Users and groups in Azure - Step-by-Step Execution

Process Flow - Users and groups

Create User

↓

Create Group

↓

Add User to Group

↓

Assign Permissions to Group

↓

User inherits Group Permissions

↓

User accesses resources with permissions

This flow shows how a user is created, added to a group, and inherits permissions assigned to that group.

Execution Sample

Azure

az ad user create --display-name "Alice" --user-principal-name [e-mail] --force-change-password-next-login
az ad group create --display-name "Developers" --mail-nickname developers
az ad group member add --group Developers --member-id alice-object-id

Creates a user Alice, a group Developers, and adds Alice to the Developers group.

Process Table

Step	Action	Input	Result	State Change
1	Create User	DisplayName=Alice, UPN=[e-mail]	User Alice created with objectId=alice-object-id	Users: {Alice}
2	Create Group	DisplayName=Developers, MailNickname=developers	Group Developers created with objectId=dev-group-id	Groups: {Developers}
3	Add User to Group	Group=Developers, Member=alice-object-id	Alice added to Developers group	Group Members: Developers -> {Alice}
4	Assign Permissions	Group=Developers, Permissions=Read, Write	Permissions assigned to Developers group	Permissions: Developers -> {Read, Write}
5	User Access	User=Alice	Alice inherits Developers permissions	Effective Permissions: Alice -> {Read, Write}
6	Exit	N/A	Process complete	Final State: Users={Alice}, Groups={Developers}, Permissions assigned

💡 All steps completed successfully; user Alice is in Developers group with assigned permissions.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Users	{}	{Alice}	{Alice}	{Alice}	{Alice}	{Alice}
Groups	{}	{}	{Developers}	{Developers}	{Developers}	{Developers}
Group Members (Developers)	{}	{}	{}	{Alice}	{Alice}	{Alice}
Permissions (Developers)	{}	{}	{}	{}	{Read, Write}	{Read, Write}
Effective Permissions (Alice)	{}	{}	{}	{}	{}	{Read, Write}

Key Moments - 3 Insights

Why does Alice get permissions even though we assigned them only to the Developers group?

Because Alice is added as a member of the Developers group (see step 3), she inherits all permissions assigned to that group (step 5).

What happens if we assign permissions directly to Alice instead of the group?

Alice would have those direct permissions in addition to any inherited from groups. This is not shown here but is possible.

Can a user belong to multiple groups and combine permissions?

Yes, a user can be in multiple groups and their effective permissions are the union of all group permissions.

Visual Quiz - 3 Questions

Look at the execution table, what is the state of group members after step 3?

A Alice is not in any group

B Developers group has Alice as a member

C Developers group is empty

D Developers group has no members

💡 Hint

Check the 'Group Members (Developers)' variable in variable_tracker after step 3

At which step are permissions assigned to the Developers group?

A Step 3

B Step 2

C Step 4

D Step 5

💡 Hint

Look at the 'Action' column in the execution_table for permission assignment

If Alice was not added to the Developers group, what would her effective permissions be at step 5?

A No permissions

B Read and Write

C Only Read

D Only Write

💡 Hint

Refer to the 'Effective Permissions (Alice)' variable in variable_tracker and the importance of group membership

Concept Snapshot

Users and groups in Azure:
- Create users and groups separately.
- Add users to groups to inherit permissions.
- Assign permissions to groups, not individual users.
- Users gain effective permissions from all groups they belong to.
- This simplifies managing access for many users.

Full Transcript

This visual execution traces creating a user named Alice and a group called Developers in Azure Active Directory. Alice is added to the Developers group, which is then assigned Read and Write permissions. The execution table shows each step, including user and group creation, adding the user to the group, assigning permissions, and how Alice inherits those permissions through group membership. The variable tracker highlights the state changes of users, groups, group members, and permissions after each step. Key moments clarify why permissions assigned to groups affect users and how multiple group memberships combine permissions. The quiz tests understanding of group membership, permission assignment timing, and the effect of missing group membership on user permissions. The snapshot summarizes the core concept of managing users and groups to control access efficiently in Azure.

Practice

1. What is the main purpose of a group in Azure Active Directory?

easy

A. To monitor network traffic

B. To store files and documents

C. To create virtual machines

D. To manage permissions for multiple users together

Solution

1. Step 1: Understand the role of groups

   Groups in Azure AD are used to organize users and assign permissions collectively.

2. Step 2: Compare with other options

   Storing files, creating VMs, and monitoring traffic are unrelated to groups.

3. Final Answer:

   To manage permissions for multiple users together -> Option D

4. Quick Check:

   Groups = Manage multiple users' permissions [OK]

Hint: Groups bundle users for easy permission management [OK]

Common Mistakes:

• Confusing groups with storage or compute resources
• Thinking groups monitor network traffic
• Assuming groups create virtual machines

2. Which Azure CLI command correctly creates a new user named 'alice'?

easy

A. az ad user create --display-name alice

B. az user create --name alice

C. az ad user add --user alice

D. az create user --username alice

Solution

1. Step 1: Identify correct Azure CLI syntax

   The correct command to create a user is 'az ad user create' with a display name parameter.

2. Step 2: Check other options for syntax errors

   Options A, C, and D use incorrect commands or parameters not recognized by Azure CLI.

3. Final Answer:

   az ad user create --display-name alice -> Option A

4. Quick Check:

   Correct CLI user creation = az ad user create --display-name alice [OK]

Hint: Use 'az ad user create' to add users [OK]

Common Mistakes:

• Using 'az user create' instead of 'az ad user create'
• Incorrect parameter names like --name or --username
• Mixing commands from different Azure services

3. Given this Azure CLI command sequence, what is the output?

az ad group create --display-name DevTeam --mail-nickname devteam
az ad user create --display-name Bob
az ad group member add --group DevTeam --member-id Bob

medium

A. Creates group DevTeam but does not add Bob

B. Adds user Bob to group DevTeam successfully

C. Fails because user Bob does not have an ID

D. Returns syntax error on group member add command

Solution

1. Step 1: Analyze user creation command

   The user is created with display name only; no user ID is captured or referenced.

2. Step 2: Check group member add command

   The command requires a member ID, but 'Bob' is a display name, not an ID, causing failure.

3. Final Answer:

   Fails because user Bob does not have an ID -> Option C

4. Quick Check:

   Member add needs user ID, not display name [OK]

Hint: Use user object ID, not display name, to add group members [OK]

Common Mistakes:

• Using display name instead of user ID in member add
• Assuming user creation returns ID automatically
• Ignoring required parameters for group member commands

4. You run this command but get an error:

az ad group member add --group DevTeam --member-id alice

What is the most likely cause?

medium

A. You need to use --member-name instead of --member-id

B. The member ID 'alice' is not a valid object ID

C. The group DevTeam does not exist

D. The Azure CLI is not installed

Solution

1. Step 1: Understand member-id parameter

   The --member-id expects a unique object ID, not a username or display name.

2. Step 2: Evaluate other options

   Group existence error would be different; --member-name is not a valid parameter; CLI installation error would prevent any command.

3. Final Answer:

   The member ID 'alice' is not a valid object ID -> Option B

4. Quick Check:

   Member ID must be object ID, not username [OK]

Hint: Use object ID, not username, for --member-id [OK]

Common Mistakes:

• Using username instead of object ID
• Assuming --member-name is valid
• Ignoring error message details

5. You want to assign a role to all users in a group named 'Admins' using Azure CLI. Which sequence of commands correctly achieves this?

hard

A. az ad group show --group Admins --query id -o tsv | az role assignment create --assignee @- --role Contributor

B. az ad group member add --group Admins --member-id Contributor

C. az ad user create --display-name Admins
az role assignment create --assignee Admins --role Contributor

D. az ad group member list --group Admins | az role assignment create --assignee @- --role Contributor

Solution

1. Step 1: Use best practice for group roles

   Assign RBAC roles directly to the Azure AD group; permissions automatically apply to all members.

2. Step 2: Retrieve and use group object ID

   'az ad group show --group Admins --query id -o tsv | az role assignment create --assignee @- --role Contributor' gets the single-line object ID and pipes it to --assignee.

3. Step 3: Evaluate other options

   A misuses group member add; C creates a user instead of using group; D pipes JSON array from member list, causing invalid --assignee value.

4. Final Answer:

   az ad group show --group Admins --query id -o tsv | az role assignment create --assignee @- --role Contributor -> Option A

5. Quick Check:

   Group object ID -> role assignment [OK]

Hint: Assign roles to Azure AD groups using object ID [OK]

Common Mistakes:

• Assigning roles to individual group members instead of group
• Piping multi-line JSON to single --assignee parameter
• Confusing group membership with RBAC role assignment