daniel ugot

Posted on May 28

Mastering Azure Entra ID: A Hands-On Guide to User Management and Privileged Roles

#cloud #devops #azure #cloudnative

Cloud identity management sits at the center of modern IT operations. Whether you are managing a startup environment or a large enterprise infrastructure, controlling who has access to cloud resources is vital. In Microsoft Azure, this responsibility is handled through Microsoft Entra ID.

In this hands-on guide, you’ll learn how to create users, assign administrative privileges, and apply the principle of least privilege by removing elevated permissions when they are no longer needed. These are foundational tasks every Azure cloud administrator should understand.

By the end of this walkthrough, you will know how to:

Create users in Azure Entra ID
Sign in with newly created accounts
Assign the Global Administrator role
Delegate administrative tasks securely
Revoke elevated access after task completion

What is Microsoft Entra ID?

Microsoft Entra ID is Microsoft’s cloud-based identity and access management service. It allows organizations to manage users, authentication, permissions, and secure access to applications and cloud resources.

Today, Entra ID plays a major role in:

Identity governance
Zero Trust security models
Multi-factor authentication (MFA)
Role-based access control (RBAC)
Single Sign-On (SSO)

Organizations use Entra ID to ensure that only authorized users can access critical systems and data.

Prerequisites

Before starting this hands-on lab, ensure you have:

An active Microsoft Azure subscription
Access to the Microsoft Azure Portal
A user account with Global Administrator privileges
Permission to create and manage users

Step 1: Create a New User in Azure Entra ID

Every employee, administrator, developer, or service account in Azure needs an identity. User creation is one of the most common administrative tasks in any cloud environment.

Sign in to the Azure Portal
Search for and open Microsoft Entra ID

Click on ADD, select Users and select Create New User

A window with a form to fill in unique information for your user opens

user principal name:ricky.george@xxxxxxx
Display Name: Ricky George
Password: xxxxxxxxx (uncheck the auto-generate option to enter your password)

Click on Next: properties

First Name: Ricky
Last Name: George
User type: Member

Click Next >> Next: Review + Create >>
Click Create
Back to Entra ID, on the left pane, select Manage >> User

Step 2: Sign In with the Newly Created User Account

Now that the account exists, the next step is testing access by signing in. In real-world environments, administrators often validate accounts before handing them over to employees or team members.

Open a private/incognito browser window
Navigate to the Microsoft Azure Portal
Sign in using the new credentials
Change the password if prompted

At this stage, the new user has very limited permissions.

If the user attempts administrative actions, Azure will deny access because no elevated role has been assigned yet.

This demonstrates Azure’s default security posture: users receive only minimal access until roles are explicitly assigned to them.

Step 3: Grant the User Global Administrator Access

Next, you will elevate the user’s privileges by assigning the Global Administrator role. The Global Administrator role is the highest privileged role in Entra ID.

A Global Administrator can:

Manage all users
Reset passwords
Assign roles
Configure security settings
Manage subscriptions and services

Because of its power, organizations should grant this role carefully and temporarily whenever possible.

Sign back in using your original administrator account
Open Microsoft Entra ID >> Manage >> Users
Select the User we have just created (Ricky George)
Under the user, in the left pane, select Assign Roles

Click on Add assignments

Search for Global Administrator and select the role.
Click ADD at the bottom to apply the role to the selected User.

Step 4: Create Another User Using the Newly Promoted Account

Using the newly promoted Global Administrator account, create another user.

While signed in as the promoted administrator
Open Microsoft Entra ID >> Manage
Navigate to ADD >> Users >> Create new Users

Fill out the necessary information for a new user and click Create.

This confirms the promoted account has administrative privileges.

Step 5: Revoke Global Administrator Access from the First User

Once the administrative task is complete, remove elevated privileges.
One of the biggest security risks in cloud environments is excessive privileged access.

Leaving Global Administrator rights permanently assigned can increase exposure to:

a. Credential theft
b. Insider threats
c. Accidental misconfigurations
d. Unauthorized access

Sign in using your original administrator account
Open Microsoft Entra ID
Navigate to Manage >> Users >> select the New User account
On the left pane, select Assign Roles. You will see the assigned role to the User. Select the Global Administrator Role, then click Remove Assignment.

Sign back in using the first user account. Try accessing administrative settings again. You should notice that administrative capabilities are no longer available.

This confirms the role removal was successful.

Closing Thoughts

Managing identities and permissions is one of the most important responsibilities in cloud administration. In this hands-on, we have learned how to: