Introduction
In modern cloud architecture, identity is the new security perimeter. As an infrastructure expands, managing access manually isn't just inefficient, it’s a massive security risk. Engineers must be able to scale user provisioning while maintaining strict governance and the principle of least privilege.
In this article, I break down a hands-on walkthrough of cloud identity engineering using Microsoft Entra ID. We will look past basic configurations to explore the real-world operational workflows every team needs: handling secure B2B guest invitations, mapping enterprise licensing, implementing granular administrative roles, and utilizing bulk automation pipelines to provision users at scale.
Here is the blueprint for building efficient, production-ready identity infrastructure in the cloud.
Exercise - Perform basic User Management tasks
In this exercise you will explore the beginner tasks of an Identity and Access administrator by creating and managing a user in Microsoft Entra ID. There are five common activities you will perform in your lab from creating a new user to assigning them roles and licenses.
This exercise should take approximately 10 minutes to complete.
Task 1 - Create a new user
1.Open the Microsoft Entra admin center at https://entra.microsoft.com.
2.Log in using the credentials for your tenant.
3.From the menu on the left, select User and then All users.
4.Select + New user and then pick the Create new user option.
5.Enter the requested information:
| Field | Value |
|---|---|
| User principal name | BhogeswarK |
| Display name | Bhogeswar Kalita |
6.Leave the Mail nickname as is.
7.Make a copy of the Password (auto-generated) and store it in Notepad. You will need it later.
8.Leave Accounted enabled checked.
9.Select the Properties tab.
10.Set the values for first and last name:
| Field | Value |
|---|---|
| First name | Bhogeswar |
| Last name | Kalita |
11.Note that you can set the User type to Member. If you pick Guest, it will restrict the users capabilities.
12.Scroll down to the bottom of the page.
13.Set the Usage location to United States or to whatever region you are in.
14.Select the Review + create button.
15.Select Create.
Subtask 1 - Log in to confirm user
1.Open an InPrivate browsing window.
2.Connect to the Microsoft Entra admin center at the link https://entra.microsoft.com.
3.Enter the username and password you just created.
| Field | Value |
|---|---|
| Username | BhogeswarK@your tenant name.onmicrosoft.com |
| Password | Auto generated password you saved |
4.If prompted follow the on-screen instructions to complete MFA setup.
5.Feel free to explore the Microsoft Entra admin center for a minute.
6.Close the InPrivate browsing window.
Task 2 - Add a license to the user
1.Open a new tab in your browser.
2.Connect to the Microsoft 365 admin center at https//:admin.microsoft.com.
3.If prompted, log in using the credentials for your tenant.
4.Find the menu on the left side of the screen.
5.Open the Billing item in the menu.
6.Select Licenses from the list.
7.When the list of licenses appears, select Microsoft Power Automate Free.
8.Select the + Assign licenses item.
9.Choose Brogeswar from the list (user created in previous task).
10.Select the Assign licenses button at the bottom of the page.
11.Notice the message that you have successfully assigned a license.
12.Close the tab with Microsoft 365 admin center.
Task 3 - Invite an external user to your tenant
1.If not already open - Open a browser and connect to the Microsoft Entra admin center at https://entra.microsoft.com.
2.If prompted, log in using the credentials for your tenant.
3.From the menu on the left, open the Identity menu.
4.Select Users then select All users.
5.At the top of the page select + New User.
6.Choose the option to Invite external user from the dropdown.
7.Enter the information for your new external user:
| Field | Value |
|---|---|
| ExtUser@testemail.com | |
| Display name | External User |
| Message | Thank you for joining the company for this short work project. We look forward to building this project together. |
8.Select the Review + Invite button.
9.Select Invite.
Task 4 - Assign a role to a user
1.If not already open - Open a browser and connect to the Microsoft Entra admin center at https://entra.microsoft.com..
2.If prompted, log in using the credentials for your tenant.
3.In the left menu find the Identity section. Open it if not already opened.
4.Select Users then select All users.
5.Choose the user Bhogeswar Kalita create in the earlier task.
6.From the newly opened menu select Assigned roles.
7.At the top of the screen select + Add assignment.
8.From the Select role dropdown menu chose the role Attribute Definition Reader.
9.Select the Next button when it becomes available.
10.Choose the option Eligible for Assignment type.
Select Assign.
Subtask 1 - Alternate method to assign a role to a user
1.Look at the Identity menu section on the left side of the screen.
2.Select the Show more option to see the full Identity menu.
3.From the list of items in the Identity menu, expand the Roles & admins section.
4.Select Roles & admins.
5.Select Attribute Log Reader from the list of roles.
6.From the top of the screen select + Add assignment.
7.From the Select member(s) select the No member selected text.
8.From the list of user choose Bhogeswar Kalita.
9.Choose the Select button at the bottom.
10.Select the Next button.
11.On the Add assignments page choose Active for the Assignment type.
12.Note that you have to enter a justification for this role / user assignment.
13.Enter the justification User will be working as an Attribute log reader as their primary job. into the box.
14.Select Assign.
Notice the Remove|Update option.
Task 5 - Bulk import users
1.If not already open - Open a browser and connect to the Microsoft Entra admin center at https://entra.microsoft.com.
2.If prompted, log in using the credentials for your tenant.
3.From the Identity menu, select Users and then select All users.
4.From the top of the page, select the Bulk operations drop-down arrow and then select Bulk create.
Note - Selecting Bulk create will open a new tile. This tile provides a Download link to a template file that you will edit to populate with your user information and upload to add the bulk creation of users.
5.Select Download to see a sample bulk user CSV file.
Note - The .csv template provides you with the fields included with the user profile. This includes the required username, display name, and initial password. You can also complete optional fields, such as Department and Usage location, at this time. You do not need to fill out all the fields.
Lab Tip - A sample CSV has been provided in the Allfiles/Lab1 folder – APL0501-BulkUser.csv.
6.Open Notepad.
7.Open the SC300BulkUser.csv file.
8.Search and replace the existing value «>> with Your actual domain name.
9.Save the file.
10.On the Bulk create users dialog, select the file folder icon on step 3.
11.Path to the Allfiles/Lab1 folder and select APL0501-BulkUser.csv file.
12.Select Open.
13.Wait for the notification that the file uploaded successfully. Select the Submit button to add the users.
Note - After the users have been created, you will be prompted that the creation has succeeded.
14.Close the Bulk create users dialog.
15.Check the list of users to see your bulk created users.
In summary, Identity is the foundation of secure cloud architecture. Managing access manually isn't just inefficient—it’s an operational risk.
This article breaks down a hands-on walkthrough of cloud identity engineering using Microsoft Entra ID. From enforcing the principle of least privilege with granular administrative roles and secure B2B guest access to scaling user provisioning through bulk automation pipelines, here is the blueprint for building secure, production-ready identity infrastructure.
Top comments (0)