User and Hybrid Identities

A Helpdesk admin who can reset passwords for one region, a contractor from a partner firm, a laptop joined to the company, and a service account synced from an old on-premises domain all live in one Microsoft Entra ID tenant (the cloud identity directory, formerly Azure Active Directory / Azure AD), yet you manage each one differently. The single idea that ties this domain together is origin: where an identity comes from decides how it lands in the tenant, where you edit it, and what it can do by default. A cloud-native user is born in Entra ID; a synced user is mastered in on-premises Active Directory and only mirrored into the cloud; a guest is invited and authenticates back in its own home directory. Origin is descriptive, not a setting you toggle, and that is exactly where the exam lays its traps. You do not promote a guest to a member by flipping its userType, you do not change a synced user by editing it in the cloud (you edit it on-premises and let the next sync cycle carry the change), and you do not grant more access by changing what an identity is. You grant access by assigning roles, group memberships, and licenses on top of whatever the origin already made it.

Read the four subtopics as a sequence that builds outward from the tenant core. Start with Entra Tenant Configuration: this is the chassis, the roles, scopes, administrative units, custom domains, branding, and default-permission switches that everyone else inherits, so settle who can administer what before you create a single user. Next, Users, Groups, and Devices fills that chassis with the cloud-native identities you own, choosing group type by purpose and membership type by how it fills, setting usage locations before licenses, and joining versus registering devices by who owns them. Then External Identities opens the tenant to people you do not own, the B2B guests, cross-tenant access settings, and cross-tenant synchronization that let partners in without you managing their passwords. Finally Hybrid Identity bridges your existing on-premises Active Directory into the cloud, keeping the synchronization choice (Microsoft Entra Connect Sync or the lighter Microsoft Entra Cloud Sync) separate from the sign-in choice (password hash sync, pass-through authentication, or federation). Each step assumes the one before it is in place.

Across all four subtopics the exam rewards the same instinct. Grant the least scope that does the job: prefer an administrative-unit-scoped or single-resource role assignment over a tenant-wide one, and a restricted management administrative unit when even tenant admins must be kept out of sensitive objects. Match the mechanism to where the identity lives: invite a one-off partner with B2B collaboration, but automate a partner you own with cross-tenant synchronization; edit a cloud user in Entra ID, but a synced user on-premises. And watch the license line, because much of this domain is free while the heavily tested features are not. Built-in roles, assigned groups, and custom security attributes cost nothing, whereas dynamic group membership, group-based licensing, custom role assignments, and each cross-tenant-synced user all require Microsoft Entra ID P1. When an answer choice would work but spends a higher privilege, a broader scope, or a license you were not told you have, it is usually the wrong one.