A Beginner’s Look into Azure Active Directory (Microsoft Entra ID) and Roles with a Simple Exercise
Tags: beginners, cloud, azure, roles
Published: 2024-05-13 03:47:24

First of all, what is **Active Directory**?

**Active Directory** is a service that was previewed by Microsoft in 1999 has been in use since windows server 2000 edition. It has been a useful service in helping organisations as a Windows domain services tool that allows you to set permissions and make groups for the users and assets in your environment. Active Directory works on premises with the domain controller.

This service is also available in the cloud, for Microsoft Azure it is known as **Azure Active Directory (Azure AD)** or by its new name **Microsoft Entra ID**. It is an identity and access management solution from Microsoft that helps organizations secure and manage identities for hybrid and multicloud environments. 

Permissions and access management solutions are given based on roles in Azure are assigned using either:

- **Azure Active Directory (Azure AD) Roles** is an identity and access management service that enables user and device authentication and authorization across Azure and other integrated applications. Azure Active Directory roles control access to Azure Active Directory resources such as users, groups, and applications.
- **Azure Roles (or Role Based Access Control-RBAC)** is a widely used access control model that allows administrators to assign specific roles to Azure users, groups, or service principals.

**Azure Roles** is responsible for the access to Azure resources while **Azure AD Roles** controls access to resources in Azure AD (Microsoft Entra ID). These roles have their different **purposes, scopes** and types of roles you can assign. Below is a table highlighting the differences between **Azure Active Directory Roles (Azure AD)** and **Azure Roles.**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wplhla43sfmtb00g21d1.png)

## Practical Exercise

Hagital Consulting Ltd has decided to streamline its identity management process by utilizing Microsoft **Entra ID **(Azure Active Directory) to manage its cloud-based identities.

- Create the Administrative Department and add two users (**Grace Peters** and **Ahmed Johnson**) to it.
- Assign the Global Administrator Role to User A **(Grace Peters)**
- Show all the steps it took the Global Admin to Log in into the Azure Portal with **Grace Peters** new credentials.
- Let the Global Administrator **(Grace Peters)** create/onboard a new member **(Steven Kalu)** to the Admin Department

Let’s go ahead with the exercise.

## Prerequisite
First thing login to your Microsoft Azure Portal by going to https://portal.azure.com.

If you do not have an azure account sign up and create an account for free with this link https://azure.microsoft.com/en-us/free/. Registration will require a phone number and a debit or credit card details to validate your account even for the free account. You have a choice between the free or pay as you go account.

## Practical Begins
**Step 1:** Search for **Microsoft Entra ID** in the search bar at the top of your portal page and Select **Microsoft Entra ID**. 


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zcoh96f8sk2x49881a5r.png)

You are now in the **Default Directory| Overview** page.

- Click **Groups** under the **Manage** drop-down menu at the left-hand side of the portal.
  
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/160249isa9l4g88jfj1s.png)

- Click **New group**.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ls4e4dzywb90ung8hwco.png)
**Step 2:** The **New Group** menu create the **Administrative Department**.

- **Group type:** Select **Security**.
- **Group name:** Type **Administrative Department**
- **Group description:** Give a description of the group or you can leave it as is.
- **Membership type:** Leave as is.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xn5nnzmjw159i1jylrpa.png)

- **Members**: Click on **No members selected**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4iaswnt7zz7wwdfup45v.png)

- The **Add members** menu pops up click **Users** underneath the search bar.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ewmz2xv587urupcoyus6.png)

Select the two new members of this group in this we are picking **Grace **and **Ahmed Johnson** the click **Select** at the bottom left of the windows.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d4ivuwe09872cju9nbys.png)

- You are back to the **New Group** page click **Create** at the bottom left of the page.
- Back at the **Groups| All groups** page click Refresh then your newly created Administrative Department will show up under the list of groups found.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7evkuxnfsp4s3l0q0nee.png)
**Step 2**: Assigning **Global Administrative role** to a member of the created group. We will be giving **Grace** this role and appoint her as **Head of the Admin**.

- Click on **Default Directory|Groups** to get back to the **Default Directory** page.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nwrkskkzlg0h3tus75tl.png)

- Click on **Users** under the **Manage** dropdown menu at the left-hand side of the page.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lx37ov7t55oh2k0g79ng.png)

- In the **Users** page click **Grace.** 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/efwbmqcfgqkvv38mn7yy.png)

- **Grace's** User page is now open. Go to the menu at left hand side of the page click on **Manage** in its dropdown menu click on **Assigned roles**.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bddyyanninlqr36j9anc.png)

- In the **Grace|Assigned roles** page click on **Add assignments.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pmkql3yd8va9bda9x4c1.png)

- **Directory roles** window opens. In the search bar type **Global Administrator**, select it when it appears and click **Add** at the bottom of the window.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9cox267meuk99qdtkv2k.png)

- Click on **Refresh** once back in **Grace|Assigned **roles page, the role will now appear in the list of **Administrative roles** she has been given.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s822bh3i3xxdz2ou7fye.png)

## Sign into Grace’s Azure Portal
 **Step1:** Open another browser or your current browser in incognito or Inprivate mode depending on the browser you are using.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yses2pziuyz5ucrru8xu.png)

- Login to Azure using Grace’s credentials. 
- Go and copy Grace **User Principal name (UPN)** to login to Azure.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dvhv2fofkdkz5r1gfmb7.png)

- Paste it in the **Sign in.**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9x8jnbomey0kyajnxfv6.png)

- Enter the password you gave to the account or the copied out autogenerated password and click **Sign In.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mjzsdist5z7td3ywwwuj.png)

- Grace will be prompted to **Update your password** at your first sign in. Change password and click **Sign in**.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/23j5o6i1n9l2m8i2uwgw.png)

- An **Action Required** prompt will show on screen, for this exercise we will be clicking **Ask Later.**
- **Stay signed in?** prompt comes click **Yes**.

You are now logged Grace’s User Account.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/60erht23pgn5glx8p5c3.png)

**Create/Onboard** a new member into the **Administrative Department** with **Grace** who we have giving the role of **Global Administrator.**

**Step 2:** Click **Microsoft Entra ID** to go into the **Default Directory|Overview** Page

- Click on **Add** 
- In the menu that hover your mouse over **User** then click on **Create new user**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kp8vt7reu8exfeczbza0.png)

**Step 3:** In the **Create new user** page we start with the **Basic** tab.

- **User principal name:** Enter the user’s name
- **Mail nickname:** Leave the check box ticked beside the **Derive from user principal name**
- **Display name:** Enter a name
- **Password:** You can leave the Auto-generate password ticked but copy the password somewhere you can easily find it or uncheck the box and type in the password yourself.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3sd1648tssx1x4y7jyv0.png)

- Click **Next: Properties** at the bottom of the portal to move to the next tab.

**Step 3:** We move to the next tab **Properties**. 

- We start with **Identity**.
1. **First name:** Enter Steven
2. **Last name:** Enter Kalu
3. **User type:** Leave it as Member.

- **Job Information**:  We will fill in a few other details

1.** Job title:** Admin Officer
2. **Company name:** Higital Consulting Ltd
3. **Department:** Administrative

- Leave everything else as they were and click **Next: Assignments** at the bottom of the page.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9jvzu89vmx6zwo5qwk3m.png)

**Step 4:** In the **Assignments** tab. We be adding **Steven Kalu** to the Administrative Department.

- Click **Add group**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o9iqwqtsxfkklzq44ep7.png)

- In the new window **Select group** look for and click the check box for **Administrative Department** we created.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ohpfg2ef0ucwtm2vfnk7.png)

- Once done click **Select** at the bottom of the page.
- Click **Next: Review + create**
- Click **Create**

You have successfully created a user with Graces Peter’s Portal. You can view the account, Steven Kalu, you just created by going to **Default Directory| Overview** and click **Users** under **manage**. You will be able to see it in both your account you start this exercise with and in Grace Peters’ account. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tct2h9i9hva2nxyyq0qi.png)

In summary, Azure Active Directory (Azure AD) Roles and Azure Roles are important parts of access management in Azure’s ecosystem. As we can see from the simple exercise above it can help an organisation securely and efficiently manage its users/staff and give access and privileges which can be similar to their roles in their organisation.