Microsoft AZ-104: Azure Active Directory and Identity Management — Study Guide

By Laurynas Brazys · 6 August 2026 · #microsoft #az-104 #certification #exam-prep #study-guide

Part of the Microsoft Azure Administrator Associate AZ-104 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Azure Active Directory (Azure AD) is the identity control plane for Microsoft cloud services. A tenant is a dedicated, trusted identity directory that contains users, groups, applications, devices, and policies. A subscription is a billing container for Azure resources and is associated with exactly one Azure AD tenant for identity and access; a single tenant can hold multiple subscriptions. Role assignments for Azure resources (Azure RBAC) come from the tenant associated with the subscription. Users authenticate against their home tenant and can be granted access to resources in any subscription that trusts that tenant. Identity governance and security policies (for example, Conditional Access) apply at the tenant layer and drive how identities consume services across subscriptions.

Identities, Groups, and Licensing

Azure AD user accounts fall into three categories that influence lifecycle, authentication, and administration:

Cloud-only users are created and managed in Azure AD. Their credentials live only in the tenant, and password reset is handled by Azure AD (SSPR).
Synced users originate in on-premises Active Directory and are synchronized via Azure AD Connect. Their identity lifecycle is mastered on-premises. With Password Hash Synchronization (PHS), Azure AD stores a hash-of-hash of the on-premises password; with Pass-through Authentication (PTA) or federation, password validation happens on-premises. With password writeback enabled (Azure AD Premium + Azure AD Connect), SSPR and “Change password” in the cloud can update on-premises AD.
Guest users (B2B collaboration) are external identities represented as userType=Guest. They authenticate with their home identity provider (another Azure AD, Microsoft account, or one-time passcode) and are granted access through groups, app assignments, or RBAC. The invitation results in a redemption process the guest completes before accessing resources.

Groups provide scalable authorization and licensing. Assigned membership is explicitly managed. Dynamic membership (Azure AD Premium P1) evaluates rules against user or device attributes and automatically maintains membership in near real-time, ideal for employee type, department, or device compliance scenarios. Group-based licensing assigns product SKUs (for example, Microsoft 365 E5, Azure AD Premium) to security groups; Azure AD calculates effective license assignment, honors service plan disables, and surfaces conflicts. Dynamic groups pair well with group-based licensing to automatically license populations based on attributes.

Hybrid Identity with Azure AD Connect

Azure AD Connect establishes identity sync and sign-in patterns for hybrid environments:

Password Hash Synchronization (PHS): Syncs a cryptographic hash-of-hash of on-premises passwords to Azure AD. Azure AD performs authentication, enabling high availability with no inbound connectivity to the corporate network, and supports Seamless SSO. PHS is the simplest, most resilient option and is recommended for most organizations.
Pass-through Authentication (PTA): Lightweight agents validate passwords against on-premises AD in real time over outbound TLS 443. Supports Seamless SSO and preserves on-premises sign-in policy dependencies without deploying federation. Deploy multiple agents for high availability.
Federation (e.g., AD FS): Authentication happens at a customer-managed STS with claims issuance and optional smartcard/Kerberos constraints. It adds complexity and operational cost and is now reserved for niche claims and sign-in requirements. Many organizations migrate from federation to PHS/PTA.

Synchronization runs on a scheduler (default 30-minute cycle). Use Start-ADSyncSyncCycle -PolicyType Delta to immediately push recent changes such as new users, group membership, and attribute updates. Run -PolicyType Initial only for first-time or topology/schema changes (it performs full import, sync, and export and is slower). Forcing AD replication, restarting NetLogon, or manipulating the Global Catalog does not trigger Azure AD Connect export; the supported method is the PowerShell sync cycle or Synchronization Service Manager operations. Scope sync with OU and attribute filtering. For password writeback and SSPR integration to on-premises, enable the writeback feature in Azure AD Connect and grant the necessary on-premises permissions.

Access Decisions: Conditional Access, MFA, SSPR, and Identity Protection

Conditional Access (Azure AD Premium P1/P2) evaluates signals and enforces real-time controls at sign-in and token issuance. A policy targets users, groups, or directory roles; cloud apps or user actions; and conditions such as sign-in risk, device platform, client apps (legacy vs modern), and locations. Named locations tag trusted IP ranges or countries/regions and allow explicit include/exclude logic. Grant controls enforce requirements such as:

Require multi-factor authentication
Require device to be marked as compliant (Intune)
Require Hybrid Azure AD joined device
Require app protection policy, approved client apps, or Terms of Use Session controls govern sign-in frequency, persistent browser sessions, or app-enforced restrictions. When the requirement is “Global Administrators must use MFA and a trusted device from untrusted locations,” target the Global Administrator directory role, use a condition for locations excluding the named trusted networks, and configure grant controls to require MFA plus either compliant device or hybrid Azure AD joined. This is not solved by toggling per-user MFA or modifying only session controls.

Multi-factor authentication can be enforced via:

Per-user MFA: A legacy, coarse-grained enable/disable state at the user object. It lacks contextual factors and is generally superseded by Conditional Access requirements.
Conditional Access MFA: The modern, recommended approach. Requires MFA only under specified conditions (for example, high-risk sign-ins, untrusted networks, privileged roles).
Self-Service Password Reset (SSPR): Configurable authentication methods and registration, with optional password writeback to on-premises. Combined registration unifies MFA and SSPR setup. Define registration policies, methods (for example, Microsoft Authenticator, FIDO2, SMS/voice as allowed), and lockout/notification settings. Legacy Azure MFA consumption models (Per Authentication vs Per Enabled User using classic MFA providers) cannot be switched in place; you must deploy a new provider and reassign—simply “changing the model” via portal or CLI is not supported.

Azure AD Identity Protection (Azure AD Premium P2) detects and responds to risk using telemetry such as leaked credentials, atypical travel, malware-linked IPs, and unfamiliar sign-in properties:

User risk estimates the likelihood an identity is compromised over time, triggering policies such as “Require password change for medium and above.”
Sign-in risk estimates the likelihood a specific sign-in is malicious, enabling controls like “Require MFA for medium and above.” Risk policies can auto-remediate or block. Integrate with Conditional Access by leveraging risk as a condition and by prioritizing resilient MFA methods.

Administrative Roles and B2B Governance

Administrative roles scope control within Azure AD and should follow least privilege:

Global Administrator has full authority over identity, security, and licenses. Use sparingly, protect with Conditional Access and MFA, and consider Privileged Identity Management (PIM) for just-in-time elevation and access reviews.
User Administrator can create and manage users and groups, reset non-admin passwords, and manage some directory attributes. Scope further using Administrative Units to limit blast radius to specific departments or regions.
Custom roles (Azure AD Premium) allow fine-grained permission sets across directory objects; assign to users or groups, optionally scoped to Administrative Units.

B2B collaboration lets external users access apps and resources without duplicating identities. The process includes:

Invitation: An internal user or automation invites by email or direct redemption URL, optionally requiring Terms of Use.
Redemption: The guest authenticates with their home identity. If unavailable, one-time passcode can be used. Successful redemption creates or confirms the guest object in the resource tenant.
Authorization: Grant access through Azure AD groups, app assignments, or Azure RBAC on subscriptions/resource groups. Use group-based licensing if the guest requires licensed services.
Governance: Use Access Reviews (Azure AD Premium P2) to periodically attest continued need for guest access, automatically remove stale guests, and audit decisions. Configure external collaboration settings and cross-tenant access policies to balance collaboration and risk. Apply Conditional Access to guests, using named locations and MFA requirements appropriate to external risk.

Practical Problem Scenario

Contoso Ltd. has a hybrid identity deployment and must reduce risk for privileged access while onboarding a partner’s users to specific applications. The Azure administrator is tasked with enforcing MFA and device trust for Global Administrators from untrusted networks, accelerating on-premises-to-cloud user sync during a merger, and governing partner guest access to a SharePoint Online site and an internal line-of-business app.

Step-by-step approach:

Model identities and trust

Associate all Azure subscriptions to the Contoso tenant to centralize identity governance. Create a dedicated resource group and Azure AD security groups for app access. This ensures a single policy plane and simplifies Conditional Access targeting.

Optimize hybrid sign-in and sync

Configure Azure AD Connect with Password Hash Synchronization and Seamless SSO for simplicity and resilience. Deploy PTA agents only if regulatory controls demand on-premises password validation. Use OU filtering to scope the merger’s user containers. For urgent user availability, run Start-ADSyncSyncCycle -PolicyType Delta. PHS provides Microsoft-operated availability and reduces on-premises dependency; the delta cycle guarantees timely export without a heavyweight full sync.

Enforce privileged access controls

Create a Conditional Access policy targeting the Global Administrator role. Conditions: include all locations, exclude named trusted corporate IP ranges. Grant controls: require multi-factor authentication and require device to be marked as compliant (or require hybrid Azure AD joined). This satisfies the “MFA + trusted device from untrusted locations” requirement precisely at sign-in. Use PIM to make Global Administrator assignments just-in-time and require approval plus MFA, reducing standing privilege.

Standardize MFA and SSPR

Disable legacy per-user MFA states and rely on Conditional Access to enforce MFA contextually. Enable combined registration and SSPR with password writeback so synced users can reset both cloud and on-premises passwords. This improves user experience and ensures compliance. Avoid attempting to switch legacy MFA consumption models in place, as it is unsupported.

Onboard partner users with B2B and govern access

Invite partner identities as guests to the Contoso tenant and assign them to a security group mapped to the SharePoint site and app. Apply an Access Review to the guest group with a 90-day recurrence and auto-removal for non-responders. Apply a Conditional Access policy to guests requiring MFA outside named partner IP ranges. B2B avoids duplicating accounts, leverages the partner’s authentication, and Access Reviews provide lifecycle governance with auditable outcomes.

Why these services:

Azure AD Connect with PHS provides the lowest operational burden with strong security; delta sync ensures rapid provisioning.
Conditional Access grant controls directly enforce MFA and device trust, something session controls and per-user MFA cannot guarantee.
SSPR with writeback closes the loop for synced identities, reducing helpdesk load and aligning with compliance.
B2B collaboration plus Access Reviews balances external collaboration with least privilege and periodic attestation, minimizing risk while maintaining agility.

All domains · Azure Subscriptions →

Practice these questions → · Timed practice on ExamRoll.io →