Shadowing Practice: Understand Microsoft Entra ID | AZ-104 | Episode 2 - Learn English Speaking with Video
Choose a practice mode
Each mode opens a full-screen practice room.
537 sentences
If sentences are too short or too long, click Edit to adjust them.
1
Welcome.
2
My name is Bob Tickleman.
3
I'm a Microsoft Technical Trainer, and I'm excited to be your guide for this module on Microsoft Enter ID, part of the Identity Governance component.
4
We're going to take a specific look at what is Microsoft Enter ID
5
and how does it relate to your on -premises or your legacy Active Directory domain services.
6
Now, this is a fairly high -level conversation.
7
There's going to be much more that
8
if you want to get into deeper components that I'll show you some techniques that you can use and other learning paths.
9
But we're going to just take a look at the overall identity governance component that Microsoft Enter ID provides.
10
As I said, Microsoft Enter ID and its current name has evolved over time
11
and is part of the identity governance model at Microsoft.
12
It was originally called Azure Active Directory, leveraging its previous name on premises of Active Directory Domain Services,
13
or ADDS is the acronym I'll be using.
14
As identity in the cloud has evolved, and we'll explain all that as we get into this module,
15
the name has changed to reflect the significant modifications to identity in the cloud
16
and it's part of our ongoing evolving model in identity.
17
We're going to be currently at Microsoft Enter ID
18
and I'll make some reference to the next phase
19
which is going to incorporate a thing called verifiable identity as an industry standard.
20
We're going to specifically look at a number of features of what is Microsoft Enter ID.
21
I'm going to be making references to content from another module
22
where we're going to take a look at this thing called a tenant inside of Azure
23
which is part of the governance model inside of the cloud solution Microsoft Azure.
24
So if you want to get some information on the overall governance and what are subscriptions and tenants, make sure you see that recording as well.
25
But we're going to take a look at a very specific piece called EntraID and the identity governance that provides.
26
We're going to show that relationship to your legacy on -premises environment, as well as we're going to be showing you a feature to provide
27
that legacy infrastructure of the thing called Kerberos and NTLM, how you can replicate that into the cloud if you don't have one on -premises,
28
but you may need it for legacy purposes.
29
We'll be taking a look at features like license programs that you have, what comes along with those licenses, and the benefits of them, and how you can assign those licenses.
30
And we'll finish up with the self -service password reset, just one component of the overall identity management.
31
And as I said, I'll be doing whiteboarding as well as demonstrations that will show you not all of the features, but show you the broad capabilities that's available for it.
32
Let's get into this.
33
In its current state, Microsoft EntraID is where we manage identities.
34
Now, identities is an important thing to understand
35
and there's a lot of words at Microsoft that sound the same but are different.
36
There are things that sound different but are exactly the same.
37
I always go back to some of my history.
38
We used to have extended and expanded memory when we were managing computers for the operating system.
39
Those two terms sound very similar but they were completely different, but then you had base and conventional memory, which sound different, but were the same.
40
You'll see a lot of that as we get into identities, and I'll try and be very specific on how I use these names, and I'll encourage you to use them so
41
that you're going to be able to communicate with your colleagues and understand each other as opposed to going, are they talking about the thing that I'm thinking that it is?
42
But I'd always make sure that you're using the correct names, and then when other people are using them, that you understand what their intent is.
43
What you're seeing on the slide is the broad spectrum of this environment that we're working with.
44
Looking at the far right -hand side of the screen, you're looking at your legacy on -premises environment
45
that was built around your Windows server environment dating back to the 1999s or 2000s when Microsoft introduced Active Directory.
46
And that evolved over time because we called it Active Directory for that on -premises authentication and authorization.
47
There's two words, again, sound the same.
48
They're two parts of a whole.
49
Authentication is proving who you are, typically with a username and password.
50
Authorization then grants you access to certain resources based around being authenticated.
51
And we're gonna be taking a look at
52
that as we get into the whiteboarding and the demonstrations that I'll be doing with regards to identity.
53
So we had this product called Active Directory on -premises, and it was based around legacy technologies called Kerberos and NTLM.
54
And it has served us very well for over 25 years.
55
We learned a lot over that period of time, and not just we as Microsoft, but the industry as a whole.
56
And when we moved to the cloud, we came up with a new method to be able to provide this authentication and authorization.
57
And that's where we're gonna cover in this recording, as well as other recordings, what are some of those differences and the things
58
that you may need to bring to your skillset to manage things in the cloud.
59
The new identities are based around the technologies of OpenID.
60
OAuth, OData, and WSFed.
61
And while we have these new skills, they have to be able to potentially incorporate working with that on -premise legacy environment.
62
And so when we take a look at Microsoft EntraID, we'll be jumping in and taking a look at those new technologies and showing them in this.
63
Now, deeper dives into the authentication and authorization will be covered in other modules in this class.
64
We're just trying to understand the landscape around identities overall.
65
Now I mentioned
66
that you might want to be able to have this legacy technology still available to you
67
and you'll see as we get into not so much the material
68
but my demonstrations that you might have to provide some legacy communications back to that on -premises environment.
69
What happens if you don't have it or maybe you don't want to maintain
70
that infrastructure anymore but you still needed those underlying technologies of Kerberos
71
and NTLM And that's where you're seeing on the far left -hand side of this, a feature that inside of Azure,
72
Microsoft is going to be able to provide some of the legacy capabilities of Kerberos
73
and NTLM and some of the services of GPOs or group policy objects that are made available to you.
74
So just understanding that Microsoft has been able to communicate this new technology, make it work with your legacy -based environment,
75
and provide a broad spectrum of options available to you.
76
Taking a look at some of the similarities and differences between the two, I've identified some of these already.
77
You take a look at when Microsoft enter ID itself, we have that at the very top, we've got those identities.
78
Now I'm going to go to a whiteboard
79
and I want to show you and come back here to hopefully have you understand all of these terms of identities,
80
service principles, security principles, security principle names, again, all these things that might sound the same.
81
So let's go to a whiteboard session.
82
I want to start by showing you content
83
that was delivered in another module that talked about the architecture of Azure itself and a thing called a tenant.
84
So if you haven't seen that recording yet, I'd make sure you go see the governance model for Azure.
85
But what you're seeing is a diagram that I showed in that module that showed what this thing called a tenant is.
86
And inside of your tenant, you have two major components.
87
On the right -hand part of the screen, you're seeing identity management and identity governance, and that's what we're covering.
88
And on the left -hand side, you're taking a look at resource management that we're going to be covering in those other modules I talked about.
89
Now, specifically around EntraID itself, the identities that we want to take a look at are hierarchical,
90
and that's where I want to take a look now of what is an identity.
91
What you're seeing is this chart
92
that I've built to hopefully show you graphically what it is
93
that I'm going to show you in the interface and to understand from a concept.
94
At the very top level, we have our Microsoft Enter ID or your tenant directory.
95
I'm going to get on a soapbox here for just a minute.
96
Some people call this your tenant and it is not.
97
It is the tenant directory.
98
And what happens is over time, people have taken this tenant directory because there is a one -to -one relationship.
99
One tenant can have one tenant directory.
100
One tenant directory can only be associated with one tenant.
101
And because of that tight coupling, a lot of people have just kind of assumed that it was just one thing.
102
And over time, they've dropped the tenant directory name.
103
And so I've got my tenant.
104
I'm going, are you talking about your enter ID directory tenant?
105
Or are you talking about the actual tenant in Azure?
106
And they go, they're the same thing, but they're not.
107
So inside of your tenant directory where you manage your identities, we have this hierarchical structure.
108
Below that, we get terms called identities and application objects.
109
Now these are general terms that take up the identities that you create and break them up into several major categories.
110
Some of them go back to that legacy component of usernames and passwords, things like device identities that you have and group identities.
111
We have those, but we have a whole new set of identities
112
that came along with this OpenID OAuth OData model that I was talking about.
113
So diving in deeper, we are going to focus on the identities themselves
114
and we have what are called security principles and identity content.
115
So under the security principles, we get user principles.
116
These are all those names that I said get a little confusing.
117
And a user principle is basically what you might be used to, a username and password that is associated with an individual.
118
They typically use that to authenticate and then use that for authorization.
119
We're going to get into and take a look at groups specifically, and it is Microsoft's recommendation that you use groups to manage users.
120
Even if it's a single individual user, we recommend that you do not manage them as an individual user.
121
You should put them into a group, even as an individual, and manage that individual user through its group membership.
122
Because what happens in organizations, they don't typically change from a structural perspective, roles that are played by individuals,
123
HR managers versus HR users.
124
But the people performing those roles often do.
125
And so if I give a permission or manage a user
126
and that user either moves up in the organization or potentially moves out, I have to actually get rid of that user account and reprovision everything that that user had.
127
It is much simpler if you were to take that user and put them into say an HR manager group
128
Allocate all the permissions to all the files and resources and services that they can do
129
And then as that person either moves out of that role
130
or moves out of the organization You just remove them from the group removing all their capabilities
131
and put the new user coming in so absolutely Try and not use
132
Individuals for managing they're going to authenticate
133
but you're going to manage them through their group membership We then take a look at device identities
134
and we've had devices for years.
135
They used to be based around a Windows operating system, either Windows 10 or Windows 11.
136
Now these were what were referred to as domain joined devices.
137
What's happened over a period of time and one of the moves
138
that we changed when we went to the cloud in this OpenID, OAuth, OData and WSFed, these devices have expanded.
139
As opposed to Windows only devices that were domain joined, we broadened the type of devices.
140
We now had mobile devices of iOS and Android.
141
We had Mac and we had Linux devices that could be registered as opposed to join that.
142
We could then put a light set of controls over those.
143
You might have heard them referred to as BYOD or bring your own devices.
144
So we got a broad spectrum of devices, some from the legacy environment, as well as a whole new set that come from using with Azure Enter ID.
145
We then get this thing called service principles.
146
So we've talked about security principles, but then we have service principles.
147
There's that concept of names that sound the same, but they're different.
148
And these are all new.
149
This is one of the major things that have changed when we moved to Azure and this OpenID OAuth model.
150
What we have is application services, and we have managed identity that fall into two categories.
151
We're not going to get into it in this module.
152
It is covered in other courses.
153
Things like user -assigned managed identity
154
and system -assigned managed identity become this new model in a way for building applications
155
and having microservices and giving them their own identities to provide for the services
156
and applications to have their own identities at a microservice level that simplifies the management.
157
So something you may want to take a look at.
158
We're not going to really cover it in this module.
159
So how does this take place?
160
I've got on the screen a diagram of your legacy environment on premises in the Active Directory domain services, and you can see there a domain controller in
161
which you had a thing called your Active Directory domain services directory structure in a file called ntds .dit.
162
Now, this is where you had your individual users that could be authenticated with the usernames and passwords.
163
All the group membership, all that stuff I was talking about before, managed on premises, but you used the technology of Kerberos and NTLM as the foundation.
164
As I said, it worked for many years for us, and it was a great service.
165
And what happened is at the time that you got authenticated, a user would come to the domain controller, authenticate their username and password,
166
and it would then create this thing called a token.
167
And that token had a thing called a SID, or secure identifier on it.
168
It's going to be a token that you could then present, and it looks something like S -1 -5 -21, and then it had a really long number.
169
period, and then a shorter number, a thing called a domain SID and a RID.
170
We'll be doing this in other modules when we take a look at security
171
and how it differs in Azure versus on -premises.
172
But you had this token that at the time you logged in, you got this token and you would walk around and present it to resources and saying, hey, I've been proven that this is who I am.
173
Can I gain access to a resource?
174
And it would check that list against a thing called an ACL or access control list and it would grant you access.
175
But here's the potential problem with this.
176
If you log on, that token is going to be valid for you for that period of time.
177
And so it could be hours or even days that you have the same permissions.
178
What happens if I needed access to a resource and I called up help desk and asked them, hey, I can't access the resource and said, great, I'll put you in a group that's going to give you access to it.
179
Until you log out and log back in, that token won't automatically refresh.
180
So these are some of the limitations around the Kerberos and NTLM world.
181
When we move to EntraID, every single time that you're working with this as a cloud resource, if I now deprecate a permission or take something away from you,
182
I don't have to have you log out and log back in to have that take place.
183
As you now try and access a resource and it's been taken away from you, you are no longer going to have access to that information.
184
Now, we talked about being able to potentially tie these two together, and you'll see this coming up,
185
that we have the capability of tying the directory services of Active Directory domain services together with Azure and its EntraID.
186
So that this list of users that I have, the group memberships that they've got,
187
to make this simpler, what I have is a sync service that would allow me to communicate and synchronize these two directories.
188
Now, I'm not going to get into all the details in the class where you're going to be able to do this.
189
Again, it's done in other modules.
190
But we can now set up this sync service one of two ways.
191
We do talk about it in here, and we'll show that to you.
192
You can actually set up a sync server where you'll download some software from Azure.
193
You'll install that sync service on that server, and it will then provide the communication between EntraID and your on -premises domain controllers.
194
We now have a new sync service, which is a cloud -hosted service, so you don't have to have the infrastructure, patch it, maintain it, secure it, all that stuff.
195
So this ability to now synchronize information through this capability is available for you
196
so that if you create new users or deprecate users on -premises, they'll be then added or deprecated as needed.
197
inside of Azure and vice versa.
198
We also provide for password resetting, a whole bunch of other services, but we're going to cover all these as we get back into the course material,
199
and I'll be demonstrating those for you as we get into the demonstration itself.
200
So you understand the landscape. So now
201
that you've seen the overall architecture of how identity is going
202
to be managed both in the legacy environment of on -premises and this new world inside of Azure, we understand that there's some several components
203
and we're going to go back to the slides we'll take a look at it
204
and then I'm going to go to the actual portal and show you where some of these features are.
205
Okay
206
so we're back in the course material I'll be in the
207
portal in just a few minutes where we're actually going to show you all these concepts
208
but you're seeing things like you've got your tenant you've got
209
your tenant ID you've got your directories hopefully this all makes a bit more sense now.
210
Now when we get to a governance module or recording a different recording set than we're going to do today,
211
we're going to be able to see these things like management groups and subscriptions, which are ways to organize your tenant to be able to
212
have an organizational structure as well as a billing construct using subscriptions.
213
So all of these are the concepts that we were just talking about.
214
If you're following along in the course materials, you're seeing that the difference between the Active Directory Domain Services or ADDS and Microsoft Enter ID.
215
I covered all of this for you in the course material.
216
You can now catch up and read some more details in there.
217
I talked about a bunch of stuff that's not in the course material.
218
That's why you might want to watch some of these recordings.
219
I'm going to give you some stuff.
220
And there's a few things that are in the recordings that I haven't covered.
221
There may be some numbers that you'll talk about sizes or the times that it might take.
222
Now it becomes one of those eye -winking moments
223
that I talked about in the introduction
224
that you might want to take a look at the course material itself if you're ever going to write the exam.
225
I strongly recommend that you read the course material.
226
Look for numbers.
227
Look for things called default values.
228
Because when you take the exam, you might read a question going, well, gosh, there could be several answers that I have.
229
It could be this one or this one.
230
Well, given no other information, you have to assume the default values.
231
And when you look at that, wow, there's two ways to do this.
232
If you look at it from only a default position, only one of those answers is going to be feasible.
233
Yes, the other one might be possible, but it would take some labor for you to get in and do this.
234
Or maybe the question might say, with the minimum amount of administration, which one would you pick?
235
So these are pro tips that I'm going to be mentioning throughout the course.
236
Look for default values.
237
Look for comparative charts that might be the basis of question.
238
Again, I don't know what the question is, but look for that information, and I strongly recommend you read the course material.
239
They're talking about some of the stuff we just mentioned.
240
The REST APIs versus an HTTP and an HTTPS.
241
One is the way I access Azure through the HTTP and HTTPS, and a feature called LDAP,
242
which is how you communicate with the Active Directory Domain Services.
243
There's those terms I've talked about of OpenID,
244
WSFED, OAuth, OData, where those new technologies that we're working with versus the Kerberos and NTLM components that are available for us.
245
Now, there's a feature that came with the on -premises stuff called GPOs or Group Policy Objects.
246
These were ways to provide for administration of users and devices to control their configuration.
247
We don't have that capability inside of Azure, but we have other services that are going to provide a lot of
248
that administration and even more administration that you could have gotten through the GPOs themselves.
249
So again, just the difference between the on -premises world or your legacy environment.
250
and the modern world of Microsoft Entra.
251
Here's another eye -winking moment that you might want to pay attention to.
252
Any time I see information like this that is a chart that compares one feature versus another, you may want to remember that.
253
Now, don't memorize the entire chart.
254
What you're seeing is a lot of services are the same, whether they're the free service, whether they're on a P1 license, or a P2.
255
What I would pay attention to is what is missing.
256
That's the thing that I would say because, you know, I know that most of this stuff is going to be made available across all of them.
257
And now instead of having to try and memorize the entire chart, I only have to, in this case, remember a few things.
258
What is different between having a free versus having a P1 and a B2?
259
A number of questions that you might get is, what is the minimum license that you need to be able to get conditional access maybe?
260
And so you'd have to find something like conditional access.
261
What is the minimum license?
262
It's not available at free.
263
It's available in P1 and P2.
264
The minimum license would be a P1 in this case.
265
So just another example of kind of information you want to
266
take a look at to be able to prepare for the exam itself.
267
Now I'm going to do a demonstration in just a few minutes, and I want to call out a way to use AI.
268
We talk about AI infrastructure in a lot of different classes now and seeing how it's going to augment it.
269
And I'm going to show an example of, gosh, I'm looking at this information, and it's not in the course material,
270
but what's the difference between a Microsoft EntraSuite license that you get with the P2?
271
Now, does it mean that it's the same service between the P2 and the EntraSuite, or is there some additional features?
272
It doesn't talk about that here.
273
And what's this one down at the very bottom, the Advanced Identity Governance?
274
I'm going to show you a co -pilot, which is our AI service.
275
I'm going to ask it a question.
276
Say, hey, co -pilot, here's a picture.
277
What's the difference between an intro suite and the P2 licenses?
278
What are the features that it's not telling me that I get in one versus another?
279
So using AI is a great way to provide for expanding your learning.
280
You know about the licenses, but this is a way that's going to be able to
281
explore it to more of an operational use as you get into it.
282
Another service is a capability called the SSPR self -service password reset.
283
This has been around for a long period of time, and it really lightened the amount of administration that was needed for people to call up and actually have their password reset.
284
It's something you can do by yourself.
285
You'll notice that when we get to the portal, it's going to be identified as a deprecated service.
286
Now, it's not happening for a number of years, but it is potentially going away because while it's a good service, it provides some vulnerabilities from a security perspective.
287
What you have is the capability of signing licenses to individual users, and you can do that.
288
So I can assign some users that get a P1 license.
289
P2 is a bit more expensive.
290
Maybe not everybody needs all the features of a P2 license.
291
So I can selectively allocate where my licenses are being allocated to.
292
The self -service password reset can be assigned for none, all, or select groups of users.
293
So you can roll it out to specific users if you wanted to.
294
Now, you're probably used to this where there's some standard questions that you could ask people.
295
What was the name of your first pet?
296
What was your nickname in high school?
297
You've probably all seen those sample questions that if you could answer them, maybe one, two, or three, they might have multiples.
298
If you could answer them, it'll allow you to reset your password.
299
Well, social media and people's ability to put a lot of
300
that kind of stuff on the internet has made this kind of a weakness because now if you're actually answering those questions,
301
I could possibly go off and mine that information and potentially reset your password for you.
302
So it's one of the reasons to maybe think of a better way to provide for self -service password reset.
303
I'll give you a pro tip.
304
What I would do is answer the questions, as long as the service is available to me, and answer them incorrectly, though.
305
So don't actually pick what was the city that you were born in.
306
I put the city that my parents met in.
307
And from the city that my parents met in is the city I was born in.
308
So I've logically flipped things around.
309
So I'm not randomly just picking numbers because then I might not be able to remember it myself.
310
And so what was my nickname in high school?
311
It was my first pet's name and my first pet name was my name in high school.
312
So there's ways that you can still make this a secure service, but you need to educate yourself and your users to find a secure method
313
so that social engineering and social media can't be used to circumvent the capability of SSPR, but know that it is going away.
314
I'll show you that you also have the pre -built questions as well as some custom questions
315
that you could ask through this process.
316
But let's go over to the demonstration where I'm going to
317
show you these features in the portal as well as a couple others and then we'll close out the module.
318
So what I want to do is actually show you the Microsoft Learn content that we just covered.
319
I'm actually going to show you that pro tip
320
that I gave you for using Copilot to figure out what are the differences potentially between identities
321
or the licenses that we have for them.
322
And then I'm actually going to get into the Azure portal and show you the services that we talked about.
323
So starting off with the course content,
324
what you're seeing now is the learn content we gave you at that aka .ms forward slash course az -104.
325
We've drilled down into the Microsoft Identities and Governance Learning Path, and we're going to take a look at this one specifically, Understanding Microsoft Entry ID.
326
I'm not going to go through it in detail, but you can see a lot of that information about identities, what they are, what is Entry Tenants, what is the schema.
327
Again, we're going to cover some of this in another module specifically, but you can go through it.
328
It talks about the characteristics of ADDS, so you're going to follow along with that course content, and I strongly recommend that you do.
329
Now what I want to show you is that pro tip
330
that I talked about you're seeing I'm using the RAI Copilot
331
and I'm using the free version of this you have licensed versions
332
if you want to take a look at But I've taken the screen snippet of that
333
License that we talked about and the difference between the free the P1 the P2
334
and the Entra Suite You can see
335
that you know in this image What is the difference between the two P2 license versus the Entra Suite?
336
What do I get if there are check boxes in both?
337
And let's take a look at what it does.
338
So it's going to be able to take a look at
339
that image and it's going to come back and more than just the course material talking about what the differences are, it's actually going to give me some other recommendations.
340
So I really like this tool as a way to dive
341
deeper as opposed to just looking at maybe a limited amount of documentation.
342
And so it's talking about what we have, the difference between the ENTRE P2 license versus the ENTRE suite.
343
It talks about the P2 as the top tier.
344
Everything in the P2 is available in the ENTRE suite.
345
And then it's going to start talking about what you're going to get with the ENTRE suite as you're working with it.
346
And it talks about you get over top of identity protection, PIM, which is privileged identity management, lifecycle workflows.
347
I'm not going to get into all of these.
348
These are covered in other courses where we go into it much deeper.
349
But then it gives you some other features that you might want to come along with.
350
So great way to get in, advance your learning using some form of AI.
351
I'd recommend Copilot, but all of them should be able to assist you with this.
352
I'm now in the Azure portal
353
and we're going to be covering all of these services throughout the multiple modules that we're going to be recording.
354
But I'm going to come into the Microsoft Enter ID component
355
and you'll see down the left -hand side what we have is referred to as a blade.
356
So I'm in the Enter ID governance component, and I have a series of blades that I can work with that covers the individual users, the groups that we have.
357
We have external identities, a number of these we didn't cover, but I'm going to come down and take a look at a couple of these features along the way.
358
At the very bottom, we have the self -service password reset capability.
359
And what I have is the capabilities to have it on for none, all or selected groups of individuals.
360
Now there's some pieces that I've got masked out.
361
I've got a piece of software that masks secure information, so that's why you're not seeing it.
362
But if you were following along in your tenant, you would actually see your specific information.
363
And what I could now do is I can allocate to a specific set of user accounts and pick a group, or I can enable it for all.
364
I could then allocate this self -service password capability to a number of users.
365
I now can come in and take a look at the authentication methods.
366
And you're seeing there's that deprecation feature that March 2027, this is going to be a deprecated capability.
367
So until then, you're going to be able to do what it is we're taking a look at.
368
So I have the capability to ask from a base set of, in this case, up to five questions, how many questions do I want to ask the person?
369
Is it two, four, or five that you're working with?
370
So you can then select a set of questions that you have from a predefined pool.
371
We talked about that.
372
These are the ones that could be easily socially engineered, but I also have the capability of actually creating some custom questions
373
that might be less likely to be socially engineered and reverse engineered for breaching your security.
374
taking a look at a couple of other features along the
375
way you do have the capability to manage custom domains i'm going to cover this in a later module
376
so that maybe you have multiple domain names
377
that you've registered for your organization might you have several divisions
378
or different companies
379
that are amalgamated you don't need separate tenants technically you're going
380
to be able to put them together by having multiple domain names registered to this environment You have company branding
381
that can go along with this so that when you go to the website, it's going to be your logo in the background as opposed to some generic Microsoft image that you're working with.
382
Now I want to take a look at the user accounts themselves.
383
And we talked about different types of users.
384
Now in the past when I used to go around to customers, I would go up and they would usually meet me at the entrance
385
and I would go through some verification of who I was and show them my identity.
386
Usually have my Microsoft shirt on and they go, Great, Bob, here's an envelope and it would have my username and password that they created for me at that company.
387
Now I would typically, based around the role that I did, would only be in there for a couple of days.
388
I would go and fix the problem and I'd be gone.
389
I'd give them back that envelope, said, thanks very much.
390
Here you go.
391
Here's the username and password.
392
You may want to delete that.
393
They go, oh, no, keep it.
394
You may be coming back.
395
I'm going, I ain't coming back.
396
And the problem is, it's an attack surface.
397
You know and I've got a report that I have to fill out
398
that you know years ago I went to this customer
399
and they haven't deleted that account I can still log in with it
400
and I have to report that to Microsoft security
401
So these are attack surfaces you want to be you know very careful about of giving away Identities
402
and not managing them in the long term So some of the things
403
that we can do is we can create new users and you'll see this in the course material
404
You can create a user inside of your directory That is your responsibility to exist in your directory.
405
The authentication will come from there.
406
The other thing is you can invite in an external user.
407
Now, I'm going to be doing a demonstration where I have a personal, what we refer to as a Microsoft account.
408
That is something that ends in the at outlook .com, at live .com, at hotmail .com, or at msn .com.
409
So those four public domain names that Microsoft has emails that anybody can get an email for,
410
I could take a user from that environment or from another tenant inside of Azure.
411
I'm going to be doing an example of that as well.
412
My last name is Bob Tickleman.
413
So my last name is Tickleman.
414
I own the tickleman .com domain.
415
So I've got a set of user accounts inside of Azure
416
and an enter ID that is associated with my Bob at tickleman .com.
417
I could invite these users into my tenant here and now instead of having me manage them,
418
it's an external identity that now all I have to do is just break
419
that link and it's an identity managed by somebody else.
420
And going back to my Microsoft example, if I have an external Microsoft account for me that you're gonna invite into your tenant,
421
if I no longer work at Microsoft, they're gonna get rid of me from their tenant.
422
You don't have to worry about that identity now being breached in your environment because I can't authenticate against my Microsoft account, you are protected.
423
Now, the vice versa of this, if you had created an account for me inside of your tenant that you managed, I no longer work at Microsoft,
424
what stops me from showing up with my Microsoft shirt on and saying, I'm Bob from Microsoft, and use that account?
425
You don't know I don't work there anymore.
426
I'm now potentially being a threat actor inside of your environment.
427
So these are much more secure ways to manage it as opposed to having you create user accounts for all your users.
428
Not really part of the course.
429
Hopefully some additional information on what we recommend, what you do.
430
And so inside of this tenant that I have, I've got my tenant directory under Entra ID, and you can see that I've got a series of user accounts.
431
My Bob Tickleman, which is my R -O -B -T -I -C -H at Microsoft .com,
432
is a guest from an external Entra tenant that we already have.
433
So that's my Tickleman user account inside of Microsoft
434
that has been invited inside of this tenant and will actually be authenticated by that other tenant, Microsoft specifically.
435
I've got a number of other accounts in here.
436
I've got my TrainerBob, which is my rjbt at outlook .com, my personal account at the Microsoft public domain name for mail.
437
So I've invited these two users in as coming from this invited user coming into the tenant itself.
438
So it's being managed externally.
439
You can see those two different types.
440
Is it on -premises?
441
We can actually have those user accounts replicated, as we talked about, through the directory sync service.
442
You're hopefully seeing these different identities.
443
Now, speaking of the sync service, I'm going to come back to the Blade itself.
444
I'm going to take a look at Microsoft Connect.
445
And so you can see EntreConnect provides for that cloud sync service where you set it up in the cloud, and you're going to then connect using user accounts in your on -premises environment
446
that have the necessary permissions to read the data
447
that you need from your on -premises ADDS environment
448
and a user account that has the capability inside of Entra to be able to do this.
449
So you connect them through the sync service and it runs as a platform as a service inside of Azure.
450
I also have the capability of doing this connect sync
451
that allows me to now download the software where you're going to download that information, configure either a physical or virtual machine on premises.
452
that you would then do the very similar process of creating identities, both in the cloud and on -premises, that have the permissions in those both realms, and then be able to synchronize.
453
And you can select which accounts and how often they're going to replicate, what values are being replicated, so you can control all of that using that Connect service.
454
In addition to the users, I'm going to go back to this concept that I talked about, the group memberships.
455
Now, the groups, as I mentioned, is the recommended method to be able to manage the users themselves.
456
Try not to individually manage the users.
457
Put them in the group and give them the RBAC or the role -based access control of the group memberships.
458
And this can actually be a hierarchical structure.
459
I'm going to show an example of this.
460
So I'm going to use in my example, I'm going to have West users and East users.
461
I've got sales managers, I've got sales users in the West.
462
I've got sales managers and sales users in the East.
463
So I've got different groups now i've got an all west
464
and i've got an all east i've got an all sales group
465
which might be made up of its membership of all sales might be made up of all west sales users
466
and all e -sales users
467
that make up the all sales users i've maybe got an all managers group
468
because i've got a west sales managers i've got an east sales manager that's part of all sales managers
469
that might be part of an all managers group
470
that has also got managers from hr that you're working with
471
so So having this hierarchical structure provides for putting a user in a single group, and all of a sudden they're going to get membership across a wide variety.
472
And so you get this granular control that you're going to be able to work with.
473
Now we're going to take a look at the different types of group memberships of either dynamic or assigned.
474
So if you assign it, you specifically put something into a group or remove it from that group.
475
So you can put a user or a group into a group potentially and you can then remove them on an assignment.
476
If it is dynamically assigned, which only comes with certain licenses, based around a characteristic, and I'm going to use a job title and a location,
477
those two attributes are going to put a user into a group and then get this nesting capability you're working with.
478
So let's go take a look at that.
479
Under the group capability, you can create a new group, and we have the choice of having a security group or a Microsoft 365 group.
480
They are somewhat similar but are used differently.
481
If you're using Microsoft Exchange, our cloud -hosted mail service, what you have is probably a distribution list that you maybe had.
482
You had distribution lists based on a project, possibly.
483
So an M365 or Microsoft 365 group is a group for distribution through the mail system.
484
That's the only place it has.
485
It's not used for security.
486
A security group also can be used as a distribution list,
487
but it also has the added capability of being used for security to assign permissions and capabilities called roles.
488
So picking the type of group might limit where it could potentially be used.
489
Taking a look at the group name, we have a naming structure that you should follow.
490
Microsoft has a naming structure that we have listed on our website under our Azure documentation recommendations.
491
You'll see that in all the naming conventions that I'm going to use across these recordings.
492
Now you can get into the membership type.
493
It can be either assigned dynamic users or dynamic devices.
494
So you can even have devices that are part of this.
495
And it's going to show a feature called conditional access.
496
And you'll see that when we get to that recording on permissions that we covered, as I said, in another recording, because we're going to have personas,
497
because Bob, as a secure user in a secure location on a secure device,
498
is a completely different persona from a security perspective than Bob, as a secure user,
499
on an unsecured device in an unsecure location one might give
500
me access to something meeting all the conditions on a secure
501
device in a secure location versus Bob on an unsecured device in an unsecure location maybe not get access to
502
that information so you'll see that come through other recordings
503
so I can have devices users either dynamically
504
or specifically assigned now you'll see
505
that some of these will come with the different licenses some
506
of them on the free base free side you're not going
507
to be able to get some of the dynamic group assignments that we're working with.
508
I'm going to go back and take a look at a group that I already have.
509
And I'm going to show you that hierarchical structure that I was talking about.
510
So here's the example that I have from sales.
511
I've got an SGS security group for sales managers all.
512
I'm going to go take a look at this group, and I can take a look at its members.
513
And you can add, it has the sales managers East and the sales managers West.
514
They are groups that have been assigned to this sales manager or all sales managers group that you're working with.
515
Now, I'm going to go into the sales managers West and take a look at its members.
516
And you can see that it's actually got a user in here specifically.
517
and it's a member, but it was dynamically assigned
518
because I'm going to get into the group name and I take a look at its membership rules, so the dynamic membership rules for being a member of this group.
519
And you can see that I've built the rule that based on a job title, a sales manager, and an attribute of west for a location,
520
those two attributes together, looked at the directory structure, I built a user, it saw that user with those attributes, it now dynamically put them into that group.
521
I take that attribute away.
522
They're no longer made in that group.
523
They no longer have that nesting structure that you're working with.
524
So there's a brief introduction about the capabilities of managing identities inside of the Azure environment.
525
We looked at the major characteristics of what you're getting with a Microsoft Entra ID.
526
You get the capabilities of OpenID,
527
OAuth, OData, and WSFed as technologies as the foundation compared to those legacies technologies of Kerberos and NTLM.
528
We've provided synchronization capabilities to your on -premises, to the cloud, to provide for a homogeneous hybrid world for identities.
529
We saw that we had all these great capabilities of self -service password reset
530
that were very hard to manage in the past in the on -premises world.
531
And we have this growing capability as we take Microsoft Enter ID forward into the verified ID world, which is a whole new world If you want to do some deeper dive,
532
I may be doing a recording on that at another time.
533
So EnterID, the foundation for identity management.
534
It is a feature inside of your tenant as an identity governance plan for you to work with.
535
Thanks for joining us for this session.
536
To continue your learning, watch other videos in the course or explore more on Microsoft Learn at aka .ms forward slash learn.
537
Thank you.
Download App
Everything you need to speak fluently
AI PronunciationScore every sentence
IPA PracticeMaster every sound
VocabularyBuild your word bank
Vocab GameLearn while playing
📺 Same Channel
B21
Configure storage accounts | AZ-104 | Episode 16
Daily ConversationUniversity StudentsWorking Adults
C11
Course Preview | SC-100 | Microsoft Cybersecurity Architect
Daily ConversationWorking Adults
B22
Course Introduction | AZ-104 | Episode 1
Daily ConversationWorking Adults
C12
Course Preview | AZ-104 | Azure Administrator Associate
Business EnglishUniversity StudentsWorking Adults
C1Course Preview | AI-103 | Develop AI apps and agents on Azure
Business EnglishUniversity StudentsWorking Adults
✨ Recommend Video
C11
176 sentences
Every Networking Concept Explained | Networking 101 (2026)
Daily ConversationUniversity StudentsWorking Adults
C11
418 sentences
Advanced English Dialogues - British Restaurants & UK Dining Experiences - Real Everyday English
Travel EnglishDaily ConversationUniversity Students
C11
180 sentences
Armchair Architects: Resiliency in the Cloud – Core Patterns
Daily ConversationUniversity StudentsWorking Adults
C13
218 sentences
Learn English From The News - Google, Elon Musk's SpaceX Discuss Launching Data Centers Into Orbit
Business EnglishDaily ConversationUniversity Students
B21
398 sentences
THIS Is Where the Internet Lives
Daily ConversationUniversity StudentsWorking Adults
C11
177 sentences
Mini Project - Implementing a Simple Web Identity Federation Application
Daily ConversationWorking Adults
C11
114 sentences
BAS Bootcamp: Day 6 Setting up IO Internally
Daily ConversationWorking Adults
C11
423 sentences
Free CCNA | VLANs (Part 2) | Day 17 | CCNA 200-301 Complete Course
Daily ConversationUniversity StudentsWorking Adults
C11
43 sentences
What is an Organization? - the Nature of Organizations
Business EnglishUniversity StudentsWorking Adults
B21
384 sentences
E1: Who Am I? _ Master Your Personal Introduction in English! (B1-B2) level
Business EnglishInterview EnglishDaily Conversation
Vocabulary and speaking notes for this lesson
This video has 537 sentences and 7994 words to shadow. The speech runs for 42:20. The speaker talks fast, about 189 words per minute, so expect linked and reduced sounds. 82% of the words are among the 3,000 most common in English; the rest is worth studying before you start.
Key vocabulary in this video
15 words from the video worth learning, with pronunciation and meaning:
| Word | Pronunciation | Meaning |
|---|---|---|
| tenant noun | /ˈtɛ.nənt/ | One who holds a lease (a tenancy). |
| capability noun | /ˌkeɪ.pəˈbɪl.ɪ.ti/ | The power or ability to generate an outcome. |
| directory noun | /dɪˈɹɛktəɹi/ | A list of names, addresses etc, of specific classes of people or organizations, often in alphabetical order or in some classification. |
| premise noun | /ˈpɹɛm.ɪs/ | A proposition antecedently supposed or proved; something previously stated or assumed as the basis of further argument; a condition; a supposition. |
| domain noun | /ˌdəʊˈmeɪ̯n/ | A geographic area owned or controlled by a single person or organization. |
| password noun | /ˈpæs.wɜɹd/ | A word relayed to a person to gain admittance to a place or to gain access to information. |
| legacy noun | /ˈlɛɡəsi/ | Money or property bequeathed to someone in a will. |
| module noun | /ˈmɑd͡ʒul/ | A self-contained component of a system, often interchangeable, which has a well-defined interface to the other components. |
| cloud noun | /ˈklaʊ̯d/ | A visible mass of water droplets suspended in the air. |
| governance noun | /ˈɡʌvəɹnəns/ | The process, or the power, of governing; government or administration. |
| assign verb | /əˈsaɪn/ | To designate or set apart (something) for some purpose. |
| principle noun | /ˈpɹɪn.sɪ.pəl/ | A fundamental assumption, fundamental law or guiding belief. |
| component noun | /kəmˈpoʊ.nənt/ | A smaller, self-contained part of a larger entity. Often refers to a manufactured object that is part of a larger device. |
| versus | /ˈvɝsəs/ | Against; in opposition to. |
| sync noun | /sɪŋk/ | Harmony. |
Phrasal verbs you will hear
| Word | Pronunciation | Meaning |
|---|---|---|
| go back to verb | To stem from; to originate in. | |
| come back verb | To return to a place. | |
| go through verb | To travel from one end of something to the other. | |
| call up verb | To retrieve from personal or computer memory. | |
| go away verb | To depart or leave a place. | |
| log out verb | To exit a user account in a computer system, so that one is not recognized until signing in again. | |
| set up verb | /ˌsɛt ˈʌp/ | To make ready for use. |
| call out verb | To specify, especially in detail. |
Grammar in this video
The structures the speaker uses most, with the exact words from the video:
| Structure | In the video |
|---|---|
| Conditional sentences if + clause, will/would + verb — a condition and its result | If you could answer them, it'll allow |
| “Used to” used to + verb — a past habit or state that is no longer true | used to have · used to be · used to go |
| Present perfect have/has + past participle — a past action that still matters now | has evolved · has changed · has served |
| Passive voice be + past participle — the focus is on what happens, not who does it | was built · being authenticated · was based |
Pronunciation to watch
The speaker uses 245 contractions and reduced forms, such as I'm, you're, we're. Say them the short way, as you hear them.
- The “th” sounds: authorization /ˌɔːθəɹaɪˈzeɪʃən/, authenticate /ɔˈθɛn.tɪ.keɪt/, authentication /ɔːˌθɛntɪˈkeɪʃn̩/
- The “sh” and “zh” sounds: potentially /pəˈtɛnʃ(ə)li/, demonstration /dɛmənˈstɹeɪʃən/, authorization /ˌɔːθəɹaɪˈzeɪʃən/, examination /ɪɡˌzæm.ɪˈneɪ.ʃən/, recommendation /ˌɹɛkəmɛnˈdeɪʃən/
- Long words — get the stress right: capability /ˌkeɪ.pəˈbɪl.ɪ.ti/, directory /dɪˈɹɛktəɹi/, potentially /pəˈtɛnʃ(ə)li/, demonstration /dɛmənˈstɹeɪʃən/, authorization /ˌɔːθəɹaɪˈzeɪʃən/
How to practise with this video
- Listen to the whole video once without speaking and note the words you do not know.
- Start at 0.75× speed, shadow it sentence by sentence, then go back to normal speed once it feels easy.
- Record yourself and compare with the original, paying attention to words like tenant, capability, directory.
What is the Shadowing Technique?
Shadowing is a science-backed language learning technique originally developed for professional interpreter training and popularized by polyglot Dr. Alexander Arguelles. The method is simple but powerful: you listen to native English audio and immediately repeat it out loud — like a shadow following the speaker with just a 1–2 second delay. Unlike passive listening or grammar drills, shadowing forces your brain and mouth muscles to simultaneously process and reproduce real speech patterns. Research shows it significantly improves pronunciation accuracy, intonation, rhythm, connected speech, listening comprehension, and speaking fluency — making it one of the most effective methods for IELTS Speaking preparation and real-world English communication.