As an Azure Administrator preparing for the AZ-104 exam, one of the essential aspects to understand is how to manage guest accounts in your Azure Active Directory (Azure AD). These accounts serve as a way to grant external users access to your organization’s resources. In this article, we will delve into the process of managing these guest accounts, including creating, inviting, and assigning roles to guests.
Creating Guest Users in Azure Active Directory (Azure AD)
Azure AD provides an easy to use interface for creating and managing guest accounts. Here is a step-by-step tutorial:
- Sign in to the Azure portal as a global administrator or user administrator.
- Select Azure Active Directory, then select Users.
- Click on the New guest user.
- In the User panel, fill in the guest user’s information. As a minimum, you must provide the guest’s email address and name.
- Click on the Invite button. An invitation email will be sent to the guest user, which they can use to access your Azure resources.
Here’s an illustration:
| Azure Active Directory | Guest User |
|---|---|
| Email Address | guest@example.com |
| Name | Guest User |
| Job Title (Optional) | Consultant |
| Department (Optional) | External |
Assigning Roles to Guest Users
In Azure AD, permissions are bundled into roles that you can assign to users, including guest users. Here are the steps:
- Select Azure Active Directory.
- In the Azure Active Directory panel, select Users.
- Choose a guest user and click on Assigned roles.
- Click on Add assignments.
- In the Add role panel, select the role you want to assign to the guest user, then click Add.
Note: The above steps assume you have the required Administrator role (User Administrator or higher) in Azure Active Directory.
Working with Azure RBAC roles
Azure Role-Based Access Control (RBAC) is an authorization system built on Azure that provides fine-grained control over what users can do. To assign a role to a guest user at a resource scope:
- Navigate to the resource in the Azure portal.
- Select Access control (IAM).
- Click Add -> Add role assignment.
- In the Role dropdown, select a role such as Reader, Contributor, or another custom role.
- In the Select dropdown, choose the guest user’s account.
- Click Save.
Examples of some common roles:
| Role | Permissions |
|---|---|
| Owner | Has full access to all resources including the right to delegate access to others |
| Contributor | Can create and manage all types of Azure resources but can’t grant access to others |
| Reader | Can view existing Azure resources |
Remember, managing guest accounts efficiently is a fundamental part of being a successful Azure Administrator. Familiarity with these steps will also prove advantageous during your AZ-104 Microsoft Azure Administrator Exam preparation. Make sure you understand these concepts and implement them into your Azure environment for practical knowledge.
Practice Test
True or False: Azure Active Directory allows you to manage guest accounts.
- True
- False
Answer: True
Explanation: Azure Active Directory supports external collaboration with guest accounts. You can invite guests and external partners to collaborate on your corporate resources.
What access do guest users in Azure Active Directory have?
- a. Full access to all resources
- b. Limited permissions
- c. No access at all
- d. Only access to email services
Answer: b. Limited permissions
Explanation: Guest users have more restricted permissions than members, such as creating app registrations, or discovering other users.
True or False: Guests and external users can be added to any type of group in Azure Active Directory.
- True
- False
Answer: True
Explanation: Guests and external users can indeed be added to any type of group (Office 365 groups, security groups, etc.) in Azure Active Directory.
Does Azure Active Directory support multi-factor authentication for guest accounts?
- a. Yes
- b. No
Answer: a. Yes
Explanation: Azure Active Directory (Azure AD) B2B collaboration supports multi-factor authentication for B2B guest users.
Azure AD only allows to invite guest users from outside organizations to collaborate with you.
- a. True
- b. False
Answer: b. False
Explanation: In Azure AD, you can invite users not only from external organizations but you can also invite personal accounts (e.g., Outlook, Gmail.) as per your policy requirement.
Which of the following can a guest user not do in Azure AD?
- a. View the directory
- b. Enumerate users, groups or other directory resources
- c. Access resources for which they have been specifically granted permission
- d. Access SharePoint Online and OneDrive for Business
Answer: b. Enumerate users, groups or other directory resources
Explanation: Guest users cannot enumerate users, groups or other directory resources, providing enhanced security and privacy for the host organization.
How can a guest user’s access be revoked in Azure Active Directory?
- a. Deleting their account
- b. Disabling their account
- c. Both a and b
- d. None of these
Answer: c. Both a and b
Explanation: Azure AD allows you to either disable or delete the guest user’s account to revoke their access.
True or False: Guest users in Azure AD cannot be assigned a role.
- True
- False
Answer: False
Explanation: Guest users in Azure AD can indeed be assigned a role. This allows organizations to manage what resources a guest user can access and the actions they can perform.
Guest users get a user principal name (UPN) in your directory. Is this statement true or false?
- True
- False
Answer: True
Explanation: Once the guest user accepts the invitation, they are represented user object in your directory, with a user principal name (UPN) in your directory.
Which attribute identifies a user as a guest in Azure AD?
- a. userType
- b. userStatus
- c. userRole
- d. userGroup
Answer: a. userType
Explanation: The userType attribute for guest users is set to ‘Guest’. This is used to identify them as guests in Azure AD.
Interview Questions
What is a guest account in Azure?
A Guest account in Azure is typically an external user with no license and specific privileges that can be invited to collaborate with your organization’s resources.
How can one add a guest user to the Azure Active Directory (Azure AD)?
You can add a guest user to the Azure AD via the Azure portal. You navigate to Azure Active Directory, select Users, and then select New guest user.
Can we Assign a role to a guest user in Azure Active Directory (Azure AD)?
Yes, we can assign a role to a guest user in Azure AD. This can be done from the Azure portal after inviting the guest user.
Can a guest user create or own resources in Azure?
No, a guest user can’t create or own resources in Azure. They can only access resources on which they’ve been granted permissions.
What permissions does an Azure guest account have by default?
By default, an Azure guest account has no permissions. The access has to be granted specifically by the Administrator.
How can you restrict a guest account in Azure from accessing certain resources?
An Azure Administrator can restrict a guest account from accessing certain resources by not granting them permissions on those resources or by modifying role-based access control (RBAC) policies for those resources.
Can you remove a guest user account from Azure AD?
Yes, you can. In the Azure portal, you just navigate to Azure Active Directory > Users, select the guest user in question, and then delete the account.
What is the purpose of Azure AD B2B collaboration?
Azure AD B2B collaboration allows organizations to securely share applications and services with their guest users and partners while maintaining control over their own corporate data.
What happens if a Guest account user leaves the organization?
If a guest user leaves the organization, the Azure AD will keep their information but they will not have any access to the resources unless a renewal invitation is received.
Can we enable Multi-Factor Authentication (MFA) for a guest user in Azure AD?
Yes, you can enable MFA for a guest user in Azure AD. This enhances the security of the guest user account.
How many guest users can we add to Azure AD by default?
By default, you can add up to five guest users to Azure AD for each license in your tenant.
What is Conditional Access in Azure AD and can it be implemented for a guest account?
Conditional Access is a capability of Azure AD that allows for more granular control over how users access applications. Yes, it can be implemented for a guest account.
Can you convert a member user to a guest user in Azure AD?
No, you cannot convert a member user to a guest user in Azure AD. The user would need to be deleted and then reinvited as a guest.
Can you apply Azure policies to the guest user accounts?
Yes, you can apply Azure policies to guest user accounts just like any other user account, to enforce rules and effects over your resources.
What happens if a user is invited as a guest to Azure AD and the invitation is not accepted?
If a guest user’s invitation is not accepted, the user will remain in a ‘invited’ state and will not have any access to resources in the Azure AD.
extutorials.com