1.2.2. Identity Objects: Users, Groups, Devices, and Applications
💡 First Principle: Anything that must be authenticated or authorized needs its own directory object — humans, machines, and software alike. If it can request access, it must have an identity; otherwise there is nothing to verify and nothing to attach policy to.
Four object families cover the whole exam. Users are humans: members (your organization's own accounts) or guests (pointers to identities homed in another tenant or identity provider). Groups collect identities so you can assign access, licenses, and policies at scale instead of per-person. Devices represent laptops, phones, and desktops that have registered with or joined the tenant, giving Conditional Access a device signal to evaluate. Applications get identities too — a topic so exam-heavy it owns all of Phase 4 — because software calling an API must prove itself exactly like a person must.
Every object carries a unique object ID and attributes (department, job title, usage location) that later drive dynamic group membership, licensing, and governance rules. Notice the pattern that repeats all through Entra: identity plus attributes in, access decisions out.
The umbrella term worth internalizing is security principal — any object that can be authenticated and granted permissions. A user is a principal; so is a device, a group being granted a role, or an application's service principal. When documentation says "assign the role to a principal," it deliberately doesn't care whether that principal breathes.
⚠️ Exam Trap: A guest user object in your tenant is not a credential store — the guest authenticates against their home tenant or identity provider, and your tenant only records the pointer plus your policies about it. Questions about "resetting a guest's password" are testing whether you know their password isn't yours to reset.
Reflection Question: A nightly batch job reads a SharePoint site. Why does giving it a service account identity (rather than borrowing an employee's account) improve both security and accountability?
