3.2.1. Users and Groups
💡 First Principle: A user object is identity plus attributes; a group is a reusable set defined either by enumeration (assigned) or by predicate (dynamic). Choosing the right group type and membership type is an access-design decision, not clerical work — it determines what the group can be used for.
Users: member vs guest (userType attribute — a guest promoted to member keeps external credentials; the attribute is about treatment, not authentication). Creation via portal, CSV bulk, or Graph/PowerShell; attributes (department, jobTitle, usageLocation, manager) feed dynamic rules, licensing, and governance. Deletion is soft for 30 days (restorable with everything intact), then permanent.
Groups, the matrix to memorize:
| Security group | Microsoft 365 group | |
|---|---|---|
| Purpose | Access control: roles, apps, CA, licenses | Collaboration: mailbox, SharePoint, Teams |
| Membership types | Assigned, dynamic user, dynamic device | Assigned, dynamic user |
| Can hold devices | ✅ | ❌ |
| Role-assignable capable | ✅ (with flag) | ❌ |
| Guests as members | ✅ | ✅ (common) |
Dynamic membership rules are attribute predicates — (user.department -eq "Sales") -and (user.country -eq "US") or (device.deviceOSType -eq "Windows") — validated in the portal with a rule-checker; a group is dynamic or assigned, never both, and switching types recalculates membership. Role-assignable groups (isAssignableToRole = true, set at creation only, max 500 per tenant) may receive Entra roles; they're locked down — only Privileged Role Admins+ manage them, membership can't be dynamic, and owners can't quietly add members to inherit the role. Ownership is quiet power everywhere: owners manage membership, and membership may carry roles, apps, and licenses — audit owners like admins.
⚠️ Exam Trap: A group must be created role-assignable — you cannot flip an existing group's isAssignableToRole later. Stems where "assign a role to an existing dynamic group" fail twice: not role-assignable, and dynamic membership is banned for role-assignable groups.
Reflection Question: Why does Microsoft prohibit dynamic membership on role-assignable groups — which attack path does that ban close?
