3. Implement and manage user identities (20–25%)

Everything Phase 2 protected, this phase creates and organizes. Here you configure the tenant itself (roles, administrative units, domains, settings), populate it with users, groups, devices, and licenses, open controlled doors to external collaborators, and plumb the hybrid pipeline that keeps on-premises Active Directory and Entra ID synchronized. The through-line is least-privilege stewardship: every question asks, in some costume, who should be able to manage what, and how do objects get here reliably?