AZ-104T00A

Microsoft
Azure Administrator

© Copyright Microsoft Corporation. All rights reserved.

Julio Alcalde - MCT

© Copyright Microsoft Corporation. All rights reserved.

About this course: Prerequisites
Successful Azure Administrators start this role with experience on operating systems, virtualization,
cloud infrastructure, storage structures, and networking

Understanding of on-premises virtualization technologies, including: VMs, virtual networking, and

virtual hard disks

Understanding of network configuration, including TCP/IP, Domain Name System (DNS), virtual private
networks (VPNs), firewalls, and encryption technologies

Understanding of Active Directory concepts, such as users, groups, and role-based access control

Understanding of resilience and disaster recovery, including backup and restore operations

© Copyright Microsoft Corporation. All rights reserved.

About this course: Course Outline

Module 01: Identity Module 07: Azure Storage

Module 02: Governance and Compliance Module 08: Azure Virtual Machines

Module 03: Azure Administration Module 09: Serverless Computing

Module 04: Virtual Networking Module 10: Data Protection

Module 05: Intersite Connectivity Module 11: Monitoring

Module 06: Network Traffic Management

© Copyright Microsoft Corporation. All rights reserved.

Hands-on Labs

You will use a Microsoft Learning Azure Pass to provide access to Microsoft Azure

Check the dollar balance of you Azure Pass within Microsoft Azure once you have set up your
subscription

Be aware of how much you are consuming and do not allow Microsoft Azure components to
run overnight or for extended periods

Lab instructions are in a GitHub repository. 

Each lab creates a new resource group. To minimize costs, remove the resource group at the
end of the lab

© Copyright Microsoft Corporation. All rights reserved.

Module Overview

Lesson 01: Azure Active Directory

Lesson 02: Users and Groups

Lesson 03: Module 01 Lab

© Copyright Microsoft Corporation. All rights reserved.

AZ-104T00A
Module 01: Identity

© Copyright Microsoft Corporation. All rights reserved.

Lesson 01: Azure Active Directory

© Copyright Microsoft Corporation. All rights reserved.

 Azure Active Directory

Azure AD Concepts

AD DS vs. Azure Active Directory

Azure Active
Directory Azure Active Directory Editions
Overview
Azure AD Join

Self-Service Password Reset

Review
© Copyright Microsoft Corporation. All rights reserved.
Azure Active Directory

A cloud-based suite of
identity management
capabilities that enables you
to securely manage access to
Azure services and resources
for your users

Provides application
management, authentication,
device management, and
hybrid identity

© Copyright Microsoft Corporation. All rights reserved.

Azure AD Concepts
Concept Description

Identity An object that can be authenticated

Account An identity that has data associated with it

Azure AD account An identity created through Azure AD or another Microsoft cloud service

A dedicated and trusted instance of Azure AD, a Tenant is automatically created when
your organization signs up for a Microsoft cloud service subscription​
 ​
Azure AD • Additional instances of Azure AD can be created​
tenant/directory • Azure AD is the underlying product providing the identity service​
• The term Tenant means a single instance of Azure AD representing a single
organization​
• The terms Tenant and Directory are often used interchangeably​

Azure subscription Used to pay for Azure cloud services

© Copyright Microsoft Corporation. All rights reserved.
AD DS vs Azure Active Directory

Azure AD is primarily an identity solution, and designed for HTTP and HTTPS communications

Queried using the REST API over HTTP and HTTPS. Instead of LDAP

Uses HTTP and HTTPS protocols such as SAML, WS-Federation, and OpenID Connect for
authentication (and OAuth for authorization). Instead of Kerberos

Includes federation services, and many third-party services (such as Facebook)

Azure AD users and groups are created in a flat structure, and there are no Organizational
Units (OUs) or Group Policy Objects (GPOs)
© Copyright Microsoft Corporation. All rights reserved.
Azure Active Directory Editions
Feature Free Microsoft 365 Apps Premium P1 Premium P2
Directory Objects 500,000 objects No object limit No object limit No object limit
Single Sign-On Unlimited Unlimited Unlimited Unlimited
Core Identity and Access X X X X
B2B Collaboration X X X X

Identity & Access for O365 X X X

Premium Features X X
Hybrid Identities X X
Advanced Group Access X X
Conditional Access X X
Identity Protection X
Identity Governance X
© Copyright Microsoft Corporation. All rights reserved.
Azure AD Join

Single-Sign-On to your Enterprise state

Azure managed SaaS roaming of user settings
apps and services across joined devices

Access to Microsoft
Windows Hello support
Store for Business 

Restriction of access
Seamless access to
to apps from only
on-premises resources 
compliant devices

© Copyright Microsoft Corporation. All rights reserved.

Self-Service Password Reset

1. Determine who can use self-service

password reset
1
2
3

2. Choose the number of authentication

methods required and the methods
available (email, phone, questions)

3. You can require users to register for

SSPR (same process as MFA)

© Copyright Microsoft Corporation. All rights reserved.

Lesson 02: Users and groups

© Copyright Microsoft Corporation. All rights reserved.

 User Accounts

Managing User Accounts

Bulk User Accounts

Users and
Groups Group Accounts
Overview
Managing Multiple Directories

Demonstration – Users and Groups

Review
© Copyright Microsoft Corporation. All rights reserved.
User Accounts

All users must The account is used for Each user account has additional
have an account authentication and authorization properties

© Copyright Microsoft Corporation. All rights reserved.

Managing User Accounts

Must be Global
User profile Deleted users Sign in and audit
Administrator or User
(picture, job, contact can be restored log information
Administrator to
info) is optional for 30 days is available
manage users
© Copyright Microsoft Corporation. All rights reserved.
Bulk User Accounts

Create the comma-separated Must be signed in as a Global

Azure AD supports bulk user
values (CSV) template you administrator or User
create, delete, and list
can download from the Portal administrator

© Copyright Microsoft Corporation. All rights reserved.

Group Accounts

Group Types Assignment Types

• Security groups • Assigned
• Microsoft 365 groups • Dynamic User
• Dynamic Device (Security groups only)
© Copyright Microsoft Corporation. All rights reserved.
Users and Groups - Review

Knowledge Check Microsoft Learn Modules (docs.microsoft.com/Learn)

Create Azure users and groups in Azure Active Directory

Manage users and groups in Azure Active Directory

© Copyright Microsoft Corporation. All rights reserved.

Lab 01 – Manage Azure Active Directory identities

Lab scenario
In order to allow Contoso users to authenticate by using Azure AD, you have been tasked with
provisioning users and group accounts. Membership of the groups should be updated automatically
based on the user job titles. You also need to create a test Azure AD tenant with a test user account
and grant that account limited permissions to resources in the Contoso Azure subscription.

Objectives

Task 1: Task 2: Task 3: Task 4:

Create and configure Create Azure AD Create an Azure Manage Azure AD
Azure AD users groups with assigned Active Directory (AD) guest users
and dynamic tenant
membership

Next slide for an architecture diagram

© Copyright Microsoft Corporation. All rights reserved.
Lab 01 – Architecture diagram
Task 1, Task 2 Task 3

Default Azure AD tenant

IT Cloud Administrators IT System Administrators
Membership type: Dynamic User Membership type: Dynamic User New Azure AD tenant
Contoso Lab
Cloud user Cloud user

az104-01a-aaduser1 az104-01a-aaduser2 Cloud user

Role: User administrator Job title: System Administrator az104-01b-aaduser1
Job title: Cloud Administrator Department: IT
Department: IT
Job title: System Administrator
Department: IT
IT Lab Administrators
Membership type: Assigned

Task 4 Guest user

az104-01b-aaduser1

Job title: Lab Administrator

Department: IT

© Copyright Microsoft Corporation. All rights reserved.