# SC-300 - Lab 1 - 5 visit [microsoft learn github](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Users/appId/8a4ff89a-5105-446c-8a2b-e24799cc34cc/objectId/47dca9c4-5216-4d51-8577-9c49c1e32703) for complete instructions # Lab 01: Manage user roles Your company recently hired a new employee who will perform duties as an application administrator. You must create a new user and assign the appropriate role. ## Exercise 1 - Create a new user and test their application admin rights #### Task 1 - Add a new user 1. After creating a user (Chris Green) on entra, search on azure portal or entra and select **Enterprise applications** in the search dialog at the top of the screen. 2. Select on **\+ New application**. Notice that **\+ Create your own application** is unavailable. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742336924888/e1664167-ca76-4fec-b26f-161d24bb9289.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742337161782/a8153609-f573-4387-94c3-081f49c778de.png align="center") 3. Try Selecting on some of the other settings like **Application Proxy**, **User settings**, and others to see that **Chris Green** does not have rights. ## Exercise 2 - Assign the application admin role and create an app 1. Assign the application admin role and create an app using Chris Green ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742338122817/9dd4693a-e5ff-4532-9ef8-0a1b52c5588c.png align="center") **Note** - If the lab environment has already activated Microsoft Entra ID Premium P2, Privileged Identity Management (PIM) will be enabled and you wll need to select **Next** and assign a Permanent role to this user. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742338633712/7403f73b-bbc2-424f-97c6-9b6e70ad7e1a.png align="center") View the **"**\+ Create your own application\*\* is not grayed out. If you pick a gallery app, you will see the **Create** button is available. **Note - This role now has the ability to add applications to the tenant. We will experiment more with this feature in later labs.** ## Exercise 3 - Remove the application administrator from Chris Green ## **Exercise 4 - Bulk import of users** ### **A: Using csv** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742491889665/6a88a020-7030-43b1-b4a9-5a2759e5dd37.png align="center") ### **B: Using PowerShell** **Microsoft Entra ID (formerly Azure AD) does not have a dedicated PowerShell module** but is managed using **Microsoft Graph PowerShell** (Microsoft.Graph) and **Azure PowerShell** (Az module). Here’s how you can interact with Entra ID using PowerShell: **Open PowerShell as Administrator** and ensure **PowerShell version 7.2 or higher** is installed. If needed, download and install the latest version. **Install Microsoft.Graph Module** if not already installed and then confirm if its already installed: ```powershell Install-Module Microsoft.Graph Get-InstalledModule Microsoft.Graph ``` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742492990682/9e5aa3d0-06c8-48d7-9754-d2ca9ad39918.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742493641222/2419badc-4c70-49e4-a82c-7c8c5b0479be.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742494367676/d7880ab0-2ec4-409f-880b-e9dcc094d3f8.png align="center") **Login to Azure AD** using: ```powershell Connect-MgGraph -Scopes "User.ReadWrite.All" ``` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742494478348/b6a4c67f-66d0-4b47-89bf-9ae1d1aef569.png align="center") * Sign in via the Edge browser and accept permissions. **Verify Connection & View Users**: ```powershell Get-MgUser ``` * **Set a Temporary Password for all New Users**: ```powershell powershellCopyEdit$PWProfile = @{ Password = ""; ForceChangePasswordNextSignIn = $false } ``` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742494964153/4a7d538a-878f-45f9-978e-fbd629ac262f.png align="center") * **Create a New User(If you have more than one user to add, you can use a notepad txt file to add the user information and copy/paste into PowerShell.)**: ```powershell powershellCopyEditNew-MgUser ` -DisplayName "New PW User" ` -GivenName "New" -Surname "User" ` -MailNickname "newuser" ` -UsageLocation "US" ` -UserPrincipalName "newuser@" ` -PasswordProfile $PWProfile -AccountEnabled ` -Department "Research" -JobTitle "Trainer" ``` *(Replace* `` with your tenant's domain.) ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742495158730/d5a3f4a4-0a70-4e10-9b2c-9fd66147650f.png align="center") ## Experiment with managing users ## **Exercise 5:** Remove a user from Microsoft Entra ID After deleting a user from entra we can restore the user again up to 30 days, after that the user will be deleted permanently ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742594451029/e130ef22-7ce2-47b7-9bc0-aa1e54f8b98e.png align="center") ## Exercise 6 - Add a Windows 10 license to a user account First, go to entra and make sure that the user’s location is set in the ‘User Properties’ section under the Overview tab of user account. To assign a license, go to the Microsoft 365 admin center at [admin.microsoft.com](http://admin.microsoft.com), navigate to the Licenses page, select the desired license, and then add the user. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742595744008/6e09fb21-f26a-44aa-91c4-775f75082fb8.png align="center") --- # Lab 02: Working with tenant properties ### Login type = Microsoft 365 admin ## Create a custom subdomains ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742597304990/5fe063b6-69c3-4f05-895e-6f9d532f6198.png align="center") you will get redirected to admin.microsoft.com ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742597773711/c1712a0a-809a-42a1-9f7b-3c7776a3ce77.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742597801809/748cf527-addf-41e0-bd56-7a6e3c4cc7a3.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742597827196/aba67da3-6840-4925-8415-98d995bf418b.png align="center") and then you need to configure the dns setting. ## Changing the tenant display name Go to Entra admin center and click on Properties in the overview menu of the Identity section. **IMPORTANT** - When the tenant is created, the Country or region are specified at that time. This setting cannot be changed later.
💡
Under Tenant properties, locate Tenant ID. This is your unique tenant identifier.
![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742599167995/e82ff7b5-5615-42e9-89c4-1d00af709262.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742599434726/09bb727c-832c-467d-8539-c0d188a9179f.png align="center") **Azure subscriptions** have a **trust relationship** with **Microsoft Entra ID**. Microsoft Entra ID is trusted to authenticate users, services, and devices for the subscription. Each subscription has a tenant ID associated with it, and there are a few ways you can find the tenant ID for your subscription. The first way is shown above. ## Setting your privacy information Microsoft strongly recommends you add both your global privacy contact and your organization's privacy statement, so your internal employees and external guests can review your policies. Because privacy statements are uniquely created and tailored for each business, we strongly recommend you contact a lawyer for assistance. **NOTE** - For information about viewing or deleting personal data, see [https://docs.microsoft.com/microsoft-365/compliance/gdpr-dsr-azure](https://docs.microsoft.com/microsoft-365/compliance/gdpr-dsr-azure). For more information about GDPR, see the [https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted). You add your organization's privacy information in the **Properties** area of Microsoft Entra ID. To access the Properties area and add your privacy information: * I you have a user in your Azure lab tenant who works as an IT Admin, you can use him as the Privacy contact. * This person is also who Microsoft contacts if there's a data breach. If there's no person listed here, Microsoft contacts your global administrators. ![Screen image displaying tenant properties with the Technical contact, Global contact, and Privacy statement boxes highlighted](https://raw.githubusercontent.com/MicrosoftLearning/SC-300-Identity-and-Access-Administrator/refs/heads/CloudSlice-and-M36tenant/Instructions/Labs/media/properties-area.png align="left") If you don't include either your own privacy statement or your privacy contact, your external guests will see text in the Review Permissions box that says, has not provided links to their terms for you to review. ![B2B Collaboration Review permissions box with message](https://raw.githubusercontent.com/MicrosoftLearning/SC-300-Identity-and-Access-Administrator/refs/heads/CloudSlice-and-M36tenant/Instructions/Labs/media/active-directory-no-privacy-statement-or-contact.png align="left") to check your privacy statement just go to myaccount.microsoft.com and click on setting and privacy --- # Lab 03: Assigning licenses using group membership ### Login type = Microsoft 365 admin 1. login to www.office.com with the user credentials to see the user has no license. * ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742844040526/d8573774-a33d-4bf1-a8f2-461da9e6a2b3.png align="center") 2. Create a group on entra: ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743095742133/d63c7398-cc75-435c-9ec7-e27716e137cf.png align="center") 3. Add an office license to the group(go to m365 admin center and select billing\\licenses\\O365E3) ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743095929536/8111322c-f2bf-4ac5-978b-d765b4c1b4d6.png align="center") 3. Then go to O365E3\\Groups and assign the license to the group ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743096080417/8cb8da22-4dfd-417e-8eb2-785150c9b845.png align="center") 4. go back to entra and check the group licenses: 5. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743096900608/dbf2d5a4-0f9f-4bcf-8856-d761acb231de.png align="center") ask the user to login to office.com and see the license there ![Screen image the Office.com website with Delia Dennis logged in with office applications available, because a license is assigned.](https://raw.githubusercontent.com/MicrosoftLearning/SC-300-Identity-and-Access-Administrator/refs/heads/CloudSlice-and-M36tenant/Instructions/Labs/media/delia-office-license.png align="left") ## Create a M365 group in Entra: 1. Create a group with two members and add yourself as the owner of the group ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743113466630/b218e0cc-fee0-40c8-bb3d-418c343f08ab.png align="center") 2. Create a dynamic group with this rule syntax: **user.object -ne null** (The new dynamic group will now include B2B guest users as well as member users.) ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743113966542/62c5f57f-452b-48ae-9bb7-3a2ca7a7568c.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743113771565/a0f0d4cb-79ae-4426-9bd5-31fe600fc4bf.png align="left") ## Experiment with alternate rules: 1. Try making a group with only **Guest** users: * (user.objectid -ne null) and (user.userType -eq "Guest") 2. Try make a group with only **Members** of the Microsoft Entra users. * (user.objectid -ne null) and (user.userType -eq "Member") ---