Manage Users in Azure Active Directory (Azure AD)

This document provides comprehensive guidance on managing users within your Azure Active Directory (Azure AD) tenant. Effective user management is crucial for security, access control, and operational efficiency.

Overview of Azure AD User Management

Azure AD is a cloud-based identity and access management service that helps your employees sign in and access resources. Managing users involves creating, updating, deleting, and assigning roles to them. This ensures that only authorized individuals have access to specific applications and data.

Creating Users

You can create new users in Azure AD through the Azure portal, PowerShell, or Microsoft Graph API. Here's a breakdown of common methods:

1. Using the Azure Portal

1. Sign in to the Azure portal.
2. Navigate to Azure Active Directory.
3. Select Users from the left-hand menu.
4. Click on the + New user button.
5. Choose either Create new user or Invite external user.
6. Fill in the required user details, such as name, username, and password.
7. Assign groups and roles as necessary.
8. Click Create.

2. Using Azure AD PowerShell

PowerShell provides a powerful way to automate user creation. Ensure you have the Azure AD PowerShell module installed.

# Connect to Azure AD
Connect-AzureAD

# Define user properties
$userParams = @{
    DisplayName = "Jane Doe"
    PasswordProfile = New-Object -TypeName Microsoft.Open.AzureAD.Model.PasswordProfile
    UserPrincipalName = "janedoe@yourtenant.onmicrosoft.com"
    MailNickname = "janedoe"
    AccountEnabled = $true
}
$userParams.PasswordProfile.Password = "YourStrongPassword!123"
$userParams.PasswordProfile.ForceChangePasswordNextLogin = $true

# Create the user
New-AzureADUser @userParams

Editing and Updating User Information

User information can be updated at any time. This includes changing display names, contact information, assigned licenses, or group memberships.

• Azure Portal: Navigate to the user's profile and select Edit.
• PowerShell: Use the Set-AzureADUser cmdlet.

# Example: Update a user's display name
$userId = "user-object-id" # Replace with the actual user object ID
Set-AzureADUser -ObjectId $userId -DisplayName "Jane Smith"

Managing User Passwords

Password management is a critical security aspect:

• Password Reset: Users can reset their own passwords via the self-service password reset (SSPR) portal if configured. Administrators can also reset passwords manually.
• Password Policies: Configure password expiration, complexity, and history policies in Azure AD.
• Force Password Change: You can force a user to change their password upon their next sign-in.

# Example: Force password change for a user
$userId = "user-object-id"
$passwordProfile = New-Object -TypeName Microsoft.Open.AzureAD.Model.PasswordProfile
$passwordProfile.ForceChangePasswordNextLogin = $true
Set-AzureADUser -ObjectId $userId -PasswordProfile $passwordProfile

Deleting Users

When a user leaves the organization or no longer requires access, their account should be deleted or disabled. Before deleting, consider revoking their access and backing up any essential data.

• Azure Portal: Navigate to the user's profile and select Delete.
• PowerShell: Use the Remove-AzureADUser cmdlet.

# Example: Delete a user
$userId = "user-object-id"
Remove-AzureADUser -ObjectId $userId

Guest Users and External Collaboration

Azure AD B2B collaboration allows you to invite external users to collaborate on your resources. These guest users have different properties and management considerations.

For detailed instructions on inviting and managing guest users, refer to the Azure AD B2B Collaboration documentation.

Best Practices for User Management

• Implement the principle of least privilege: Grant users only the permissions they need.
• Use groups to assign permissions and licenses, rather than assigning them individually.
• Regularly review user access and remove unnecessary permissions or inactive accounts.
• Enable multi-factor authentication (MFA) for all users.
• Utilize conditional access policies to enforce security requirements.

For advanced scenarios like bulk user management, synchronization from on-premises Active Directory, and automation, explore the capabilities of Microsoft Graph API.