Summary

Completed

You can now provision and govern identities across their full lifecycle in Microsoft Entra ID—from creating users and contacts to scaling that work with Graph PowerShell, extending access to guests, and moving privileged roles to just-in-time access with PIM.

What you learned

• User and contact lifecycle: You create, edit, and delete users across the Microsoft 365 and Microsoft Entra admin centers, restore a deleted user within its 30-day window, and create a mail contact for someone who never signs in.
• Bulk identity management with Graph PowerShell: You script account creation, updates, and deletion with New-MgUser, Update-MgUser, and Remove-MgUser, requesting the least-privileged scope that matches the task instead of a broader one.
• Guests and external collaboration: You configure the B2B invitation flow, guest permission levels, and domain lists, then delegate invitations through the Guest Inviter role instead of a broad administrative role.
• Groups and group policies: You choose between a security group and a Microsoft 365 group, apply assigned or dynamic membership, and recognize that nesting resolves permissions and licenses through direct membership only.
• Administrative units: You scope a delegated role, such as Helpdesk Administrator, to one slice of the directory, and recognize that adding a group to a unit scopes only the group object, not its members.
• Roles, role groups, and Privileged Identity Management: You convert standing active role assignments to eligible assignments that require activation, and disambiguate PIM's approver fallback and its three duration settings.

Learn more

• Create or delete users
• New-MgUser cmdlet reference
• Configure external collaboration settings
• Manage the lifecycle of Microsoft 365 groups
• Administrative units in Microsoft Entra ID
• Configure Privileged Identity Management