Manage Identity Lifecycle in Entra ID

Provision, organize, and revoke user access using Microsoft Entra ID.

Introduction

30 Second Summary

Every time an employee joins, changes roles, or leaves a company, someone has to create their account, adjust their permissions, and eventually shut everything down. Getting this wrong means either blocking people from doing their work or leaving security holes wide open.

In this project, you will manage the complete identity lifecycle in Microsoft Entra ID. You'll provision user accounts, organize them into departments, assign role-based access, handle an internal transfer, and securely offboard a terminated employee.

What You'll Build

You will act as the IAM Analyst for "Contoso Labs," a fictional mid-size technology company, building a complete identity management environment that demonstrates provisioning, access control, and secure de-provisioning.

By the end of this project, you'll have:

5 user accounts provisioned with department-specific attributes across Engineering, Marketing, and Finance.
Administrative Units and Security Groups enforcing scoped management and least-privilege access across departments.
A complete secure de-provisioning workflow that blocks sign-in, revokes sessions, and removes access for an offboarded employee.
Secret Mission: Build an emergency access revocation simulation for a compromised account and create a reusable offboarding checklist.

Are there any prerequisites?

You need an existing Azure account with Global Administrator or User Administrator role on your Entra ID tenant. If you created the Azure account yourself, you already have Global Administrator.

This is a browser-based project. No additional tools or software are required beyond your web browser.

Before We Start

Before you start building out user accounts and security groups, you need to confirm that your Microsoft Entra ID environment is ready. This means verifying you have the right admin permissions and knowing your tenant's domain.

In this step, you will sign in to the Microsoft Entra admin center, confirm your administrator role, note your tenant's primary domain, and verify that you are on the Free tier.

In this step, get ready to:

Sign in to the Microsoft Entra admin center and confirm your admin role.
Note your tenant's primary domain.
Confirm you are on the Entra ID Free tier.

Sign in and confirm your admin role

To manage identities in Microsoft Entra ID, you need at least the Global Administrator or User Administrator role. If you created your Azure account yourself, you automatically have Global Administrator.

Open your browser and navigate to entra.microsoft.com.
Sign in with the Azure account you use to manage your tenant.
In the left-hand menu, select Identity, then select Users, then select All users.
Find and select your own user account from the list.
On your user profile page, select Assigned roles in the left menu.
Confirm that Global Administrator (or at minimum User Administrator) appears in the list.

What is Global Administrator?

Global Administrator is the highest-privilege role in Microsoft Entra ID. It grants full control over the directory, including the ability to create users, assign roles, and manage groups. In production environments, this role is tightly restricted, but for your lab it ensures you can complete every task.

Don't see Assigned roles?

Make sure you selected your own user account, not another user. The Assigned roles option appears in the left menu of the user profile page.

If you do not see Global Administrator or User Administrator listed, you may not have sufficient permissions. The account owner who created the Azure subscription always receives Global Administrator.

Why don't I see an admin role on my account?

Note your tenant primary domain

Every Entra ID tenant has a primary domain that you will use when creating new user accounts. It follows the format yourdomain.onmicrosoft.com.

In the left-hand menu, browse to Identity > Overview.
In the Basic information section, find the Primary domain field.
Write down or copy this domain. You will use it for every user account you create in this project.

Why does my domain matter?

The primary domain is the default suffix for new user accounts. When you create a user like alexkim@yourdomain.onmicrosoft.com, the part after the @ is your tenant's primary domain.

Confirm the Entra ID Free tier

This project uses only features included in the Entra ID Free tier. No paid licenses are required for user management, group management, or Administrative Units with assigned membership.

While still on the Overview page, look at the tenant information displayed. The Home page also shows a Tenant overview section with your tenant name, ID, and license information.
Confirm that no paid Entra ID licenses (P1 or P2) are required. If you see only the Free tier or no premium licenses listed, you are all set.

What does the Free tier include?

The Entra ID Free tier is included automatically with every Azure subscription. It covers user and group management, basic reports, self-service password change for cloud users, and single sign-on across Azure, Microsoft 365, and many popular SaaS apps.

Everything you build in this project falls within the Free tier. No charges will appear on your Azure bill from the work you do here.

Your environment is confirmed and ready to go. Next up, you will provision user accounts for the fictional Contoso Labs company.

Verify Your Environment and Admin Access

Before provisioning any user accounts, you need to confirm your environment is ready. The right admin role determines what you can create and manage in your tenant.

You also need to know your tenant's primary domain. Every user account you create will include this domain in their sign-in address.

In this step, get ready to:

Confirm your Global Administrator role.
Note your tenant's primary domain.
Verify your Entra ID Free tier.

Confirm your admin role

Your admin role controls what actions you can perform across the tenant. Microsoft Entra ID requires at least a User Administrator role to create and manage users, but Global Administrator gives you full access to every feature you need in this project.

In the Microsoft Entra admin center, select Entra ID in the left navigation menu.
Select Users, then All users.
Find and select your own user account from the list.
Select Assigned roles on the user profile page.
Confirm you see Global Administrator in the list of assigned roles.

What is Global Administrator?

Global Administrator is the highest-privilege role in Microsoft Entra ID. It grants full access to all administrative features across your tenant, including user management, group management, and role assignments.

If you created your Azure account yourself, you automatically have this role. If you see User Administrator instead, that also works for this project.

Don't see any admin role?

If no admin role appears under Assigned roles, your account may not have administrative privileges on this tenant. You need either Global Administrator or User Administrator to complete this project. Ask whoever manages your Azure subscription to assign you the User Administrator role.

Help me understand why I don't see an admin role on my account.

Verify your tenant domain

Your tenant's primary domain is the suffix for every user account you create. It looks like yourdomain.onmicrosoft.com.

In the left navigation, select Entra ID, then select Overview.
Look for the Basic information section on the Overview page.
Note your Primary domain value. Write it down or copy it somewhere accessible.

Why do I need to know my tenant domain?

Every user you create in the next step will have a username in the format username@yourdomain.onmicrosoft.com. You need your exact domain to set up those accounts correctly.

If you added a custom domain to your tenant (like contoso.com), that will appear as the primary domain instead. Either works for this project.

Confirm your Entra ID Free tier

This project uses only features available on the Entra ID Free tier. No paid licenses are required for user management, group management, or Administrative Units with assigned membership.

On the same Overview page, check the license information displayed. Your tenant shows the license tier associated with your subscription.
Confirm that the Entra ID Free tier is included with your Azure subscription. No additional license purchase is needed.

What does the Free tier cover?

The Entra ID Free tier includes user and group management, basic reports, self-service password change for cloud users, and single sign-on across Azure and Microsoft 365 apps. These features are more than enough for this project.

Every new Azure subscription includes the Entra ID Free tier automatically at no extra cost. You get up to 50,000 stored objects with single sign-on to all cloud apps.

No P1 or P2 license needed

Administrative Units require a P1 or P2 license for AU administrators only. Since you are using your Global Administrator account (which has full permissions on the tenant), and AU members only need Free licenses, you can complete this entire project on the Free tier.

Your environment is confirmed and ready. Next up, you will provision user accounts for the fictional Contoso Labs company across three departments.

Provision User Accounts for New Hires

Your admin access is confirmed and your tenant domain is ready. Now it's time to do the core work of an IAM Analyst: provisioning user accounts for new employees.

You'll create five accounts for fictional Contoso Labs employees spread across three departments. Each account needs the correct job title and department set from day one, because in real IAM operations these attributes drive group assignments, access decisions, and audit trails.

In this step, get ready to:

Create five user accounts with department-specific attributes.
Verify all accounts appear in the Entra ID directory.
Confirm job title and department fields on each user profile.

Create user accounts for Contoso Labs

User provisioning is the process of creating identity records for new employees in your directory. You'll walk through the full creation flow for each of the five Contoso Labs hires.

In the Microsoft Entra admin center, browse to Entra ID > Users.
Select New user > Create new user.

You'll start with the first employee, Alex Kim. Follow the full walkthrough below, then repeat the same process for the remaining four users.

On the Basics tab, enter alexkim in the User principal name field. The domain dropdown already shows your tenant domain (the one you noted in the previous step).
Enter Alex Kim in the Display name field.
Leave the password set to Auto-generate password. You do not need to note this password down for this project.
Select Next: Properties at the bottom of the page.
Under the Job information section, enter Software Engineer in the Job title field.
Enter Engineering in the Department field.
Select Review + create at the bottom of the page.
Review the details, then select Create.

What is user provisioning?

User provisioning is the first phase of the identity lifecycle. It creates a digital identity for an employee so they can authenticate and receive access to company resources.

Setting attributes like Department and Job title at creation time is critical. These attributes determine which Security Groups a user belongs to, which resources they can access, and how they appear in audit logs.

Now repeat the same process for the remaining four users. For each one, browse to Entra ID > Users > New user > Create new user and fill in the details from the list below.

Jordan Patel jordanpatel / Marketing Coordinator / Marketing.
Sam Rivera samrivera / Financial Analyst / Finance.
Casey Morgan caseymorgan / DevOps Engineer / Engineering.
Taylor Brooks taylorbrooks / Marketing Manager / Marketing.

Keep the same pattern

For each user, enter the username in the User principal name field on the Basics tab, then the full name in Display name. Move to the Properties tab and set the Job title and Department. Then select Review + create and Create.

Seeing a username already exists error?

This means a user with the same User principal name already exists in your directory. Double-check the spelling of the username you entered. If you previously created a test user with the same name, delete it first before retrying.

Help me fix this username conflict

Verify all five users in the directory

After creating all five accounts, you need to confirm they all exist in your tenant's user list.

Browse to Entra ID > Users > All users.
Confirm that all five accounts appear in the list: Alex Kim, Jordan Patel, Sam Rivera, Casey Morgan, and Taylor Brooks.
Check that the Department column shows the correct department for each user (Engineering, Marketing, or Finance).

What should I see?

The All users list displays every identity in your directory. You should see your own admin account plus the five new accounts. Each row shows the Display name, User principal name, and User type at a minimum.

Missing a user from the list?

Try refreshing the page. If the user still does not appear, go back to New user > Create new user and create the missing account. Make sure you select Create on the final review page.

Help me find my missing user

Confirm department and job title on each profile

The All users list confirms the accounts exist, but you also need to verify that the attribute data is correct on each profile. Accurate attributes are critical for security group assignment and audit trails in real IAM operations.

From the All users list, select Alex Kim.
Select Properties on the user's page.
Scroll to the Job information section and confirm that Job title shows Software Engineer and Department shows Engineering.
Navigate back to All users and repeat for each of the other four users, confirming their Job title and Department match the values you entered.

Why verify attributes individually?

In a production environment, an IAM Analyst cross-references user attributes to confirm data integrity before assigning access. A typo in the Department field could mean a user gets added to the wrong Security Group and receives access they should not have.

This verification step mirrors the audit process you would follow at a real organization after onboarding a batch of new hires.

Department or Job title field is blank?

You may have skipped the Properties tab during user creation. Select Properties on the user's page, then select the pencil icon next to the Job information heading. Enter the correct values and select Save at the bottom of the page.

Help me add missing attributes to my user

All five identities are provisioned and verified. Next up, you'll organize these users into Administrative Units so that management responsibilities can be scoped by department.

Create Administrative Units for Department Scoping

You now have five user accounts representing Contoso Labs employees across three departments. Managing all of them from a single flat list works for five people, but imagine a company with 5,000.

In this step, you will create Administrative Units to scope management by department. This means a delegated admin assigned to the Engineering AU could only manage Engineering users, not Finance or Marketing users.

In this step, get ready to:

Create three Administrative Units representing Contoso Labs departments.
Assign each user to their department's Administrative Unit.
Verify memberships to confirm the scoped management structure.

Create the three Administrative Units

Administrative Units are the cloud-native way to scope administrative permissions to subsets of your directory. Each AU represents a department boundary.

In the left navigation of the Entra admin center, browse to Entra ID > Roles & admins > Admin units.
Select Add at the top of the page.
Enter AU-Engineering as the name.
Enter Engineering department management scope as the description.
Leave the membership type as Assigned (this is the default and works on the Free tier for members).
Select Next: Review + create, then select Create.

Now repeat this process for the remaining two departments.

Select Add again.
Enter AU-Marketing as the name and Marketing department management scope as the description.
Leave membership type as Assigned and select Next: Review + create > Create.
Select Add one more time.
Enter AU-Finance as the name and Finance department management scope as the description.
Leave membership type as Assigned and select Next: Review + create > Create.

You should now see all three Administrative Units listed on the Admin units page.

What is an Administrative Unit?

An Administrative Unit is a container that restricts the scope of role permissions to a specific portion of your organization. Think of it like a department fence. An admin assigned a role scoped to AU-Engineering can manage users inside that AU, but cannot touch users in AU-Finance or AU-Marketing.

This is how real organizations enforce separation of duties at scale.

Why Assigned membership instead of Dynamic?

Dynamic membership automatically adds users based on attribute rules (like department = Engineering). However, Dynamic membership requires a Microsoft Entra ID P1 license for each member. Assigned membership works on the Free tier for AU members, which keeps this project at zero cost.

Don't see the Add button?

Make sure you navigated to Roles & admins > Admin units, not just Roles & admins. You need the Privileged Role Administrator role or Global Administrator to create Administrative Units. If you created your Azure account yourself, you already have Global Administrator.

help me find the Admin units page in the Entra admin center

Add users to their respective Administrative Units

With the three AUs created, you need to place each user into the correct department container.

From the Admin units list, select AU-Engineering.
Select Users in the left menu.
Select Add member.
Search for and select Alex Kim.
Select Add member again and add Casey Morgan.

Now add members to AU-Marketing.

Go back to Roles & admins > Admin units and select AU-Marketing.
Select Users > Add member.
Add Jordan Patel and Taylor Brooks.

Finally, add the Finance member.

Go back to Admin units and select AU-Finance.
Select Users > Add member.
Add Sam Rivera.

Verify membership in each Administrative Unit

Verifying membership ensures your scoped management structure is correct before you build access controls on top of it.

Browse to Roles & admins > Admin units > select AU-Engineering > Users.
Confirm you see Alex Kim and Casey Morgan listed.
Go back and select AU-Marketing > Users.
Confirm you see Jordan Patel and Taylor Brooks.
Go back and select AU-Finance > Users.
Confirm you see Sam Rivera.

Each AU should show only the users from that department. If a delegated admin were assigned to AU-Engineering, they would see only Alex Kim and Casey Morgan. They would have no visibility into Finance or Marketing users.

Missing a user in an AU?

If a user does not appear under the AU's Users list, go back to the AU and select Add member to add them. Make sure you are searching by their display name (e.g., Alex Kim), not their email address.

help me add a user to an Administrative Unit in Entra ID

Your directory now has a clear department structure. Next up, you will build Security Groups that control what level of access each department's users actually have.

Build Security Groups for Role-Based Access Control

Your Administrative Units define who manages whom. Now you need to define who can access what.

Security Groups are the building blocks of Role-Based Access Control (RBAC) in Microsoft Entra ID. Instead of assigning permissions to individual users, you assign permissions to groups. Users inherit access through their group membership. This enforces Least Privilege because each group grants only the minimum access its members need.

In this step, get ready to:

Create four Security Groups with department-specific access levels.
Assign users to groups based on their role and department.
Verify group memberships from both the group and user profile perspectives.

Create four Security Groups

A Security Group is used to manage user and device access to shared resources. You will create four groups representing different access tiers at Contoso Labs.

In the Microsoft Entra admin center, browse to Entra ID in the left navigation.
Select Groups, then All groups.
Select New group.
Set Group type to Security.
Set Membership type to Assigned.
Enter SG-Engineering-FullAccess as the Group name.
Enter Full access to engineering tools and repos as the Group description.
Select Create.

Repeat the same process for the remaining three groups:

SG-Marketing-ReadOnly with description Read-only access to marketing campaigns and assets.
SG-Finance-Sensitive with description Access to sensitive financial data and reports.
SG-AllStaff with description Basic access granted to all Contoso Labs employees.

Why four groups instead of one?

Each group represents a distinct access tier. Engineers need full access to repos and tools. Marketing only needs read access to campaign assets. Finance handles sensitive data that requires extra restrictions.

The SG-AllStaff group provides a baseline of company-wide access (like intranet or email). This layered approach means you can grant and revoke access at the group level without touching individual user permissions.

Don't see the New group button?

You need at least the Groups Administrator or User Administrator role to create groups. Since you confirmed Global Administrator access in Step 1, this should work. Make sure you are on the All groups page, not inside an existing group.

Help me troubleshoot why I can't create a new Security Group in Entra ID.

Assign members to each group

With all four groups created, you can now assign users to the groups that match their department and role.

Browse to Entra ID > Groups > All groups.
Select SG-Engineering-FullAccess.
Select Members in the left menu.
Select Add members.
Search for and select Alex Kim and Casey Morgan, then confirm.

Repeat this process for the remaining three groups:

Open SG-Marketing-ReadOnly > Members > Add members. Add Jordan Patel and Taylor Brooks.
Open SG-Finance-Sensitive > Members > Add members. Add Sam Rivera.
Open SG-AllStaff > Members > Add members. Add all five users: Alex Kim, Jordan Patel, Sam Rivera, Casey Morgan, and Taylor Brooks.

What does this membership structure achieve?

Each user now belongs to exactly two groups: one department-specific group (like SG-Engineering-FullAccess) and the company-wide SG-AllStaff group.

In a production environment, you would assign permissions to these groups rather than to individual users. When someone joins or leaves a department, you only change their group membership. The permissions follow automatically.

Verify group memberships

An IAM Analyst always verifies access from multiple angles. You will confirm memberships both from the group side and from an individual user's profile.

Browse to Entra ID > Groups > All groups.
Select each group one at a time and confirm the correct members appear under Members.
Verify SG-Engineering-FullAccess shows Alex Kim and Casey Morgan.
Verify SG-Marketing-ReadOnly shows Jordan Patel and Taylor Brooks.
Verify SG-Finance-Sensitive shows Sam Rivera.
Verify SG-AllStaff shows all five users.

Now cross-reference from the user side.

Browse to Entra ID > Users.
Select Alex Kim.
Select Groups in the left menu.
Confirm that both SG-Engineering-FullAccess and SG-AllStaff appear in the list.

Why verify from the user's profile?

Checking group membership from the user side is exactly how an IAM Analyst audits access during a security review. If someone reports they can access a resource they shouldn't, you would open their profile and check which groups they belong to. This cross-reference catches misconfigurations that a group-only check might miss.

Missing a group membership?

If a user does not appear in the expected group, go back to that group's Members page and add them. Make sure you are selecting the correct user name, as Entra ID search can sometimes show partial matches.

Help me figure out why a user is missing from a Security Group in Entra ID.

Your RBAC structure is in place. Every user has exactly the access their role requires. Next up, you will simulate what happens when an employee changes departments and their access needs to be updated.

Simulate an Internal Transfer

Your access control structure is in place. Security Groups enforce who can access what, and Administrative Units scope who can manage whom.

Employees don't stay in one role forever. When someone transfers departments, their access must change to reflect their new responsibilities. Getting this wrong means either blocking productivity or leaving old permissions in place that violate least privilege.

In this step, get ready to:

Update user attributes for the transferring employee.
Modify Security Group memberships to match the new role.
Reassign Administrative Unit membership for correct management scoping.

Update Taylor Brooks' user attributes

Taylor Brooks is transferring from Marketing to Engineering as a Technical Project Manager. The first step in any internal transfer is updating the employee's identity attributes so that audit logs and directory lookups reflect the change immediately.

In the Entra admin center, browse to Entra ID > Users.
Select Taylor Brooks from the user list.
Select Properties, then select Edit properties.
Change the Department field from Marketing to Engineering.
Change the Job title field from Marketing Manager to Technical Project Manager.
Select Save at the bottom of the page.

Why update attributes first?

In a real IAM operation, you update identity attributes before changing access permissions. This ensures audit logs reflect the correct department at the moment access changes are recorded.

It also means any automated policies tied to department attributes will align correctly during the transition.

Modify Security Group memberships

Taylor's access must now match the Engineering team. You need to remove their Marketing access and grant Engineering access.

Browse to Entra ID > Groups > All groups.
Select SG-Marketing-ReadOnly.
Select Members.
Check the box next to Taylor Brooks and select Remove.
Browse back to All groups and select SG-Engineering-FullAccess.
Select Members, then select Add members.
Search for and select Taylor Brooks, then select Select.

What is happening to Taylor's access?

By removing Taylor from SG-Marketing-ReadOnly, you revoke their read-only access to marketing campaigns and assets. By adding them to SG-Engineering-FullAccess, you grant full access to engineering tools and repos.

Taylor remains in SG-AllStaff because that group provides baseline access for all employees regardless of department.

Reassign Administrative Unit membership

The final piece of the transfer is moving Taylor's management scope. Administrative Units control which delegated admins can manage which users.

Browse to Entra ID > Roles & admins > Admin units.
Select AU-Marketing.
Select Users.
Select Taylor Brooks and select Remove.
Browse back to Admin units and select AU-Engineering.
Select Users > Add member.
Search for and select Taylor Brooks, then confirm the addition.

Why does the order matter?

The correct order for an internal transfer is: attributes first, then access changes, then scope changes. Attributes record who the person is. Access changes (groups) control what they can reach. Scope changes (AUs) control who can manage them.

If you moved the AU membership first, a Marketing-scoped admin could still manage Taylor during the window before group changes took effect. Updating attributes first ensures every downstream action is logged against the correct department.

Now verify the transfer is complete. Open Taylor Brooks' profile by browsing to Entra ID > Users > Taylor Brooks.

Select Properties and confirm Department shows Engineering and Job title shows Technical Project Manager.
Select Groups and confirm Taylor is a member of SG-Engineering-FullAccess and SG-AllStaff (and NOT SG-Marketing-ReadOnly).

Taylor still shows Marketing?

Make sure you selected Save after editing the properties. Changes are not committed until you explicitly save.

If the group membership looks wrong, double check that you removed Taylor from SG-Marketing-ReadOnly and added them to SG-Engineering-FullAccess. Open each group's Members page to confirm.

Help me verify Taylor Brooks' transfer is complete.

You've successfully simulated an internal transfer following the correct IAM sequence. Next up, you'll handle the most security-critical operation in identity management: securely de-provisioning a terminated employee.

Secure De-provisioning of a Terminated Employee

In the previous step, you handled an internal transfer by updating Taylor Brooks' attributes, group memberships, and Administrative Unit assignment. That process followed a careful order to ensure access was never over-provisioned during the change.

Now you face the most security-critical operation in the identity lifecycle: de-provisioning a terminated employee. Casey Morgan has been terminated from Contoso Labs and must be immediately offboarded. Every minute of delay is a minute where a former employee could still access company resources.

In this step, get ready to:

Block sign-in for a terminated employee to prevent new authentication attempts.
Revoke all active sessions to force immediate sign-out from all applications.
Remove all group and Administrative Unit memberships and document a reusable offboarding checklist.

Block sign-in for Casey Morgan

When an employee is terminated, the very first action is to block their ability to sign in. This prevents any new authentication attempts from succeeding, even if the former employee still knows their password.

Browse to Entra ID > Users > All users.
Select Casey Morgan from the user list.
Select Edit properties.
Uncheck Account enabled to block all sign-in attempts.
Select Save.

Why is blocking sign-in the first step?

Blocking sign-in is the fastest way to prevent a terminated employee from initiating any new sessions. Without this, a former employee could sign in and generate new access tokens while you work through the rest of the offboarding process.

In a Zero Trust security model, you assume breach and verify every access attempt explicitly. Blocking sign-in is the foundation of that model during offboarding.

You should see Casey Morgan's profile now shows Account enabled as unchecked.

Don't see the Account enabled checkbox?

Make sure you selected Edit properties at the top of the user profile page. The checkbox only appears in edit mode, not in the read-only view.

If the option is greyed out, confirm your account has Global Administrator or User Administrator permissions.

help me troubleshoot why I can't disable a user account in Entra ID

Revoke all active sessions

Blocking sign-in stops new authentications, but it does not terminate sessions that are already active. Access tokens issued by Microsoft Entra ID last for 1 hour by default. Without revoking sessions, Casey Morgan could continue accessing resources on existing tokens until they expire.

Return to Casey Morgan's user Overview page.
Select Revoke sessions.
Confirm the action when prompted.

What does Revoke sessions do?

This invalidates all refresh tokens and forces sign-out from every application Casey Morgan is currently using. Any active session across Microsoft 365 apps, custom applications, and third-party integrations tied to Entra ID will be terminated.

Combined with blocking sign-in, this means the user cannot gain new tokens for any application tied to Microsoft Entra ID.

You should see a confirmation message indicating that the sessions have been successfully revoked.

Not seeing the Revoke sessions button?

Make sure you are on Casey Morgan's Overview page, not the Properties page. The Revoke sessions button is located on the main Overview tab of the user profile.

help me find the Revoke sessions button in Microsoft Entra admin center

Remove all access and document the offboarding checklist

With sign-in blocked and sessions revoked, Casey Morgan can no longer authenticate. The final step is to remove all group memberships and Administrative Unit assignments so that even if tokens were somehow restored, no resource access would be granted.

On Casey Morgan's profile, select Groups.
Select the checkbox next to SG-Engineering-FullAccess, then select Remove.
Select the checkbox next to SG-AllStaff, then select Remove.

Casey Morgan should now have zero group memberships listed on their profile.

Browse to Entra ID > Roles & admins > Admin units.
Select AU-Engineering.
Select Users.
Select the checkbox next to Casey Morgan, then select Remove member.

Why remove group memberships after revoking sessions?

Security Groups in Entra ID control access to shared resources. Even though Casey Morgan cannot currently authenticate, leaving group memberships intact creates a security risk.

If the account were ever re-enabled by mistake, all previous access would be automatically restored. Removing memberships ensures a clean separation of the terminated user from all resources.

Now verify the complete de-provisioning by checking Casey Morgan's profile.

Browse to Entra ID > Users > select Casey Morgan.
Confirm the account shows as disabled (Account enabled is unchecked).
Select Groups and confirm zero memberships are listed.
Browse to Admin units > AU-Engineering > Users and confirm Casey Morgan no longer appears.

Finally, document the offboarding steps you performed as a reusable checklist. In a production environment, this checklist would be stored in your organization's runbook or IT ticketing system.

Block sign-in (Account enabled = unchecked).
Revoke sessions (invalidates all tokens).
Remove from all Security Groups.
Remove from Administrative Units.
(Production) Reset password as an extra precaution.
(Production) Notify manager and document in ticketing system.

Why does the order matter?

This sequence follows the principle of eliminating the highest-risk exposure first. Blocking sign-in prevents new sessions. Revoking sessions kills existing access. Removing group memberships strips resource permissions.

If you reversed the order and removed groups first, the user could still be actively signed in and accessing cached resources during the entire group-removal process.

Casey Morgan still shows group memberships?

Make sure you removed Casey Morgan from both SG-Engineering-FullAccess and SG-AllStaff. Check each group individually under Groups > All groups > select the group > Members to confirm removal.

help me troubleshoot removing a user from security groups in Entra ID

Secret mission

Build an Emergency Access Revocation Workflow

You have already offboarded Casey Morgan following a standard termination workflow. But what happens when an account is actively compromised and every second counts? In this secret mission, you will build a complete offboarding checklist with Zero Trust rationale and simulate an emergency access revocation for a compromised account scenario.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely on the Microsoft Entra ID Free tier, so there are no ongoing costs regardless of your choice.

Resources you used:

5 user accounts in Microsoft Entra ID (free, no cost).
3 Administrative Units: AU-Engineering, AU-Marketing, AU-Finance (free, no cost).
4 Security Groups: SG-Engineering-FullAccess, SG-Marketing-ReadOnly, SG-Finance-Sensitive, SG-AllStaff (free, no cost).

Keep everything running

No action needed. Choose this if you plan to continue practising IAM operations, preparing for interviews, or extending the lab with additional users and policies.

All user accounts, Administrative Units, and Security Groups remain intact.
No charges apply on the Entra ID Free tier.
You can return to entra.microsoft.com at any time to pick up where you left off.

Pause - I'll come back to this later

Since all resources are free, pausing simply means leaving them in place. There is nothing to shut down or stop.

Your user accounts, groups, and Administrative Units will remain exactly as they are.
No processes are running and no costs accrue.
When you return, sign back in at entra.microsoft.com and your lab will be in the same state.

Delete - I don't want to use this again

Remove all project resources to keep your tenant clean. Follow these steps in order.

Delete all five user accounts:

Browse to Entra ID > Users.
Select each user (Alex Kim, Casey Morgan, Jordan Patel, Sam Rivera, Taylor Brooks) one at a time.
Select Delete to remove the account.
Repeat until all five test users are deleted.

Delete all four Security Groups:

Browse to Entra ID > Groups > All groups.
Select each group (SG-Engineering-FullAccess, SG-Marketing-ReadOnly, SG-Finance-Sensitive, SG-AllStaff) one at a time.
Select Delete to remove the group.
Repeat until all four groups are deleted.

Delete all three Administrative Units:

Browse to Entra ID > Roles & admins > Admin units.
Select each Administrative Unit (AU-Engineering, AU-Marketing, AU-Finance) one at a time.
Select Delete to remove the unit.
Repeat until all three Administrative Units are deleted.

Why this order?

Deleting users first removes them from groups and AUs automatically. You then delete the now-empty groups and AUs to leave your tenant completely clean.

Nice Work!

You just built a complete identity lifecycle management environment in Microsoft Entra ID. From onboarding new hires to securely offboarding a terminated employee, you exercised the same workflows a Cybersecurity IAM Analyst performs every day.

You've learned how to:

Provisioned user accounts with department-specific attributes and organized them into Administrative Units for scoped management across Engineering, Marketing, and Finance.
Built Security Groups implementing role-based access control and least-privilege principles to control access across departments.
Performed a complete secure de-provisioning workflow including sign-in block, session revocation, and access removal following Zero Trust principles.
Secret Mission: Completed an emergency access revocation simulating a compromised account scenario with a documented rapid-response workflow.

Ready to quiz yourself?