Onboard an Entra ID Identity Pilot

Onboard users and guests, assign licenses, and pilot password reset.

Introduction

30 Second Summary

A new teammate expects access on day one. A contractor expects to use the account they already have.

In this project, you will build a controlled identity pilot in Microsoft Entra ID for two internal users plus one external contractor. You will expose a licensing blocker before proving a group-scoped self-service password reset (SSPR) flow when your tenant has an eligible license.

What You'll Build

You open the directory to show two distinct employees plus a redeemed contractor before demonstrating that only a selected pilot member can recover a forgotten password.

By the end of this project, you'll have:

A demo-ready identity roster where you can compare two cloud-only identities with a redeemed B2B guest whose sign-in remains external to your tenant.
A licensing diagnosis that shows how a missing Usage location blocks assignment before you verify the corrected product license when a seat is available.
A controlled SSPR pilot that visibly rejects an out-of-scope user before allowing the group member to register a recovery method and reset a password when licensing permits.
Secret Mission: Replace the test user's direct product license with group-based licensing that can scale to future internal users.

Are there any prerequisites?

You'll need a Microsoft Entra workforce tenant that is safe to modify, an administrator account with sufficient permissions, plus an external email address you can access. A live password-reset test requires an existing eligible license or a tenant-offered trial, so this lab never requires a purchase.

Before We Start

Before any hands-on work begins, this checkpoint locks in the purpose of your controlled Microsoft Entra identity pilot. You are preparing the right onboarding experience for internal users and an external guest while keeping self-service password reset limited to a selected group.

Verify Tenant Readiness

Your Microsoft Entra ID pilot depends on the correct tenant context. Missing roles or licenses create different blockers.

The Microsoft Entra admin center shows your directory context. The Microsoft 365 admin center shows the product seats available to that tenant.

A separate Safari private window keeps future test-user sessions isolated from your administrator session.

In this step, get ready to:

Confirm the workforce directory context.
Check administrative permissions and eligible-license availability.
Prepare an isolated private window for non-administrator testing.

Confirm the directory and permissions

The directory name confirms where your changes would land. The tenant type confirms that this lab uses a workforce directory.

Protect an Unfamiliar Tenant

A blocked page marks a permission boundary for your current account.

Record any blocked page as part of your readiness check.
Leave tenant permissions unchanged if this is an unfamiliar production environment.

Sign in to the Microsoft Entra admin center with the administrative account for this lab.
Confirm the current directory name is Default Directory.
Confirm the tenant type is Workforce.
Select Entra ID in the left navigation.
Select Users to test access.
Select Groups to test access.
Select Password reset to test access.
Record the result for all three pages here: Users, Groups, and Password reset access results.

A page that opens confirms your account can reach that administration area. A blocked page identifies the permission boundary you need to report.

Least-Privileged Roles for This Lab

Each identity task has a role designed for its scope. Matching tasks to roles helps you avoid broad administrative access.

User Administrator covers internal user management.
Groups Administrator or User Administrator covers group management.
Guest Inviter covers external guest invitations.
License Administrator or User Administrator covers product license assignment.
Authentication Policy Administrator covers SSPR configuration.

Good, you now know which identity tasks your current account can perform safely.

Audit license availability

An eligible product seat determines whether the cloud-only self-service password reset test can run. This audit records the entitlement available in your tenant.

Keep This Audit Free

This readiness check does not require a purchase.

Avoid purchasing a subscription for this lab.
Review the terms shown for your tenant before using Try for free.
Continue with the free identity tasks if no eligible seat or trial is available.

Sign in to the Microsoft 365 admin center with the administrative account for this lab.
Select Billing in the navigation.
Select Licenses.
Check whether at least one seat is available for Microsoft Entra ID P1 or P2, Microsoft 365 Business Standard, or Microsoft 365 Business Premium.
Record the qualifying product here: eligible product name or no eligible product.
Record the available quantity here: available seat count or zero.

You should find either an eligible product with its available quantity or no suitable seat. Both outcomes give the pilot a clear licensing boundary.

That audit gives you a safe path forward without turning the lab into an unexpected purchase.

Prepare an isolated test session

A private window creates a separate browser session for the internal test user and external guest. Cached administrator credentials cannot mask their sign-in experience.

Click File in the Safari menu bar.
Select New Private Window.
Leave the private window open for later identity testing.

Before the final check, which Safari window should contain your administrator sessions?

Return to the regular Safari window.
Confirm the Microsoft Entra admin center still shows Default Directory as a Workforce tenant.
Confirm the Microsoft 365 admin center uses the same administrative account.
Switch to the separate private Safari window.

You should see both administrator sessions in the regular Safari window. The separate private window should have a dark Smart Search field with white text.

Seeing the Wrong Tenant or Window?

Use the private-window option under File if the Smart Search field is not dark.
Return to the regular Safari window if an admin center opens inside the private session.
Confirm the administrative account belongs to Default Directory before continuing.
Still stuck? Help me verify my Microsoft Entra tenant and Safari session setup.

Tenant Readiness Checkpoint

Default Directory confirmed as a Workforce tenant. Microsoft Entra admin center and Microsoft 365 admin center access checked.

Relevant administrative permissions and eligible-license availability recorded. A separate Safari Private Window is ready for non-admin sign-in testing.

Your tenant boundaries are clear. Next, you'll create two internal test users and an empty control group.

Create the Internal Pilot Team

Your readiness check confirmed Default Directory as the correct Workforce tenant in the Microsoft Entra admin center. You also established the permissions plus licensing boundary for this lab.

The pilot needs visible internal accounts before licensing or password recovery enters the picture. An empty assigned security group creates a controlled starting point for those later tests.

In this step, get ready to:

Create the internal license test user.
Create the internal SSPR test user.
Create the empty pilot security group.

Create the first cloud-only user

A cloud-only identity is created directly in your tenant. Microsoft Entra ID manages its sign-in details within Default Directory.

Switch back to the Microsoft Entra admin center session from earlier.
Select Entra ID in the left navigation.
Select Users.
Select New user.
Select Create new user.
Enter az104-license-user in the User principal name field.

How the sign-in name works

The user principal name prefix identifies the account inside your directory. The tenant's default domain completes the sign-in name.

The generated password is a live credential for this lab. Secure storage keeps it protected during later sign-in tests.

Select the tenant's default domain for the user principal name.
Enter AZ104 License User in the Display name field.
Keep Account enabled selected.
Select Auto-generate password.
Submit the new-user form to create AZ104 License User.
Store the generated initial password in a secure credential store for this lab.

You should see AZ104 License User in the directory as an enabled internal account. That first identity now gives your pilot a real onboarding target.

User not appearing?

Refresh the Users page once.
Confirm that the new-user form used AZ104 License User as the display name.
Still missing the account? Help me troubleshoot the internal user creation.

Create the SSPR test user

The second internal account becomes the subject of the later password-recovery pilot. Its Usage location stays empty as part of the planned test state.

Select New user on the Users page.
Select Create new user.
Enter az104-sspr-user in the User principal name field.
Select the tenant's default domain for the user principal name.
Enter AZ104 SSPR User in the Display name field.
Keep Account enabled selected.
Select Auto-generate password.
Leave Usage location empty.

Preserve the planned test state

The empty Usage location is part of the starting state for the next licensing test.

The second generated password is another live credential. Its secure copy lets you test the account without exposing it.

Submit the new-user form to create AZ104 SSPR User.
Store the generated initial password in a separate secure credential entry for this lab.

You should see AZ104 SSPR User in the directory as an enabled internal account. Your pilot now has both internal test identities ready.

Second user missing?

Refresh the Users page.
Check that the display name is AZ104 SSPR User.
Need help finding the problem? Help me troubleshoot the SSPR test user.

Create the pilot security group

Assigned membership gives you direct control over who enters the pilot. Starting with zero members creates the boundary that later SSPR testing depends on.

Return to Entra ID in the left navigation.
Select Groups.
Select All groups.
Select New group.
Select Security for Group type.
Enter AZ104-Identity-Pilot in the Group name field.
Enter AZ-104 SSPR pilot group in the Group description field.
Select Assigned for Membership type.

What assigned membership controls

Assigned membership changes only when an administrator explicitly updates the group. No user joins this pilot automatically.

Leave Members empty.
Submit the new-group form to create AZ104-Identity-Pilot.

You should see AZ104-Identity-Pilot under All groups. The empty group now gives your pilot a controlled membership boundary.

Group not showing the planned state?

Refresh the All groups page.
Confirm that Membership type is set to Assigned.
Remove any account that appears in the group's members list.
Still seeing the wrong group state? Help me troubleshoot the pilot group.

Before you refresh the directory, do you expect either new user to appear inside the pilot group?

Return to Entra ID.
Select Users.
Refresh the page.

You should see AZ104 License User plus AZ104 SSPR User in the refreshed user list.

Select Groups.
Select All groups.
Refresh the page.
Select AZ104-Identity-Pilot.
Select Members.

You should see an empty members list. This confirms that neither internal user has entered the pilot group.

Your first working identity pilot is in place. Next, you'll add realistic properties before testing the licensing boundary plus the external guest lifecycle.

Manage Properties and Invite a Guest

Your two internal users plus the empty pilot group now form the base of your Microsoft Entra ID pilot. The Microsoft Entra admin center lets you turn those basic directory objects into realistic identities.

Incomplete location data can block a product license in the Microsoft 365 admin center. An external collaborator also follows a different identity lifecycle from an employee.

In this step, get ready to:

Complete the directory property audit.
Expose the direct-license assignment blocker.
Complete the external guest lifecycle.

Update the user and group properties

Profile properties help other administrators understand each account's purpose. A group's Object ID provides a stable reference even when its editable details change.

Switch back to the Microsoft Entra admin center from earlier.
Select Entra ID in the left navigation.
Select Users.
Select AZ104 License User.
Select Edit properties or Properties.
Enter Lab Analyst in Job title.
Enter Operations in Department.
Select Save.

Solid start. AZ104 License User now has the job details of a lab analyst in Operations.

Return to Users.
Select AZ104 SSPR User.
Select Edit properties or Properties.
Enter Support Analyst in Job title.
Enter IT in Department.
Confirm that Usage location remains empty.
Select Save.

AZ104 SSPR User now shows the Support Analyst role in IT. Its empty Usage location remains visible for the licensing test.

Return to Entra ID.
Select Groups.
Select All groups.
Select AZ104-Identity-Pilot.
Select Properties.
Confirm that the description is AZ-104 SSPR pilot group.
Copy the value beside Object ID.
Record the Object ID here: your AZ104-Identity-Pilot Object ID.

Why record the Object ID?

The group name can change. Its description can change.

The Object ID cannot change. It gives you a stable identifier for the same group.

Attempt the direct license assignment

The Billing area can feel high stakes. This check uses only an existing seat available to your tenant. No purchase is required.

Switch back to the Microsoft 365 admin center from earlier.
Select Billing in the left navigation.
Select Licenses.

Before you test the assignment, predict whether the current user profile satisfies the product's licensing checks.

An Eligible Seat Is Available

Select the eligible product you identified earlier.
Select Assign licenses.
Choose AZ104 SSPR User.
Select Assign.

The assignment reports a problem. This planned result proves that the product checked the incomplete user profile.

Select View errors and issues.
Confirm that the details mention An invalid usage location.
Keep Usage location empty for now.

No Assignable Seat Is Available

Confirm that no suitable product has an assignable seat.
Record the unavailable-seat state without starting a purchase or trial.

The Licenses page may report No available licenses for the selected product. This proves that license inventory is the current blocker.

You have found the intended boundary. The assignment is blocked by profile completeness or license inventory.

What did this test isolate?

An eligible product requires a valid country or region in Usage location before it can be assigned. The failed attempt isolates that missing prerequisite.

A tenant without an assignable seat has a separate entitlement blocker. The lab continues without a purchase.

Invite and redeem the external guest

A B2B external identity gives a collaborator a guest record in your directory. Its credentials remain with an external identity provider.

Switch back to the Microsoft Entra admin center from earlier.
Select Entra ID.
Select Users.
Select New user.
Select Invite external user.
Enter your accessible external email address in Email.
Enter AZ104 External Contractor in Display name.
Keep Send invite message selected.

The invitation now targets the external account without creating a tenant-managed password.

Select Review and invite.
Select Invite.

The invitation is on its way. Your directory now has a pending connection to the external collaborator.

Return to the Safari Private Window from earlier.
Sign in to the inbox for your external email address.
Open the invitation email.
Accept the invitation.
Complete the consent flow.

You reach My Apps after redemption. An account without assigned applications can show There are no apps to show.

Why does the guest use external credentials?

The guest record gives your tenant a way to authorize the contractor. The external identity provider continues to authenticate that person.

This keeps the guest's password outside Default Directory. The guest therefore follows a different lifecycle from your internal users.

Before the final refresh, predict which user type the redeemed contractor will show in your directory.

Switch back to the Microsoft Entra admin center.
Select Entra ID.
Select Users.
Refresh the users list.
Find AZ104 External Contractor.
Confirm that User type shows Guest.

That completes the external lifecycle. The redeemed contractor now appears as a Guest in Default Directory.

I Attempted the Assignment

Switch back to the Microsoft 365 admin center.
Select Billing.
Select Licenses.
Select the product used for the assignment attempt.
Refresh the product details page.

You should still see the failed assignment status for AZ104 SSPR User. Its issue details identify the invalid Usage location.

My Tenant Has No Assignable Seat

Switch back to the Microsoft 365 admin center.
Select Billing.
Select Licenses.
Refresh the Licenses page.

You should still see that no suitable product seat is available. This preserves the licensing-limited branch without changing your subscription.

Guest entry not updated?

Refresh the Users page after the external consent flow finishes.
Confirm that you opened the invitation with the same external email address that received it.
Still stuck? Help me troubleshoot guest invitation redemption in Microsoft Entra ID.

Your directory now reflects realistic employee profiles plus an external contractor. Next, you will resolve the licensing dependency before testing the SSPR scope boundary.

Fix Licensing and Scope SSPR

Your Microsoft Entra ID directory now contains two internal users with distinct job properties. The redeemed guest also proves that an external identity keeps its existing authentication provider.

The failed product-license attempt exposed the missing Usage location dependency. You'll correct that property before scoping self-service password reset (SSPR) to the empty pilot group. This test reveals how group membership controls access to tenant-wide recovery settings.

In this step, get ready to:

Correct the SSPR user's Usage location.
Retry or reprocess the product-license assignment when a seat is available.
Scope SSPR to the empty pilot group before testing the membership boundary.

Correct the usage location and retry licensing

A product license depends on the user's service-consumption country or region. Microsoft 365 reads the Usage location property when it processes the assignment.

Return to the Microsoft Entra admin center from earlier.
Select Entra ID in the left menu.
Select Users.
Select AZ104 SSPR User.
Select Edit properties or Properties.
Set Usage location to the country or region where this lab user consumes the service.
Select Save.
Refresh the user's profile.

You should see the selected country or region under Usage location. That clears the profile blocker for AZ104 SSPR User.

Your earlier license audit determines which path applies now. Select the tab that matches the product status in your tenant.

Reprocess the earlier error

This path applies when the failed assignment appears in the product's error list.

Return to the Microsoft 365 admin center from earlier.
Select Billing in the navigation menu.
Select Licenses.
Select the eligible product from earlier.
Open Errors & Issues.
Select AZ104 SSPR User.
Select Reprocess.

The assignment status should show that the product is directly assigned. That's the earlier licensing failure resolved for AZ104 SSPR User.

Retry the direct assignment

This path applies when an eligible seat exists without a previous error entry to reprocess.

Return to the Microsoft 365 admin center from earlier.
Select Billing in the navigation menu.
Select Licenses.
Select the eligible product from earlier.
Select Assign licenses.
Add AZ104 SSPR User.
Select Assign.

The assignment status should show that the product is directly assigned. The user's corrected Usage location now allows the assignment to complete.

No assignable seat is available

A missing seat ends the licensing branch here. This lab never requires a purchase.

Return to the Microsoft 365 admin center from earlier.
Select Billing in the navigation menu.
Select Licenses.
Confirm that no suitable seat is available for AZ104 SSPR User.
Retain the unavailable-license evidence from your earlier attempt.
Continue without purchasing a subscription.

AZ104 SSPR User remains unlicensed. The no-seat result becomes the entitlement evidence for the SSPR test.

License Still Shows an Error?

Confirm that AZ104 SSPR User still displays the country or region you selected under Usage location.
Return to Errors & Issues after correcting the profile.
Select Reprocess for the affected user.
Still stuck? Help me diagnose the product-license assignment for AZ104 SSPR User.

Scope SSPR to the empty pilot group

A selected SSPR scope limits self-service recovery to one chosen group. The empty pilot group creates a controlled boundary that you can test before any user receives recovery access.

Return to the Microsoft Entra admin center from earlier.
Select Entra ID in the left menu.
Select Password reset.
Select Properties.
Set Self service password reset enabled to Selected.
Select AZ104-Identity-Pilot as the scoped group.
Select Save.
Refresh the SSPR Properties page.

You should see Selected with AZ104-Identity-Pilot as the configured group. The group still has no members.

Unable to Save the SSPR Scope?

Confirm that your administrative account has the Authentication Policy Administrator role required for SSPR configuration.
Confirm that AZ104-Identity-Pilot is a Security group with Assigned membership.
Still stuck? Help me configure the selected SSPR group.

Test the user outside the selected group

The pilot group remains empty. The next request tests which boundary SSPR evaluates for AZ104 SSPR User.

Switch back to the Safari Private Window from earlier.
Browse to https://aka.ms/sspr.
Enter the user principal name for AZ104 SSPR User.

Before you submit the CAPTCHA, which boundary do you expect SSPR to evaluate first?

Complete the CAPTCHA to submit the password-reset request.

What Did the Boundary Test Prove?

With eligible licensing, you'll see SSPR_0013: You aren't a member of a group enabled for password reset. Contact your admin and request to be added to the group. This planned result proves that the selected-group scope is active while the pilot group is empty.

Without the required licensing, you'll see SSPR_0012: Your organization doesn't have the required licenses necessary to perform password reset. Contact your admin and ask them to review the license assignments. This result preserves the unavailable-license blocker as evidence.

Seeing a Different Result?

Confirm that the private Safari window is using AZ104 SSPR User.
Check that AZ104 SSPR User is absent from the Members page for AZ104-Identity-Pilot.
Confirm that SSPR Properties still shows Selected with AZ104-Identity-Pilot.
Still stuck? Help me understand my SSPR test result.

The selected-group boundary is now proven. Next up, you'll add the user to the pilot group before completing self-service recovery.

Complete and Test the SSPR Pilot

Your selected-group self-service password reset pilot in Microsoft Entra ID has already exposed its boundary. AZ104 SSPR User could not continue while the pilot group was empty.

Now you will add AZ104 SSPR User to the group. This fixes the group-scope failure.

Eligible licensing lets the user register a recovery method. A successful sign-in proves the recovery flow works.

In this step, get ready to:

Add the internal test user to the selected SSPR pilot group.
Register an email authentication method when licensing permits.
Test the reset flow according to the user's license state.

Add the user to the pilot group

The selected group is the access boundary for SSPR. AZ104 External Contractor stays outside because a B2B guest authenticates through an external identity provider.

Switch back to the Microsoft Entra admin center from earlier.
Select Entra ID in the left navigation.
Select Groups.
Select All groups.
Select AZ104-Identity-Pilot.
Select Members.
Select Add members.
Select AZ104 SSPR User in the member picker.

The internal test user is now staged for membership in the pilot group.

Select Select to add the user.
Select Overview.
Refresh the page.

You should see a member count of one.

Select Members to verify the group's membership.

You should see AZ104 SSPR User as the sole member. AZ104 External Contractor should remain outside the group.

Great progress. Your pilot now has one internal member inside its recovery boundary.

Register the recovery method

Authentication-method registration gives the user a way to prove ownership during password recovery. Eligible licensing unlocks this flow.

The separate Safari Private Window keeps the test user's session isolated from your administrator session. The no-license branch preserves the entitlement evidence without a purchase.

Choose the branch that matches the license state you recorded for AZ104 SSPR User.

✔️ An eligible license is assigned

The assigned license allows AZ104 SSPR User to register security information for password recovery.

Switch back to the Safari Private Window from earlier.
Enter https://aka.ms/ssprsetup in the Smart Search field.
Sign in as AZ104 SSPR User.
Enter the generated password saved earlier when the sign-in page requests the current password.
Create a new lab password if a password-change prompt appears.
Add an email authentication method on the registration page.
Enter your accessible external email address.

The registration service sends a verification code to the external email address.

Retrieve the verification code from the external inbox.
Enter the verification code on the registration page.
Finish the registration when the page confirms your security information.

That recovery method is now ready to verify the user during a password reset.

ⓧ No eligible license is available

The missing entitlement prevents security-information registration. This branch keeps the lab free while preserving evidence of the licensing boundary.

Keep AZ104 SSPR User in its existing unlicensed state.
Retain the no-seat evidence recorded earlier.
Skip authentication-method registration for this branch.
Leave the tenant's billing configuration unchanged.

No purchase is needed. The final reset test records the entitlement blocker instead.

Registration page not completing?

Confirm that the Private Window shows AZ104 SSPR User as the active account.
Return to the pilot group's Members page to confirm that AZ104 SSPR User is still listed.
If you chose the licensed branch, return to the product's assignment status to confirm that the direct license assignment succeeded.
Still blocked? Help me diagnose why AZ104 SSPR User cannot complete SSPR registration.

Reset and verify the password

The group grants access to the recovery flow. The registered email method proves that the internal user controls the recovery address.

During the reset, a CAPTCHA protects the public recovery page from automated requests. Your final result now depends on the user's license state.

Choose the branch that matches the license state used during registration.

✔️ An eligible license is assigned

The test user now has group membership and a registered email method. The reset flow can use both controls.

Switch back to the Safari Private Window from earlier.
Enter https://aka.ms/sspr in the Smart Search field.
Enter the AZ104 SSPR User account.
Complete the CAPTCHA.
Choose the registered email method.
Retrieve the verification code from the accessible external inbox.
Enter the verification code on the reset page.
Set a new password.

The password reset is now complete.

Before you sign in, consider which password should now control the account.

You should see a successful sign-in for AZ104 SSPR User. That proves the user can complete recovery without administrator intervention.

ⓧ No eligible license is available

Group membership fixed the selected-group boundary. The missing license remains as the separate entitlement boundary.

Before you rerun the reset flow, predict whether group membership can replace a missing SSPR entitlement.

Switch back to the Safari Private Window from earlier.
Enter https://aka.ms/sspr in the Smart Search field.
Enter the AZ104 SSPR User account.
Complete the CAPTCHA.

You should see SSPR_0012: Your organization doesn't have the required licenses necessary to perform password reset. Contact your admin and ask them to review the license assignments..

The group change worked. The tenant still blocks password reset because the required entitlement is missing.

In both branches, SSPR remains enabled only for AZ104-Identity-Pilot. AZ104 External Contractor remains outside the group.

Reset flow still blocked?

If you still see SSPR_0013, return to the group's Members page to confirm that AZ104 SSPR User is listed.
If the licensed branch returns SSPR_0012, return to the product's assignment status to confirm that the direct license is successfully assigned.
Need another set of eyes? Help me troubleshoot my final SSPR reset test.

Your controlled pilot now has one scoped internal member. You also have a verified recovery flow or clear evidence of the missing entitlement.

Secret mission

Secret Mission: Replace Direct Licensing with Group-Based Licensing

A direct license handles one user at a time. Build an internal-only assigned security group that provides the same product through group-based licensing. Then remove the direct assignment without interrupting the test user's access.

Clean Up Your Resources

This lab requires no purchase. The options below let you keep the Microsoft Entra ID pilot, pause access, or delete its resources.

Cost warning

Any existing subscription or trial you activated remains governed by the terms displayed in your tenant.

Review the terms shown in your tenant for any trial you activated.
Manage an unwanted trial separately in the Billing area of the Microsoft 365 admin center.

Resources you used:

The cloud-only member accounts AZ104 License User and AZ104 SSPR User.
The redeemed B2B guest account AZ104 External Contractor.
The assigned security group AZ104-Identity-Pilot.
The SSPR configuration scoped to AZ104-Identity-Pilot.
The optional assigned security group AZ104-Licensed-Users when an assignable product license was available.
The optional group-based licensing assignment for AZ104-Licensed-Users when an assignable product license was available.

Keep everything running

Keeping everything preserves the pilot as an AZ-104 identity sandbox. The current SSPR boundary remains limited to the pilot group.

Both internal lab accounts remain enabled with their configured job properties.
The redeemed guest account remains available for external identity demonstrations.
The guest remains outside AZ104-Identity-Pilot.
AZ104 SSPR User remains the sole member of AZ104-Identity-Pilot.
SSPR remains enabled for Selected users through AZ104-Identity-Pilot.
If created, AZ104-Licensed-Users continues to provide the eligible product license to AZ104 SSPR User.

Pause - I'll come back to this later

Pausing removes the test user's SSPR scope while preserving the identities and groups for later study.

Return to the Microsoft Entra admin center from earlier.
Select Entra ID.
Select Groups.
Select All groups.
Select AZ104-Identity-Pilot.
Select Members.
Remove AZ104 SSPR User from the group.
Select Overview.

You should see a member count of zero. The users and group still remain in the tenant.

If AZ104-Licensed-Users exists, pause its product assignment while preserving the group.

Switch back to the Microsoft 365 admin center from earlier.
Select Billing.
Select Licenses.
Select the eligible product assigned to AZ104-Licensed-Users.
Select the AZ104-Licensed-Users group assignment.
Select Unassign licenses.
Refresh the product details page.

You should no longer see AZ104-Licensed-Users as a product assignment. If no assignable product license existed, there is no licensing assignment to pause.

Delete - I don't want to use this again

Deleting a tenant pilot can feel drastic, so the cleanup starts by closing its SSPR scope. Deleted users remain recoverable from Deleted users for 30 days.

Return to the Microsoft Entra admin center from earlier.
Select Entra ID.
Select Password reset.
Select Properties.
Set Self service password reset enabled to None.
Select Save.
Refresh the Properties page.

You should see None for the SSPR setting. The password-reset scope is now closed.

If AZ104-Licensed-Users exists, remove its product assignment before deleting the group.

Switch back to the Microsoft 365 admin center from earlier.
Select Billing.
Select Licenses.
Select the eligible product assigned to AZ104-Licensed-Users.
Select the AZ104-Licensed-Users group assignment.
Select Unassign licenses.
Refresh the product details page.

You should no longer see AZ104-Licensed-Users on the product details page. If no assignable product existed, there is no product assignment or licensing group to remove.

The three lab identities can now be removed without leaving an active SSPR or product assignment attached to them.

Switch back to the Microsoft Entra admin center from earlier.
Select Entra ID.
Select Users.
Select AZ104 License User, AZ104 SSPR User, and AZ104 External Contractor.
Select Delete.
Approve the deletion in the confirmation prompt.
Select Deleted users.

You should see all three lab identities under Deleted users. They remain recoverable there for 30 days.

Deleting the remaining lab groups completes the tenant cleanup.

Return to Entra ID.
Select Groups.
Select All groups.
Select the checkbox for AZ104-Identity-Pilot.
Select the checkbox for AZ104-Licensed-Users only if you created it.
Select Delete.
Approve the deletion in the confirmation prompt.
Refresh All groups.

You should no longer see AZ104-Identity-Pilot or AZ104-Licensed-Users in the group list. Your active tenant is now clear of the identity pilot resources.

Nice Work!

Excellent work. You completed a controlled identity pilot in Microsoft Entra ID for a small project team.

You've learned how to:

Onboard cloud-only members with distinct job properties. You also redeemed a B2B guest whose authentication remains with the external identity provider.
Diagnose license assignment blockers caused by Usage location or product availability. You corrected the user property when an eligible license was available.
Scope self-service password reset to an assigned security group. You proved the membership boundary through a planned failure before completing recovery testing when licensing allowed it.
Complete the Secret Mission by replacing a direct product license with an inherited group-based license through AZ104-Licensed-Users when an assignable product was available.

Ready to quiz yourself?