Onboard an Employee with Entra ID

Create and audit a cloud-only employee with group access in Microsoft Entra ID.

Introduction

30 Second Summary

Starting a new job depends on access being ready from day one. Administrators also need proof that each onboarding change succeeded.

In this project, you will complete a realistic joiner workflow for Jordan Lee in Microsoft Entra ID. The audit trail will prove the account, group access, and credential preparation succeeded.

What You'll Build

Your finished workforce tenant tells a complete onboarding story for Jordan Lee, from employee profile to group access to successful audit evidence.

By the end of this project, you'll have:

  • A realistic employee profile where you can find Jordan Lee's Operations job title and department.
  • Visible group-based access through the NW-Operations-Onboarding security group, where Jordan Lee appears as a member.
  • A secure onboarding record that pairs a fresh temporary password with successful audit logs for the user, group, membership, and password actions.
  • Secret Mission: Onboard Sam Rivera in one pass by assigning the existing NW-Operations-Onboarding group during account creation.

Are there any prerequisites?

You need a Mac with internet access, a Microsoft or GitHub account, a phone number, a non-prepaid payment card, and eligibility as a new Azure free account customer. Registration can place a temporary $1 or equivalent authorization on the card, which Microsoft reverses after verification.

Before We Start

This opening checkpoint gets Safari ready for your identity lab. It also captures the fictional onboarding scenario before any tenant work begins.

Set Up Your Free Entra Lab

Practicing employee onboarding inside a workplace directory could affect real identities. This lab needs its own boundary before Jordan Lee is created.

An Azure free account gives this lab an isolated Microsoft Entra ID Free workforce tenant. In this step, you will register the account without creating Azure service resources.

In this step, get ready to:
  • Complete the Azure free account registration.
  • Keep spending protection intact without creating Azure service resources.
  • Identify the tenant name and generated domain in the Microsoft Entra admin center.
Start the free account registration

The official Azure account page keeps the signup on the free path. The offer is available to new Azure customers.

You'll reach the Azure account registration form with About you as the first section.

Why use the generated tenant?

The account registration generates a tenant automatically. Its directory is separate from a production organization.

That boundary lets you practice with fictional users and groups without touching real employee access.

Complete identity verification safely

Azure verifies each free account through phone and card checks. The registration also collects your account details and agreement.

Keep the account free

Entering a card can feel like a purchase. Signup costs nothing unless you explicitly move to Pay-as-you-go.

You may see a temporary $1 or equivalent authorization. Microsoft reverses it after verification.

Spending protection remains intact while the account stays on the free path. This lab creates no Azure service resources.

  • Complete the About you section.
  • Complete Identity verification by phone using your phone number.
  • Complete Identity verification by card using a credit card or non-prepaid debit card.
  • Complete the Agreement section.
  • Keep the account on the free path without moving to Pay-as-you-go.
  • Finish the registration.
  • Skip creating any Azure service resources in the Azure portal.

You'll reach the Azure portal while signed in as the administrator for the new tenant.

You've completed the sensitive account setup. Your free account is ready without any Azure service resources.

Signup not completing?

  • Confirm that you are eligible as a new Azure customer.
  • Confirm that your card is a credit card or non-prepaid debit card.
  • Return to the incomplete registration section to correct any highlighted field.

Help me troubleshoot Azure free account registration.

Find your Microsoft Entra tenant

Azure account registration creates the identity tenant automatically. The Microsoft Entra admin center shows the directory boundary that contains your lab identities.

  • Open a new tab in Safari.
  • Visit https://entra.microsoft.com.
  • Sign in with the same account if prompted.
  • Select Entra ID.
  • Select Overview.

Before you inspect the Overview details, do you expect this page to describe an Azure service resource or your identity tenant?

  • Record the tenant name shown on the Overview page: your tenant name.
  • Record the generated domain shown on the Overview page: <tenant-domain>.onmicrosoft.com.

You'll see the identity tenant's name and its generated .onmicrosoft.com domain. Together, these values confirm that your isolated Microsoft Entra ID Free lab exists.

Why use the admin center?

The admin center lets you follow the employee lifecycle through visible directory records. It keeps this first lab focused on identities and access.

A Microsoft Graph approach adds API consent and permission setup. Those requirements would distract from the onboarding workflow.

Don't see your tenant details?

  • Confirm that the admin center uses the same account from the Azure registration.
  • Return to Entra ID from the left navigation.
  • Select Overview to display the tenant details.

Help me find my Microsoft Entra tenant details.

Your isolated Entra lab is ready. Next, you'll create Jordan Lee and see why an identity still needs an access structure.

Create Jordan Lee and Identify the Access Gap

Your isolated Microsoft Entra ID tenant is ready for a safe test identity. A fictional employee lets you practise the joiner flow without touching a real account.

Creating Jordan Lee gives you an early result that you can inspect. You will then test whether an identity alone provides the access structure needed by Operations.

In this step, get ready to:
  • Create Jordan Lee with an enabled employee account.
  • Add Jordan's Operations job details.
  • Test whether the NW-Operations-Onboarding group exists.
Enter Jordan Lee's identity details

An employee created directly in your tenant becomes a cloud-only user. A user principal name gives that user a unique sign-in identity.

  • In the Entra ID menu from earlier, select Users.
  • Select New user.
  • Select Create new user.

The Basics tab controls the account's sign-in identity. Your tenant domain completes the prefix that you enter.

  • Enter jordan.lee as the prefix in the User principal name field.
  • Confirm the domain selector shows the generated tenant domain that you identified earlier.
  • Enter Jordan Lee in the Display name field.

The form now shows Jordan's full sign-in identity as jordan.lee@<tenant-domain>.onmicrosoft.com.

  • Leave Account enabled selected.
  • Keep Auto-generate password selected.

Protect the Generated Password

Handling a generated password can feel sensitive. This lab does not require you to share it.

  • Keep the password out of screenshots and project notes.
Add Jordan's employee properties

Employee attributes make the identity useful to administrators. The job title identifies Jordan's role. The department places that role in Operations.

  • Select the Properties tab.
  • Keep User type set to Member.
  • Enter Operations Analyst in the Job title field.
  • Enter Operations in the Department field.

Jordan's form now shows a Member identity for an Operations Analyst in the Operations department.

Why Keep Jordan as a Member?

User type and administrator roles are separate controls. This project leaves Jordan without an administrator role to follow least privilege.

  • Select Review + create.
  • Confirm the summary shows jordan.lee@<tenant-domain>.onmicrosoft.com.
  • Confirm the summary shows Operations Analyst as the job title.
  • Confirm the summary shows Operations as the department.
  • Select Create.

Microsoft Entra ID saves the new identity in your tenant.

  • Return to Users in the Entra ID menu.
  • Search for Jordan Lee using the Users search box.
  • Select Jordan Lee from the results.
  • Confirm the profile shows jordan.lee@<tenant-domain>.onmicrosoft.com.

Good progress. Jordan Lee is now a searchable employee identity in your tenant.

Can't Find Jordan Lee?

  • Confirm that you selected Create on the review page.
  • Clear any existing text from the Users search box.
  • Search for Jordan Lee again.

Still missing the user? Help me find Jordan Lee in Microsoft Entra ID.

Verify the user and expose the access gap

Jordan's profile proves that the employee identity exists. The next check tests whether the tenant already has a shared access structure for Operations onboarding.

  • Select Groups in the Entra ID menu.
  • Select All groups.

Before you search, do you expect the tenant to already contain the onboarding group?

  • Search for NW-Operations-Onboarding using the All groups search box.

You will see no matching group. This shortfall is intentional.

Jordan now has an identity. The tenant still has no reusable security group for Operations onboarding.

See a Matching Group?

A matching result means that you may be viewing a different tenant or reusing a tenant with existing lab objects.

  • Return to Entra ID.
  • Select Overview.
  • Confirm the tenant domain matches the domain that you identified earlier.
  • Return to All groups.
  • Search for NW-Operations-Onboarding again.

Still seeing an unexpected group? Help me confirm that I am using the correct Microsoft Entra tenant.

Jordan's employee identity is ready. Next, you will create the missing access group and add Jordan as its first member.

Create the Onboarding Group

Jordan Lee now exists in your isolated Microsoft Entra ID tenant. The missing onboarding group still leaves the employee without the shared access structure used by Operations.

An assigned security group gives this fictional team a reusable access pattern. This step creates that group for Jordan Lee.

In this step, get ready to:
  • Create the NW-Operations-Onboarding assigned security group.
  • Add Jordan Lee as the group's first member.
  • Confirm Jordan Lee appears on the group's Members page.
Create the assigned security group

An assigned membership list keeps access explicit. Each member appears because an administrator selected them.

  • In the Microsoft Entra admin center from earlier, select Entra ID in the left navigation.
  • Select Groups.
  • Select All groups.
  • Select New group.

You will see the group creation form. This form defines the access structure before you add its first member.

  • Set Group type to Security.
  • Enter NW-Operations-Onboarding in the Group name field.

The form now identifies this as a Security group named NW-Operations-Onboarding.

  • Enter Assigned access group for fictional Operations joiners in the Group description field.
  • Set Membership type to Assigned.

Your group now has a clear purpose. Its assigned membership keeps the member list under direct administrator control.

Why assigned membership?

Assigned membership gives administrators direct control over the member list. It fits a small onboarding workflow where each fictional employee is chosen deliberately.

The same group can support future Operations joiners. You avoid rebuilding the access structure for every account.

Add Jordan Lee as a member

Membership connects Jordan Lee's identity to the Operations access pattern. Creating the group saves that relationship in the tenant.

  • Under Members, select the member link.
  • Select Jordan Lee from the member list.

Jordan Lee is now selected for membership in the new group.

  • Select Select.

The group form now shows Jordan Lee under Members.

  • Select Create.
  • Return to All groups.
  • Search for NW-Operations-Onboarding.

You should see NW-Operations-Onboarding in the group list. Good work. The reusable Operations group now exists with Jordan Lee as its first member.

Cannot create the group?

  • Check that Group type shows Security.
  • Check that Group name contains NW-Operations-Onboarding.
  • Confirm the tenant name in the portal header matches your isolated lab tenant.

Help me troubleshoot the group creation form.

Confirm the group membership

The Members page provides direct evidence of who receives the group's access pattern. That evidence confirms the onboarding access gap is closed.

Before you check, consider whether Jordan Lee should already appear in the group's member list.

  • From All groups, select NW-Operations-Onboarding.
  • Select Members.

You should see Jordan Lee in the member list with the user principal name jordan.lee@<tenant-domain>.onmicrosoft.com. The assigned security group now contains the intended fictional employee.

Jordan Lee missing from Members?

  • Refresh the Members page in Safari.
  • If Jordan Lee is still absent, select + Add.
  • Choose Jordan Lee from the user list.
  • Select Select.

Help me fix the missing group membership.

The onboarding group is ready. Next, you will prepare Jordan Lee's controlled first-day credential.

Prepare a First-Day Credential

Jordan Lee now has group-based access through NW-Operations-Onboarding. The account still needs a controlled first credential before handoff.

Microsoft Entra ID can generate a temporary password that Jordan must change at next sign-in. You will protect that live credential while preparing a password-free handoff checklist.

In this step, get ready to:
  • Reset Jordan Lee's password to generate a temporary credential.
  • Store the credential outside your project notes.
  • Create a password-free handoff checklist with Jordan's user principal name.
Generate a temporary password

A password reset replaces Jordan's initial credential with a fresh Microsoft Entra-generated value. Jordan must change it during the next sign-in.

This is the sensitive part of the step. Only Jordan's secure handoff location should receive the value.

  • Return to Entra ID in the Microsoft Entra admin center from earlier.
  • Select Users in the left navigation.
  • Enter Jordan Lee in the search field.
  • Select Jordan Lee in the results.
  • Select Reset password on Jordan's profile.

Before you confirm the reset, make a quick prediction about the credential result.

  • Confirm the reset by selecting Reset password again.

Microsoft Entra displays a newly generated temporary password for Jordan.

Can't reset Jordan's password?

  • Confirm that Jordan Lee is the selected user in your isolated tenant.
  • Confirm that you are still signed in as the tenant administrator.

Help me troubleshoot the password reset action.

Secure the generated credential

The generated value is a live credential. It belongs in a secure temporary handoff location that is separate from your project evidence.

  • Copy the displayed temporary password.
  • Paste the temporary password into your secure temporary handoff location.
  • Confirm that your project notes do not contain the temporary password.

That sensitive step is complete. Jordan now has a fresh credential without exposing it in the project record.

Why mention multifactor authentication?

New Microsoft Entra tenants use security defaults.

Security defaults can require multifactor authentication registration at first sign-in. The checklist prepares Jordan for that prompt without extending this lab into a real employee sign-in.

Create the password-free handoff checklist

The checklist separates safe handoff instructions from the live credential. Password reset leaves Jordan's group membership in place.

Jordan also remains a Member user with no administrator role.

  • Select Users in the left navigation.
  • Search for Jordan Lee.
  • Select Jordan Lee in the results.
  • Record the User principal name shown on Jordan's profile here: jordan.lee@<tenant-domain>.onmicrosoft.com.
  • Create a section titled First-day handoff checklist in your secure handoff location.
  • Add jordan.lee@<tenant-domain>.onmicrosoft.com to the checklist.
  • Add change the temporary password at next sign-in to the checklist.
  • Add register multifactor authentication if prompted to the checklist.

Before you inspect the checklist, predict whether any password characters should appear.

  • Review the completed checklist.

You should see Jordan's full user principal name plus two first-sign-in instructions. The temporary password should be absent.

That's the sensitive handoff done. Your record now guides Jordan without exposing the live credential.

Your first-day credential is ready for secure handoff. Next, you'll prove each onboarding action in the Microsoft Entra audit logs.

Verify the Audit Evidence

Jordan Lee now has group-based access. A temporary first-day credential is ready for secure handoff.

The employee profile shows only the current state. The full onboarding history needs evidence from the directory.

Microsoft Entra ID audit logs connect each change to the administrator who made it. They also record whether each action succeeded.

In this step, get ready to:
  • Limit the audit evidence to the last 24 hours.
  • Verify the employee creation and password activities.
  • Verify the group creation and membership activities.
Set the audit window

A busy tenant can collect many directory events. The 24 hours window keeps this project's onboarding actions within reach.

  • Switch back to Safari.
  • Select Entra ID in the Microsoft Entra admin center.
  • Select Monitoring & health in the Entra ID menu.
  • Select Audit logs.
  • Set Date range to 24 hours.

You'll see the directory activities recorded during the last 24 hours.

What Do Audit Logs Prove?

Each audit event identifies a directory activity. Its details connect that activity to a target.

The event status shows whether the activity succeeded. The initiator identifies the administrator responsible for the change.

Verify the employee events

Employee onboarding began when you created Jordan Lee. The corresponding user event proves that the identity was added successfully.

  • Select the Category filter.
  • Choose UserManagement.
  • Select the Activity filter.
  • Choose Add user.
  • Select the Status filter.
  • Choose the option for successful activities.
  • Select the Target filter.
  • Choose Jordan Lee as the target.

You'll see the successful account creation activity for Jordan Lee.

  • Select the Initiated by filter.
  • Choose your signed-in tenant administrator account.
  • Open the matching Add user row.
  • Confirm that the activity succeeded.
  • Confirm that Jordan Lee is the target.
  • Confirm that your tenant administrator account initiated the activity.

You have now connected Jordan Lee's identity to the administrator action that created it.

The password reset is the next stage in the user history. Its audit event proves that a new first-day credential was generated.

  • Return to the audit log table.
  • Change the Activity filter to Reset password.
  • Open the matching successful row.
  • Confirm that Jordan Lee is the target.
  • Confirm that your tenant administrator account initiated the activity.

That's the user lifecycle proven. You now have successful evidence for identity creation and credential preparation.

Missing a User Event?

  • Confirm that Date range remains set to 24 hours.
  • Clear the Target filter if Jordan Lee does not appear.
  • Apply the Activity filter again after the table reloads.

Help me find the missing user audit event.

Verify the group events

The group events prove that the reusable access structure was created. They also prove that Jordan Lee received membership in that structure.

  • Return to the audit log table.
  • Change the Category filter to GroupManagement.
  • Change the Activity filter to Add group.
  • Set the Target filter to NW-Operations-Onboarding.
  • Open the matching successful row.
  • Confirm that NW-Operations-Onboarding is the target.
  • Confirm that your tenant administrator account initiated the activity.

The opened event proves that the assigned security group was created successfully.

  • Return to the audit log table.
  • Change the Activity filter to Add member to group.
  • Clear the Target filter.
  • Open the matching successful row.
  • Confirm that the event identifies NW-Operations-Onboarding.
  • Confirm that the event identifies Jordan Lee.
  • Confirm that your tenant administrator account initiated the activity.

The membership event proves that Jordan Lee received the intended group-based access.

Missing a Group Event?

  • Confirm that the Category filter uses GroupManagement.
  • Clear the Target filter to reveal every matching group activity.
  • Apply the Activity filter again after the table reloads.

Help me find the missing group audit event.

Before the final check, which four activities should cover the complete onboarding story?

  • Confirm that a successful Add user event targets Jordan Lee.
  • Confirm that a successful Reset password event targets Jordan Lee.
  • Confirm that a successful Add group event targets NW-Operations-Onboarding.
  • Confirm that a successful Add member to group event identifies NW-Operations-Onboarding.
  • Confirm that the membership event identifies Jordan Lee.

You have closed the loop on Jordan Lee's onboarding. The audit trail now proves the user, group, membership, and credential actions succeeded.

Secret mission

Onboard a Second Employee in One Pass

Repeat the joiner workflow for Sam Rivera in a single account-creation pass. Assign the existing NW-Operations-Onboarding group during creation. Confirm the result in the member list and audit logs.

Clean Up Your Resources

Clean Up Your Resources

This lab uses Microsoft Entra ID Free. It creates no Azure service resources or paid licenses.

Keeping the tenant's fictional users and group creates no ongoing project cost. Decide whether to keep these resources available or remove the directory objects you created.

Resources you used:

  • The enabled cloud-only user Jordan Lee.
  • The enabled cloud-only user Sam Rivera.
  • The assigned security group NW-Operations-Onboarding.

Keep everything running

No action is needed. Choose this if you want to reuse the isolated tenant for another identity project.

  • Retain Jordan Lee as a fictional Operations employee for future access exercises.
  • Retain Sam Rivera as a second fictional employee for future onboarding exercises.
  • Keep NW-Operations-Onboarding as a reusable group-based access pattern.
  • Leave the Azure free account on its current free path.

Your tenant keeps both employee records and their audit evidence available without creating an ongoing project charge.

Pause - I'll come back to this later

End your administrator session while leaving the tenant's directory objects unchanged for next time.

  • Sign out of the Microsoft Entra admin center using your tenant administrator account.
  • Close Safari.

Jordan Lee and Sam Rivera remain enabled. Their membership in NW-Operations-Onboarding also remains intact.

Delete - I don't want to use this again

Remove the project-created users and group so the directory is ready for a fresh start. Deleting the lab identities can feel drastic, but deleted users remain recoverable for 30 days.

  • In the Microsoft Entra admin center from earlier, select Entra ID.
  • Select Users.
  • Select Jordan Lee from the user list.
  • Select Delete user.
  • Confirm the deletion.
  • Select Deleted users to confirm that Jordan Lee appears there.

Jordan Lee is removed from the active user list. The account remains recoverable during the 30 days after deletion.

  • Return to Users.
  • Select Sam Rivera from the user list.
  • Select Delete user.
  • Confirm the deletion.
  • Select Deleted users to confirm that both fictional employees appear there.

Both fictional employees are now removed from the tenant's active user list.

  • Remove Jordan Lee's temporary password from the secure temporary handoff location you used.

The password-free handoff checklist can remain as evidence of the process because it contains no temporary password.

  • Select Entra ID.
  • Select Groups.
  • Select All groups.
  • Select NW-Operations-Onboarding.
  • Select Delete.
  • Confirm the deletion.
  • Return to All groups.
  • Search for NW-Operations-Onboarding.

You should see no matching group. Your Azure free account and isolated tenant remain available for future projects.

Nice Work!

Nice Work!

You did it! You built an auditable employee onboarding workflow in an isolated Microsoft Entra ID Free tenant.

You've learned how to:

  • Complete a secure first-day handoff for Jordan Lee with a realistic cloud identity.
  • Close the identity-to-access gap through group-based access in the assigned NW-Operations-Onboarding security group.
  • Prove the joiner workflow with successful audit evidence for user, group, membership, and password actions.
  • Secret Mission: Onboard Sam Rivera in one pass by assigning the existing NW-Operations-Onboarding group during account creation.

Ready to quiz yourself?