Free guides, interview Q&As, and job responsibility breakdowns — curated by industry veterans to help you crack MNC interviews
Figure 1: Authentication ("Who are you?") vs. Authorization ("What can you do?")
Figure 2: A Microsoft Entra ID Tenant containing Users, Groups, Devices, Applications, Roles, AUs, and security features
Identity
Definition: A unique digital representation of a user, device, application, or service used to verify who is requesting access.
Day-to-Day Example: Like a passport that uniquely identifies you at any international border checkpoint.
Identity Management
Definition: The process of creating, managing, and securing digital identities so the right people get the right access.
Day-to-Day Example: Like an HR department issuing, updating, and revoking employee ID badges as people join, change roles, or leave.
Microsoft Entra ID
Definition: Microsoft's cloud-based Identity and Access Management (IAM) service for authenticating users and controlling access to resources.
Day-to-Day Example: Like a company's central security office that issues every badge and decides which doors each badge can open, across every building.
Authentication
Definition: The process of verifying the identity of a user, device, or application before granting access.
Day-to-Day Example: Like a security guard checking your ID card at the front entrance to confirm you are who you claim to be.
Authorization
Definition: The process of determining what resources and actions an already-authenticated user is allowed to access.
Day-to-Day Example: Like being allowed into your own department's floor after check-in, but not into the server room or executive suite.
Tenant
Definition: A dedicated, isolated instance of Microsoft Entra ID created for one organization, holding all its users, groups, and resources.
Day-to-Day Example: Like a company's own private office building — separate and secured from every other company's building nearby.
User
Definition: An individual account in Microsoft Entra ID representing a person who can sign in and access resources.
Day-to-Day Example: Like a single employee's personal ID badge, unique to them and tied to their own access rights.
Cloud User
Definition: A user account created and managed directly within Microsoft Entra ID.
Day-to-Day Example: Like hiring someone and issuing them a badge made entirely in-house, with no outside paperwork involved.
Guest User
Definition: An external user invited to access an organization's resources or applications with limited permissions.
Day-to-Day Example: Like giving a visiting contractor a temporary visitor badge that only opens the meeting room they need.
Directory Synchronized User
Definition: A user account created in on-premises Active Directory and automatically synced to Microsoft Entra ID.
Day-to-Day Example: Like an employee's existing office badge being automatically linked to a new cloud-based badge system, so both work with the same identity.
Group
Definition: A collection of users used to simplify permission and access management by assigning access once to the whole set.
Day-to-Day Example: Like a team roster — give the whole team access to the shared equipment room at once, instead of unlocking it for each person individually.
Security Group
Definition: A group type used to assign permissions and control access to resources, applications, and services.
Day-to-Day Example: Like a keycard group that opens a specific set of doors for everyone carrying that particular card.
Microsoft 365 Group
Definition: A group type that provides shared collaboration tools like Outlook, Teams, SharePoint, and Planner for its members.
Day-to-Day Example: Like giving a project team a shared office space, whiteboard, and mailbox all bundled together for teamwork.
Multi-Factor Authentication (MFA)
Definition: A security process requiring two or more verification methods to confirm identity before granting access.
Day-to-Day Example: Like needing both a physical key and a fingerprint scan to open a safe — one alone isn't enough.
Self-Service Password Reset (SSPR)
Definition: A feature that lets users reset their own password after verifying their identity, without administrator help.
Day-to-Day Example: Like an ATM letting you reset your card PIN yourself after verifying your identity, instead of visiting a bank teller.
Administrative Unit (AU)
Definition: A logical container that groups users, groups, and devices so administrative rights can be delegated to a specific subset.
Day-to-Day Example: Like giving a regional branch manager keys only to their own branch, not to every branch the company owns.
Role
Definition: A defined set of permissions specifying what actions a user is allowed to perform in Microsoft Entra ID or Azure.
Day-to-Day Example: Like a job title that automatically comes with a specific set of responsibilities and access, such as "manager" or "security guard."
Device (in Microsoft Entra ID)
Definition: A computer, laptop, or mobile phone registered or joined with Microsoft Entra ID for centralized management.
Day-to-Day Example: Like registering a company laptop with IT so it can be tracked, secured, and managed like every other company asset.
Application (in Microsoft Entra ID)
Definition: A cloud or enterprise application that uses Microsoft Entra ID to authenticate users and manage access.
Day-to-Day Example: Like a building that agrees to accept the same universal ID badge system used across the whole business park.
Single Sign-On (SSO)
Definition: A feature allowing a user to log in once and access multiple connected applications without logging in again.
Day-to-Day Example: Like scanning one wristband at an event that then lets you enter every attraction without buying separate tickets.
Figure 3: The Self-Service Password Reset (SSPR) flow
Figure 4: Administrative Units delegating admin control by department
1. Authentication vs. Authorization
Feature Authentication Authorization Confirms Who are you? What are you allowed to do? Order Happens first Happens after authentication Checks Username, password, OTP, MFA Roles and permissions Example Signing in to Azure Managing (or not managing) Virtual Machines
2. Cloud User vs. Guest User vs. Directory Synchronized User
User Type Created/Managed Typical Use Cloud User Directly in Microsoft Entra ID Standard employee accounts Guest User Invited from an external organization External collaborators, contractors Directory Synchronized User On-prem AD, synced via Microsoft Entra Connect Hybrid organizations with existing on-prem AD
3. Security Group vs. Microsoft 365 Group
Feature Security Group Microsoft 365 Group Main purpose Managing permissions and access Collaboration among users Provides Access control to resources Shared mailbox, Teams, SharePoint, Planner Best for Security and access management Teamwork and communication
4. Tenant vs. Subscription
Feature Tenant Subscription Represents The organization's identity boundary The billing/resource management boundary Contains Users, groups, devices, applications Azure resources like VMs, storage, databases Relationship One tenant can have multiple subscriptions Each subscription belongs to one tenant
5. MFA vs. SSPR
Feature MFA SSPR Purpose Verifies identity during sign-in with extra factors Lets users reset their own forgotten password When used Every sign-in (or risk-based triggers) Only when a password needs to be reset Security role Prevents unauthorized access even with a stolen password Keeps password recovery secure via identity verification
6. Administrative Unit vs. Full Tenant Administration
Feature Administrative Unit Full Tenant Administration Scope of control A specific department, group, or location The entire organization Risk if misused Limited to that unit Impacts the whole organization Typical holder Department or branch administrators Global Administrator
7. Identity vs. Identity Management
Concept Identity Identity Management What it is The digital representation itself (a user, device, app) The overall process of creating, controlling, and securing identities Analogy The ID card itself The office that issues, tracks, and revokes ID cards
8. Cloud User vs. Guest User (Access Scope)
Feature Cloud User Guest User Belongs to The organization's own tenant An external organization or personal account Access level Full standard employee access Limited, invitation-based access Example rahul@company.onmicrosoft.com amit@gmail.com invited to a Teams project
9. Role vs. Group
Concept Role Group Defines What actions a user can perform A collection of users for shared management Example Global Administrator, Helpdesk Administrator HR Group, VM Administrators Group Assigned to Individual users or groups Multiple users at once
10. Authentication Methods Compared
Method Type of Factor Password Something you know OTP / SMS / Phone Call Something you have (access to a device/number) Microsoft Authenticator App Something you have (a registered device) Fingerprint / Face Recognition Something you are (biometric)
Q1. What is Identity, and why does every system need one for users?
Answer: An Identity is a unique digital representation of a user, device, application, or service, used to verify who or what is requesting access; without it, a system cannot determine who's asking or what they should be allowed to do.
Q2. What is Identity Management, and what does it help organizations control?
Answer: Identity Management is the process of creating, managing, and securing digital identities, helping organizations ensure the right users have access to the right resources at the right time.
Q3. What is Microsoft Entra ID, and what was it previously called?
Answer: Microsoft Entra ID is Microsoft's cloud-based Identity and Access Management service that authenticates users and controls access to cloud resources; it was previously known as Azure Active Directory (Azure AD) before being renamed in 2023.
Q4. What is the difference between Authentication and Authorization?
Answer: Authentication verifies who a user is using credentials like passwords or MFA, and happens first; Authorization determines what an already-authenticated user is allowed to do, and happens afterward.
Q5. What is a Tenant, and why is it isolated between organizations?
Answer: A Tenant is a dedicated, isolated instance of Microsoft Entra ID created for one organization; it's isolated so that one company's users and resources cannot access another company's tenant unless explicitly permitted.
Q6. What are the three main types of Users in Microsoft Entra ID?
Answer: Cloud User (created directly in Entra ID), Guest User (external, invited with limited access), and Directory Synchronized User (synced from on-premises Active Directory).
Q7. Why do organizations use Groups instead of assigning permissions to individual users?
Answer: Groups let administrators assign a permission once to the whole group, and every member automatically receives it, which is far more efficient than configuring access one user at a time.
Q8. What is the difference between a Security Group and a Microsoft 365 Group?
Answer: A Security Group is used mainly for managing permissions and access to resources, while a Microsoft 365 Group is used for collaboration, providing shared tools like Outlook, Teams, and SharePoint.
Q9. What is Multi-Factor Authentication (MFA), and why is it needed?
Answer: MFA requires two or more verification methods to confirm identity; it's needed because passwords alone can be stolen or guessed, and MFA ensures a stolen password alone isn't enough to gain access.
Q10. What authentication methods does Microsoft Entra ID support for MFA?
Answer: Password, One-Time Password (OTP), Microsoft Authenticator App, SMS verification, phone call verification, fingerprint, and face recognition.
Q11. What is Self-Service Password Reset (SSPR), and what problem does it solve?
Answer: SSPR lets users reset their own password after verifying their identity, without contacting an administrator, which reduces IT workload and gets users back into their accounts faster.
Q12. What are the basic steps in the SSPR process?
Answer: The user selects "Forgot Password," enters their username, verifies identity via OTP/Authenticator/security questions, creates a new password, and signs in with the new password.
Q13. What is an Administrative Unit, and why would a large organization use one?
Answer: An Administrative Unit is a logical container grouping users, groups, and devices so administrative rights can be delegated to a specific subset — useful for large organizations that want department- or location-specific administrators instead of one admin managing everyone.
Q14. What is the relationship between a Tenant and Azure Subscriptions?
Answer: A Tenant represents the organization's identity boundary, while Subscriptions are the billing and resource management boundaries within it — one tenant can contain multiple subscriptions.
Q15. What built-in roles are commonly explored in Microsoft Entra ID, and what do they represent?
Answer: Common built-in roles include Global Administrator (full control), User Administrator (manages users), and Helpdesk Administrator (handles tasks like password resets) — each representing a different, limited set of permissions.
Q1. An employee's password is stolen through phishing, but the attacker still can't log into the company's Azure account. What security feature likely stopped them, and why?
Answer: Multi-Factor Authentication (MFA) likely stopped them, since the attacker had the password but lacked the second verification factor, such as an OTP or Authenticator app approval.
Q2. A company wants an external contractor to collaborate on a Microsoft Teams project without becoming a full employee account in their tenant. What should they create?
Answer: They should create a Guest User, inviting the contractor's external account with limited, specific access rather than creating a full Cloud User account.
Q3. A company already has employee accounts in an on-premises Active Directory and wants those same accounts usable in Microsoft Entra ID without recreating them manually. What should they set up?
Answer: They should set up Directory Synchronization (e.g., using Microsoft Entra Connect) to sync existing on-prem AD accounts as Directory Synchronized Users in Microsoft Entra ID.
Q4. An administrator wants to give 50 employees access to an HR application without configuring each person individually. What should they do?
Answer: They should create a Security Group, add all 50 HR employees to it, and assign the application access to the group once, so every member automatically inherits that access.
Q5. A project team wants a shared mailbox, calendar, and Teams channel for collaboration, not just resource permissions. What type of group fits best?
Answer: A Microsoft 365 Group fits best, since it provides shared collaboration tools like Outlook, Teams, SharePoint, and Planner, unlike a Security Group which only manages access.
Q6. An employee forgets their password late at night when no IT administrator is available. How can they regain access without waiting?
Answer: They can use Self-Service Password Reset (SSPR) — verifying their identity via OTP, Authenticator, or security questions, then creating a new password themselves without needing an administrator.
Q7. A company with HR, Finance, and IT departments wants each department's admin to manage only their own department's users, not the entire organization. What should be configured?
Answer: They should create separate Administrative Units for HR, Finance, and IT, and assign a dedicated administrator to each unit so they can only manage their own department's users, groups, and devices.
Q8. A company has offices in Delhi, Mumbai, and Bengaluru and wants each office's local admin to manage only their own office's users. What Microsoft Entra ID feature enables this?
Answer: Administrative Units enable this — one AU can be created per office/location, each with its own assigned administrator who can manage only that specific office's users and groups.
Related: Azure System Administration - Job Ready Internship Program
