Lab 11: Entra ID Users, Groups and Roles

Overview

In this lab, I extended the Microsoft 365 identity baseline from Labs 05 and 06 into delegated Microsoft Entra administration. The earlier labs created and validated the cloud users, licences, authentication readiness and sign-in evidence. This lab focused on granting first-line support access through separate role-assignable cloud security groups.

CLOUD_Helpdesk_UserAdmins provides delegated password-reset capability through the built-in Helpdesk Administrator role. CLOUD_Helpdesk_LicenseAdmins provides approved licence and service-plan administration through the built-in License Administrator role. Chloe Bennett and Daniel Smith receive both permissions through group membership rather than direct user-level role assignments.

Objective

The objective was to implement a least-privilege Entra support model in which first-line analysts can reset passwords for standard users and manage approved Microsoft 365 licence assignments without receiving broad Global Administrator, User Administrator or Exchange Administrator access.

Environment

Configuration and Evidence

1. Helpdesk Administration Group Created

I created CLOUD_Helpdesk_UserAdmins as an assigned, cloud-only security group for delegated Entra helpdesk administration.

Context: A dedicated group keeps password-reset delegation separate from department access groups, collaboration groups and other administrative roles.

2. Licence Administration Group Created

I created CLOUD_Helpdesk_LicenseAdmins as a separate assigned, cloud-only security group for delegated Microsoft 365 licence administration.

Context: Using a separate group prevents unrelated administrative permissions from being bundled into the password-reset role group.

3. Helpdesk Group Membership Confirmed

I added Chloe Bennett and Daniel Smith to the delegated helpdesk group so the Helpdesk Administrator role can be managed through group membership.

Context: Group-based delegation makes it easier to add or remove first-line analysts without editing role assignments individually.

4. Licence Administration Group Membership Confirmed

I added Chloe Bennett and Daniel Smith to the delegated licence-administration group.

Context: Membership of the licence group can be managed independently from password-reset delegation.

5. Helpdesk Administrator Role Assigned to Group

I assigned the built-in Helpdesk Administrator role to CLOUD_Helpdesk_UserAdmins at directory scope.

Context: Assigning the role to the group rather than directly to Chloe or Daniel keeps the delegation model consistent and auditable.

6. License Administrator Role Assigned to Group

I assigned the built-in License Administrator role to CLOUD_Helpdesk_LicenseAdmins at directory scope.

Context: The licence role supports approved product and service-plan changes without granting broad user, messaging or tenant administration.

7. Helpdesk Group-Side Role Confirmed

I checked the assigned roles view for CLOUD_Helpdesk_UserAdmins and confirmed that the group carries the built-in Helpdesk Administrator role.

Context: This confirms the assignment from the group side as well as from the role assignment page.

8. Licence Group-Side Role Confirmed

I checked the assigned roles view for CLOUD_Helpdesk_LicenseAdmins and confirmed that the group carries the built-in License Administrator role.

Context: The group-side view provides a second verification path for the licence role assignment.

9. Delegated Password Reset Validated

I signed in as Chloe Bennett and confirmed that she could open the password-reset action for a standard user account.

Context: User-side validation proves that the delegated role works from the perspective of a first-line support analyst.

10. Delegated Licence Management Validated

I signed in as Chloe Bennett and confirmed that she could access editable licence controls for a standard user through the delegated License Administrator role.

Context: Service Desk analysts can apply approved standard licence and service-plan changes, while purchasing decisions and exceptional or unclear requests remain subject to approval or escalation.

11. Privileged Password-Reset Boundary Confirmed

I tested the delegated boundary by opening the password-reset action against the daily administrator account. The reset was blocked because Chloe did not have sufficient privilege to reset that administrative account.

Context: The boundary confirms that first-line password-reset capability does not provide unrestricted tenant administration.

Validation

The helpdesk delegation was validated when CLOUD_Helpdesk_UserAdmins existed as an assigned cloud security group, Chloe Bennett and Daniel Smith were confirmed as direct members, and the built-in Helpdesk Administrator role was visible from both the role and group assignment views.

The licence delegation was validated when CLOUD_Helpdesk_LicenseAdmins existed as a separate assigned cloud security group, the same support users were confirmed as direct members, and the built-in License Administrator role was visible from both assignment views.

Operational access was validated by signing in as Chloe Bennett, confirming password-reset access for a standard user, confirming editable licence controls for a standard user, and verifying that the same delegated access did not allow reset of the daily administrator account.

Key Technical Outcomes

This lab demonstrated group-based Microsoft Entra role delegation through separate role-assignable cloud security groups for password support and Microsoft 365 licence administration.

It also demonstrated separation of duties by keeping licence permissions independent from helpdesk password-reset permissions and by validating the boundary protecting an administrative account.