Azure AD now includes group-based licensing

 You can assign one or more product licenses to a group. Azure AD ensures that the licenses are assigned to all members of the group. Any new members who join the group are assigned the appropriate licenses. When they leave the group, those licenses are removed. 

Group-based licensing is currently available only through the Azure portal.

Some Microsoft services are not available in all locations. The administrator, before assigning a license to a user, should specify usage location in the User Profile.

For group license assignment, any users without a usage location specified inherit the location of the directory. 

Azure AD allows you to define two different types of groups. The second characteristic of a group that you need to be aware of is the Membership Type.

 

• Security groups - the most common type of groups and are used to manage member and computer access to shared resources for a group of users. For example, you can create a security group for a specific security policy. By doing it this way, you can give a set of permissions to all the members at once, instead of having to add permissions to each member individually. This option requires an Azure AD administrator.
• Microsoft 365 groups - provide collaboration opportunities by giving members access to a shared mailbox, calendar, files, SharePoint site, and more. This option also lets you give people outside of your organization access to the group. This option is available to users as well as admins. Microsoft 365 groups are often referred to as distribution groups.

The second characteristic of a group that you need to be aware of is the Membership Type. This specifies how individuals members are added to the group. The two types are:

• Assigned - members are added and maintained manually.
• Dynamic - members are added based on rules, creating a Dynamic Group. These groups are still either a security group or Microsoft 365 group, just their members are controlled by rule.

Dynamic groups

Azure AD defines users in three ways:

 

• Cloud identities - These users exist only in Azure AD. Examples are administrator accounts and users that you manage yourself. Their source is Azure Active Directory or External Azure Active Directory if the user is defined in another Azure AD instance but needs access to subscription resources controlled by this directory. When these accounts are removed from the primary directory, they are deleted.
• Directory-synchronized identities - These users exist in an on-premises Active Directory. A synchronization activity that occurs via Azure AD Connect brings these users in to Azure. Their source is Windows Server AD.
• Guest users - These users exist outside Azure. Examples are accounts from other cloud providers and Microsoft accounts such as an Xbox LIVE account. Their source is Invited user. This type of account is useful when external vendors or contractors need access to your Azure resources. Once their help is no longer necessary, you can remove the account and all of their access.

a User Administrator scoped to an administrative unit that contains a group can and can't do the following:

 a User Administrator scoped to an administrative unit that contains a group can and can't do the following:

Permissions	Can do
Manage the name of the group	✔️
Manage the membership of the group	✔️
Manage the user properties for individual members of the group	❌
Manage the user authentication methods of individual members of the group	❌
Reset the passwords of individual members of the group	❌

You can add up to 900 managed domain names. If you're configuring all your domains for federation with on-premises Active Directory, you can add up to 450 domain names in each organization.

 You can add up to 900 managed domain names. If you're configuring all your domains for federation with on-premises Active Directory, you can add up to 450 domain names in each organization.

Configure delegation by using administrative units

 Administrative units are Azure Active Directory (Azure AD) resources that can be containers for other Azure AD resources. An administrative unit can contain only users and groups.

What admin roles are available for an administrative unit?

You can have users in the following roles to manage your administrative unit:

• Authentication administrator
• Groups administrator
• Helpdesk administrator
• License administrator
• Password administrator
• User administrator

 Note

If you are familiar with on-premises Active Directory, this capability was handled by setting up Organizational Units (OUs) in your directory and adding your users to the OU.

Differences between Azure roles and Azure AD roles

 At a high level, Azure roles control permissions to manage Azure resources, while Azure AD roles control permissions to manage Azure AD resources. The following table compares some of the differences.

Azure roles	Azure AD roles
Manage access to Azure resources	Manage access to Azure AD resources
Supports custom roles	Supports custom roles
Scope can be specified at multiple levels (management group, subscription, resource group, resource)	Scope is at the tenant level or can be applied to an Administrative Unit
Role information can be accessed in Azure portal, Azure CLI, Azure PowerShell, Azure Resource Manager templates, REST API Azure AD roles Azure AD roles are used to manage Azure AD resources in a directory. Actions such as create or edit users are the most common. However, the need to assign administrative roles to others, reset user passwords, manage user licenses, and manage domains are common. The following table describes a few of the more important Azure AD roles. Azure AD role Permissions Notes Global Administrator Manage access to all administrative features in Azure Active Directory, and services that federate to Azure Active Directory The person who signs up for the Azure Active Directory tenant becomes the first Global Administrator. Assign administrator roles to others Reset the password for any user and all other administrators User Administrator Create and manage all aspects of users and groups Manage support tickets Monitor service health Change passwords for users, Helpdesk administrators, and other User Administrators Billing Administrator Make purchases Manage subscriptions Manage support tickets Monitors service health	Role information can be accessed in Azure admin portal, Microsoft 365 admin center, Microsoft Graph, Azure AD PowerShell