blocking sign-in stops new authentication without deleting the account and its potentially needed evidence. In this case, an administrator must create a cloud-only employee identity without synchronizing an on-premises directory. “Block sign-in on the existing Entra user” would not satisfy that requirement; the supported action is “A new Microsoft Entra user in the tenant”. A cloud-only Entra user is independently managed in the tenant rather than synchronized from an external directory.

changing a property preserves the existing object and its app assignments rather than replacing the identity. In this case, an administrator must create a cloud-only employee identity without synchronizing an on-premises directory. “The user's display name on the existing Entra object” would not satisfy that requirement; the supported action is “A new Microsoft Entra user in the tenant”. A cloud-only Entra user is independently managed in the tenant rather than synchronized from an external directory.

authentication can be disabled temporarily while leaving the user object and intended access relationships intact. In this case, an administrator must create a cloud-only employee identity without synchronizing an on-premises directory. “Keep the user's sign-in blocked until activation” would not satisfy that requirement; the supported action is “A new Microsoft Entra user in the tenant”. A cloud-only Entra user is independently managed in the tenant rather than synchronized from an external directory.

Direct app assignments could grant the employee comparable permissions today, but each application would then require separate maintenance. They can drift as the finance group changes. Joining the existing group avoids this duplication.

Changing a display name does not add group membership or application entitlements. The employee would still lack the finance group’s assigned applications.

Blocking sign-in prevents authentication rather than granting the requested finance applications. A valid employee must be assigned to the correct existing access group.

blocking sign-in stops new authentication without deleting the account and its potentially needed evidence. In this case, a renamed employee must keep access while their displayed surname changes. “Block sign-in on the existing Entra user” would not satisfy that requirement; the supported action is “The user's display name on the existing Entra object”. Changing a property preserves the existing object and its app assignments rather than replacing the identity.

a cloud-only Entra user is independently managed in the tenant rather than synchronized from an external directory. In this case, a renamed employee must keep access while their displayed surname changes. “A new Microsoft Entra user in the tenant” would not satisfy that requirement; the supported action is “The user's display name on the existing Entra object”. Changing a property preserves the existing object and its app assignments rather than replacing the identity.

group membership lets existing group assignments provide consistent access without repeating assignments on the user. In this case, a renamed employee must keep access while their displayed surname changes. “Add the employee to the existing finance security group” would not satisfy that requirement; the supported action is “The user's display name on the existing Entra object”. Changing a property preserves the existing object and its app assignments rather than replacing the identity.

changing a property preserves the existing object and its app assignments rather than replacing the identity. In this case, an employee leaves permanently and must immediately lose cloud sign-in access while an investigation continues. “The user's display name on the existing Entra object” would not satisfy that requirement; the supported action is “Block sign-in on the existing Entra user”. Blocking sign-in stops new authentication without deleting the account and its potentially needed evidence.

a cloud-only Entra user is independently managed in the tenant rather than synchronized from an external directory. In this case, an employee leaves permanently and must immediately lose cloud sign-in access while an investigation continues. “A new Microsoft Entra user in the tenant” would not satisfy that requirement; the supported action is “Block sign-in on the existing Entra user”. Blocking sign-in stops new authentication without deleting the account and its potentially needed evidence.

b2B guest access supports cross-organization collaboration without creating an ordinary internal employee identity. In this case, an employee leaves permanently and must immediately lose cloud sign-in access while an investigation continues. “Invite the contractor as an external guest user” would not satisfy that requirement; the supported action is “Block sign-in on the existing Entra user”. Blocking sign-in stops new authentication without deleting the account and its potentially needed evidence.

a cloud-only Entra user is independently managed in the tenant rather than synchronized from an external directory. In this case, a contractor uses an account managed by another company and needs invited collaboration. “A new Microsoft Entra user in the tenant” would not satisfy that requirement; the supported action is “Invite the contractor as an external guest user”. B2B guest access supports cross-organization collaboration without creating an ordinary internal employee identity.

authentication can be disabled temporarily while leaving the user object and intended access relationships intact. In this case, a contractor uses an account managed by another company and needs invited collaboration. “Keep the user's sign-in blocked until activation” would not satisfy that requirement; the supported action is “Invite the contractor as an external guest user”. B2B guest access supports cross-organization collaboration without creating an ordinary internal employee identity.

blocking sign-in stops new authentication without deleting the account and its potentially needed evidence. In this case, a contractor uses an account managed by another company and needs invited collaboration. “Block sign-in on the existing Entra user” would not satisfy that requirement; the supported action is “Invite the contractor as an external guest user”. B2B guest access supports cross-organization collaboration without creating an ordinary internal employee identity.

group membership lets existing group assignments provide consistent access without repeating assignments on the user. In this case, an administrator wants to avoid separately assigning the same security group to 75 new staff. “Add the employee to the existing finance security group” would not satisfy that requirement; the supported action is “Add users through managed group membership”. Group membership centralizes access changes that otherwise would require many user-level changes.

authentication can be disabled temporarily while leaving the user object and intended access relationships intact. In this case, an administrator wants to avoid separately assigning the same security group to 75 new staff. “Keep the user's sign-in blocked until activation” would not satisfy that requirement; the supported action is “Add users through managed group membership”. Group membership centralizes access changes that otherwise would require many user-level changes.

an identity consolidation without mapping group and app access can unexpectedly remove permissions or retain excess access. In this case, an administrator wants to avoid separately assigning the same security group to 75 new staff. “Review object assignments before consolidating the duplicate identities” would not satisfy that requirement; the supported action is “Add users through managed group membership”. Group membership centralizes access changes that otherwise would require many user-level changes.

blocking sign-in stops new authentication without deleting the account and its potentially needed evidence. In this case, a temporary team member's identity exists but must not be usable until their start date. “Block sign-in on the existing Entra user” would not satisfy that requirement; the supported action is “Keep the user's sign-in blocked until activation”. Authentication can be disabled temporarily while leaving the user object and intended access relationships intact.

a cloud-only Entra user is independently managed in the tenant rather than synchronized from an external directory. In this case, a temporary team member's identity exists but must not be usable until their start date. “A new Microsoft Entra user in the tenant” would not satisfy that requirement; the supported action is “Keep the user's sign-in blocked until activation”. Authentication can be disabled temporarily while leaving the user object and intended access relationships intact.

group membership lets existing group assignments provide consistent access without repeating assignments on the user. In this case, a temporary team member's identity exists but must not be usable until their start date. “Add the employee to the existing finance security group” would not satisfy that requirement; the supported action is “Keep the user's sign-in blocked until activation”. Authentication can be disabled temporarily while leaving the user object and intended access relationships intact.

changing a property preserves the existing object and its app assignments rather than replacing the identity. In this case, two users were accidentally created for one employee, each with different app assignments. “The user's display name on the existing Entra object” would not satisfy that requirement; the supported action is “Review object assignments before consolidating the duplicate identities”. An identity consolidation without mapping group and app access can unexpectedly remove permissions or retain excess access.

group membership lets existing group assignments provide consistent access without repeating assignments on the user. In this case, two users were accidentally created for one employee, each with different app assignments. “Add the employee to the existing finance security group” would not satisfy that requirement; the supported action is “Review object assignments before consolidating the duplicate identities”. An identity consolidation without mapping group and app access can unexpectedly remove permissions or retain excess access.

a cloud-only Entra user is independently managed in the tenant rather than synchronized from an external directory. In this case, two users were accidentally created for one employee, each with different app assignments. “A new Microsoft Entra user in the tenant” would not satisfy that requirement; the supported action is “Review object assignments before consolidating the duplicate identities”. An identity consolidation without mapping group and app access can unexpectedly remove permissions or retain excess access.

group-based access aligns the entitlement with team membership and reduces individual configuration drift. In this case, an organization needs automatically calculated membership for employees with department set to Sales. “Assign the app to a security group and maintain membership” would not satisfy that requirement; the supported action is “A dynamic membership rule based on the department attribute”. Dynamic membership recalculates eligible users from their properties rather than requiring manual additions.

automatic membership depends on matching directory attributes and membership-rule evaluation. In this case, an organization needs automatically calculated membership for employees with department set to Sales. “Validate the employee attributes against the dynamic rule” would not satisfy that requirement; the supported action is “A dynamic membership rule based on the department attribute”. Dynamic membership recalculates eligible users from their properties rather than requiring manual additions.

an owner can be authorized to maintain group properties and membership without replacing the group. In this case, an organization needs automatically calculated membership for employees with department set to Sales. “Change the designated group's owner” would not satisfy that requirement; the supported action is “A dynamic membership rule based on the department attribute”. Dynamic membership recalculates eligible users from their properties rather than requiring manual additions.

security groups are appropriate subjects for Azure RBAC role assignments and access control. In this case, a team must remove a former employee's access to a security group without deleting their account. “A Microsoft Entra security group” would not satisfy that requirement; the supported action is “Remove the user from the security group's members”. Removing group membership changes the resulting assignments while retaining the directory identity.

editing metadata preserves the same group identity and its memberships and downstream access assignments. In this case, a team must remove a former employee's access to a security group without deleting their account. “Edit the existing group's description property” would not satisfy that requirement; the supported action is “Remove the user from the security group's members”. Removing group membership changes the resulting assignments while retaining the directory identity.

group-based access aligns the entitlement with team membership and reduces individual configuration drift. In this case, a team must remove a former employee's access to a security group without deleting their account. “Assign the app to a security group and maintain membership” would not satisfy that requirement; the supported action is “Remove the user from the security group's members”. Removing group membership changes the resulting assignments while retaining the directory identity.