🏢 Entra Groups & Workspace Identities

Explained like you're 5

Imagine Fabric is a big office building with lots of rooms. Each room has stuff inside it: reports, data, dashboards. Some rooms are for everyone, some are private.

This is the story of who gets to open which doors. 🚪

Meet the Characters

👤

The Person

A real human. Has a name. Comes to work each day.

Example: Jamie from Finance.

👥

The Badge Group

A bucket of people who all do the same kind of job. Everyone in the bucket gets the same badge.

Example: "Finance-Viewers" badge — anyone wearing it can open the Finance reading rooms.

🤖

The Robot Helper (Workspace Identity)

A little robot that lives inside one room and does chores. It has its own badge too. The robot never goes home — it's just there to fetch things.

Example: "Sales-Dashboard-Robot" — lives in the Sales room, fetches data from the Warehouse room every morning.

🚪

The Doors

Doors don't know names. Doors just check badges.

The One Big Rule

🟢 Give badges to groups. Put people and robots into the right groups.

🔴 Don't hand badges out to one person or robot at a time. You'll lose track.

That's it. That's the whole idea.

How It Works — The Picture

👤 Jamie 👤 Pat 👤 Sam \ | / \ | / +---> 👥 "Finance-Viewers" badge ---> 🚪 Finance Reports Room ▲ | 🤖 Robot can wear it too!

If Jamie quits, you just take their name out of the bucket. The door is untouched. The badge is untouched. Easy.

If you add Riya next week, you drop her name into the bucket. Done. She can open every door that badge opens.

Three Bedtime Stories

📖 Story 1

A New Hire Shows Up

😩 Without groups

A new analyst joins. You walk around the building unlocking 12 doors for her one at a time. You forget door #7. She emails you tomorrow. You unlock it. You forget door #9. Repeat for a week.

😎 With groups

You drop her name in the "Finance-Viewers" bucket. She walks into work and every Finance door opens. You go get coffee.
📖 Story 2

The Sales Report Needs Yesterday's Data

The Sales dashboard lives in the Sales Room. The data lives in the Warehouse Room next door.

Every morning at 6am, the dashboard needs fresh numbers. But there's no human at 6am to open the Warehouse door.

So we use the Sales Room's robot 🤖. We give the robot a badge that opens the Warehouse door. At 6am the robot walks over, opens the door, grabs the numbers, walks back. Dashboard updated. Nobody woke up.

The robot has no password. Its badge is just… part of being the robot. Way safer than handing out a key that someone could steal.

📖 Story 3

The Robot Needs to Open a Door Outside the Building

Sometimes the robot needs to fetch things from another building (Azure — like Key Vault or a data lake).

The other building's doors also check badges. So we make a special bucket called "Lake-Readers" over there, and we tell those doors "open for anyone wearing this badge."

Then we drop our robot's name into that bucket. 🤖 + 👥 = door opens.

The cool part: if we ever build a second robot that also needs lake access, we just drop its name in the same bucket. No new door rules. No phone call to the other building's security guard.

The Two Kinds of Buckets

Bucket typeWhat goes in itExample name
👥 People bucketsHumans onlyFinance-Viewers, HR-Admins
🤖 Robot bucketsWorkspace Identities onlyLake-Readers, KeyVault-Readers

Keep them separate. People buckets are for people. Robot buckets are for robots. Don't mix — it gets confusing fast.

When Something Goes Wrong

ProblemFix
"Sam left the company!"Take Sam out of every people bucket. Done.
"The robot is reading stuff it shouldn't!"Take the robot out of that bucket. Done.
"We deleted the whole Sales Room!"The robot disappears too. It was part of the room. The buckets are still fine. The doors are still fine.
"A new team needs the same access as Finance!"Make them their own bucket. Give it the same door permissions. Drop the team in.

🧠 What to Remember

  1. Doors check badges, not names. Always give permission to a group, never to one person or robot.
  2. People go in people buckets. Robots go in robot buckets. Same idea, different bucket.
  3. Robots live in one room. They're great for chores like "fetch data" and "refresh a dashboard." When the room goes away, so does the robot.
  4. The robot never has a password. Its identity is just… being the robot. That's the magic. 🪄
That's it. You now understand Fabric security. 🎉