AZ-800 Exam Alignment
AZ-800

Manage AD DS objects: Create and manage user accounts, group types and scopes, and computer accounts. Understand the AGDLP nesting strategy and automate bulk operations with PowerShell.

• Know all three group scopes (Domain Local, Global, Universal) and when each is used
• Understand the AGDLP nesting model — Accounts into Global groups, Global into Domain Local, Domain Local assigned Permissions
• Know which group scope can contain members from any domain in the forest (Universal)
• Understand the difference between Security and Distribution groups and when to use each

Exam Tip: AZ-800 tests group scope nesting rules precisely. Remember: Universal Groups can contain users and groups from any domain in the forest and are expanded at logon (requiring GC contact). Excessive Universal Groups contribute to GC load and logon latency.

👤 User Accounts

Every person who needs access to domain resources requires a user account. User accounts in AD DS have required and optional attributes that affect authentication, mail routing, and management.

Active Directory Users and Computers
|
Users Container

🌎 techcareers.local

📁 Builtin

💻 Computers

🏗️ Domain Controllers

👤 Users

📁 HR

📁 IT

Users container

Name	Type	UPN
John Smith	User	jsmith@techcareers.local
IT-Admins	Security Group (Global)	—
Domain Admins	Security Group (Global)	—

ⓘ Best practice: move users and groups to dedicated OUs, not the default Users container. GPOs cannot be linked to the default Users container.

👥 Group Types and Scopes — AGDLP

Understanding group types and scopes is one of the most tested AD topics in interviews and on AZ-800. Use the AGDLP nesting model for scalable permission management.

💻 Computer Accounts and Domain Join

Computer accounts authenticate workstations and servers to the domain, enable Group Policy application, and are required for Kerberos authentication. A computer account is created automatically when a machine joins the domain.

# Create a new user account
New-ADUser -Name 'John Smith' -SamAccountName 'jsmith' -UserPrincipalName 'jsmith@techcareers.local' -Path 'OU=HR,DC=techcareers,DC=local' -AccountPassword (ConvertTo-SecureString 'P@ssw0rd!' -AsPlainText -Force) -Enabled $true

# Modify user properties
Set-ADUser -Identity jsmith -Title 'HR Manager' -Department 'Human Resources'

# Create a Global Security group (for user role grouping)
New-ADGroup -Name 'TC-HR-Users' -GroupScope Global -GroupCategory Security -Path 'OU=Groups,DC=techcareers,DC=local'

# Create a Domain Local group (for resource permission assignment)
New-ADGroup -Name 'TC-FileShare-HR-Read' -GroupScope DomainLocal -GroupCategory Security -Path 'OU=Groups,DC=techcareers,DC=local'

# Add user to Global group, then nest Global into DomainLocal (AGDLP)
Add-ADGroupMember -Identity 'TC-HR-Users' -Members jsmith
Add-ADGroupMember -Identity 'TC-FileShare-HR-Read' -Members 'TC-HR-Users'

# Bulk create users from CSV file
Import-Csv C:\users.csv | ForEach-Object {
    New-ADUser -Name $_.Name -SamAccountName $_.Username -Enabled $true -AccountPassword (ConvertTo-SecureString $_.Password -AsPlainText -Force)
}

# Join a computer to the domain
Add-Computer -DomainName 'techcareers.local' -Credential (Get-Credential) -Restart

💡 Best Practices

• Move all users and groups out of the default Users container into dedicated OUs — GPOs cannot be linked to the built-in Users container
• Follow the AGDLP model consistently — never assign permissions directly to user accounts; always use groups
• Use Global groups for role-based grouping (TC-IT-Admins, TC-HR-Users) and Domain Local groups for resource access (TC-FileShare-Finance-Read)
• Minimise Universal Group usage — their membership is stored in the global catalog and expanded at every logon, increasing GC load
• Set account expiry dates for all contractor and temporary accounts at creation time — never rely on manual disabling
• Implement a naming convention for all accounts and groups before deployment (e.g., TC-[Department]-[Role] for groups)

🎓 Interview Q&A