Entra ID

The right stop

A test user, a group, an app registration? Get off here: it is self-service, with no request and no cost. Plenty of people ride all the way to a lab for nothing.

Vecteezy

Testing authentication, validating a group mapping, running a script under an application identity: none of this requires a lab. Any employee can create users, groups and app registrations in Entra ID, with no cost, no quota, no request and no e-mail.

Open the Microsoft Entra portal →Create users, groups and app registrations, self-service.

What you can create freely

Object	Typical use cases	Cost
Users	Test accounts, validating a sign-in flow, test data for an application role.	None
Groups	Testing membership, role mapping, token claims, dynamic assignment.	None
App registrations	OAuth 2.0 / OIDC, service principal for a script or pipeline, testing consent and permissions.	None

These objects are part of Entra ID’s free features. A license becomes necessary for a user who needs to consume a paid service (Microsoft 365, Entra ID P1/P2 features). A test account that only signs in doesn’t need one.

Nothing expires on its own

That is the fundamental difference with a lab.

	Azure or Proxmox lab	Entra ID object
Lifetime	3 months maximum, enforced	Unlimited
Expiry reminders	Notifications at D-14 and D-7	None
Deletion	Automatic at D0 by the administrators	Never, unless you do it

A forgotten app registration keeps its secrets and permissions indefinitely. A neglected lab disappears; a neglected Entra ID object piles up. Cleaning up is the price of self-service.

What remains your responsibility

Create users, groups and app registrations freely

My responsibility

Any employee can create Entra ID users, groups and app registrations: no cost, no quota, no prior request. No e-mail and no lab needed. What you create, however, remains your responsibility until it is deleted.

Not blockingInternal practice

Delete objects as soon as you are done

My responsibility

Test users, groups and app registrations must be deleted once the need is over. A forgotten app registration keeps its secrets and permissions: unlike a lab, nothing expires it automatically.

MandatoryInternal practice

Short-lived secrets and certificates

Recommendation

Give any app registration secret or certificate the shortest lifetime that covers the need, and prefer renewing over a far-off expiry. Never paste a secret into code or a ticket.

Not blockingInternal practice

Identifiable naming

Recommendation

A name should tell who created it and why without any detective work: for example test-{trigramme}-{objet} for a user or group, and an explicit test purpose for an app registration.

Not blockingInternal practice

What falls outside self-service

Creating objects is open; anything that touches the tenant is not. Go through lab@qiminfo.ch for:

• assigning a privileged directory role (Global Administrator, User Administrator)
• changing a tenant-wide configuration: conditional access, authentication policies, verified domains, consent settings
• granting API permissions that require admin consent
• anything involving client, personal or sensitive data, even for a simple test user

Test data is made up

Copying the name, address or phone number of a real colleague or client contact into a test object creates real personal data in the directory.

How to proceed

1. Open the Microsoft Entra admin center.

2. Create your object with a recognizable name: your trigram and the purpose of the test, for example test-qro-login-b2c. An anonymous name becomes an orphaned object nobody will dare delete.

3. For an app registration, give the secret or certificate the shortest lifetime that covers the need.

4. Write down the deletion date. No reminder will reach you.

5. Once the need is over, delete the object and its secrets.

If I need more than an identity

A need that involves resources (VM, AKS, database, network) is a lab: create my lab. A need for a sharing space belongs in SharePoint, also self-service. The three can be combined; they simply follow separate processes.