Ambiguity around identity management paths: Microsoft Graph vs Az.Resources

[alvincent1984]

Description

Hi,

When Microsoft markets Graph and Entra as the successors to MSOnline and AzureAD, it’s reasonable for engineers to assume Az is not part of the identity story—yet the tooling still tells a different story:

==========================

Microsoft has consistently positioned Microsoft Graph PowerShell and Microsoft.Entra PowerShell as the official successors to the now deprecated and retired MSOnline and AzureAD / AzureADPreview modules.

This positioning has been very explicit in:

Microsoft Learn documentation, Blog posts and announcements, and especially Microsoft engineers’ and advocates’ posts on LinkedIn

Based on that messaging, many platform and identity engineers—including myself—made a deliberate architectural decision to:

1. Treat Microsoft Graph / Microsoft.Entra as the identity control plane
2. Treat Az modules strictly as the Azure resource and subscription control plane
3. Actively avoid AzureAD/MSOnline and discourage their use

From Microsoft’s marketing and guidance, it is reasonable to conclude that:

Identity and IAM changes should move forward via Graph/Entra, not Az.

However, in practice, Az.Resources still exposes identity-modifying cmdlets such as:

Update-AzADUser

New-AzADUser

Remove-AzADUser

etc.

What is surprising—and problematic—is that this capability is not clearly documented, positioned, or explained alongside Microsoft’s “Graph is the way forward” narrative.

As a result:

Engineers who closely follow Microsoft guidance end up blocked in customer tenants where Graph write permissions are restricted

Engineers who use Az identity cmdlets complete the same changes immediately via existing RBAC

This creates inconsistent practices, confusion, and a perception that following Microsoft’s recommended path is operationally disadvantageous

This is not an argument that Az identity cmdlets should be removed immediately.
Rather, the issue is lack of explicit guidance.

What’s missing is clarity on:

Whether Az identity cmdlets are:

Transitional

Long-term supported

Operational fallbacks only

When engineers should prefer Graph/Entra

When Az-based identity changes are considered acceptable

How customers should govern identity consistently when multiple mutation paths exist

Today, the reality feels like:

Microsoft.Entra / Graph is marketed as the successor

Az identity cmdlets quietly remain fully functional

Engineers discover this only by accident, not by design

That disconnect between marketing, documentation, and operational behavior is what causes confusion :( especially for platform engineers trying to build clean, future-aligned identity practices.

Thank you!
Alvin

Script or Debug output

Environment data

Module versions

Error output

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• Document decision tree about when to choose Az.Resources or Microsoft.Graph module for Azure AD user and group management #18248

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

Thanks for reporting. Due to Azure user needs to handle AzureAD user, group, application, and service principal with Azure services, Azure PowerShell provides their support in Az.Resources module. So, those four types are our focus.

MicrosoftGraph module serves all services behind MicrosoftGraph API. AzureAD is just a subset. So, if you want to manage objects in MicrosoftGraph API including AzureAD and others such as calendar, email, conversation and so on, MicrosoftGraph is a better choice.

If you only manage AzureAD object in your script, both can support your requirement.

It's a good suggestion that we should tell users in our conceptual doc.

Reference:

• Document decision tree about when to choose Az.Resources or Microsoft.Graph module for Azure AD user and group management #18248 (comment)

Solution 2:

Yes please clear up the confusion and if possible keep to one model that rules it all. At the moment I can not find Invite guest user in either AZ or MSGraph. Kinde hat using 2-3 modules and logon in them for every automation I do.

Reference:

• Document decision tree about when to choose Az.Resources or Microsoft.Graph module for Azure AD user and group management #18248 (comment)

Powered by issue-sentinel