Design identity, governance, and monitoring solutions · Topic 3 of 6
Authorizing Access to Azure and On Premises Resources
AZ-305 authorization design: Azure RBAC scopes, Privileged Identity Management, and Application Proxy or Private Access for on premises resources.
- 5 min
- Azure RBAC governs Azure resources, and Entra roles govern the directory. Neither role set can be used in the other's custom roles.
- Global Administrator has no Azure access until it elevates. Classic roles are retired.
- Assign roles to groups at the lowest workable scope. Contributor cannot grant access, and User Access Administrator can.
What it is
Authorization decides what an authenticated identity may do. In Azure, Azure role based access control (Azure RBAC) controls access to Azure resources, and Microsoft Entra roles control access to the directory. Privileged Identity Management (PIM) makes powerful access time limited. For on premises resources, Entra Application Proxy and Entra Private Access let users reach internal apps without a traditional VPN.
How it works
Azure RBAC and Entra roles
| Azure RBAC | Microsoft Entra roles | |
|---|---|---|
| Controls | Azure resources through Azure Resource Manager (VMs, storage, networks) | Entra objects (users, groups, apps, tenant settings) |
| Scope | Management group, subscription, resource group, resource | Tenant, administrative unit, or an object for some roles |
| Examples | Owner, Contributor, Reader, User Access Administrator | Global Administrator, User Administrator |
The two are separate: Entra role permissions cannot be used in Azure custom roles, and the reverse. A Global Administrator does not have access to Azure resources by default. They can elevate access, which grants User Access Administrator at the root scope. The old classic administrator roles are retired, so use RBAC.
A role assignment has three parts: the security principal, the role definition and the scope. Assignments are inherited downward, so assign at the lowest scope that works and prefer groups over individuals. For specific needs, create a custom role. Know that deny assignments are created by services such as deployment stacks and managed applications, and use conditions (ABAC) on role assignments, such as limiting Storage Blob Data access by blob tag.
Key built in roles to know: Owner (full access and can grant access), Contributor (full access, cannot grant access), Reader, User Access Administrator (manages access only), and data plane roles such as Storage Blob Data Contributor and Key Vault Secrets User.
Privileged Identity Management
PIM provides just in time privileged access for Entra roles, Azure roles and PIM for Groups. It needs Entra ID P2 or Entra ID Governance.
| Concept | Meaning |
|---|---|
| Eligible assignment | The user must activate the role first, with MFA, a justification or approval |
| Active assignment | The role is usable without activation |
| Time bound | An assignment with a start and end date |
| Activation duration | Limited, such as 8 hours |
| Approval | Designated approvers must approve the activation |
| Access reviews | Periodic recertification of privileged assignments |
| Alerts and audit | Notifications on role use and a full history |
Recommend eligible, time bound assignments with MFA and approval for roles such as Owner or Global Administrator, and keep a small number of emergency access (break glass) accounts. Service principals cannot be made eligible, but they can have a time limited active assignment.
Authorizing access to on premises resources
| Need | Recommendation |
|---|---|
| Publish an on premises web app to remote users with Entra sign in, no inbound firewall ports | Microsoft Entra Application Proxy with a connector installed on premises |
| Provide non web access (RDP, SSH, SQL, file shares) without a full VPN | Microsoft Entra Private Access (part of Global Secure Access), using the same private network connectors |
| Site to site connectivity between networks | VPN Gateway or ExpressRoute (network chapter) |
| Authenticate legacy LDAP or Kerberos apps in Azure | Microsoft Entra Domain Services |
| Resource based access for on premises servers managed from Azure | Azure Arc with managed identity and RBAC |
Application Proxy uses outbound connections only from a connector to the cloud, applies Conditional Access and pre authentication, and supports single sign on to the internal app. Entra Private Access extends zero trust to any TCP or UDP private resource. Application Proxy requires Entra ID P1 or P2, and Private Access is licensed separately, through the Entra Suite or a Private Access license.
Choosing quickly
| Requirement | Answer |
|---|---|
| Give a team control of one resource group | Contributor on the resource group, assigned to a group |
| An app reads blobs but never writes | Storage Blob Data Reader to its managed identity |
| Admins should only have rights when needed | PIM eligible assignments |
| Remote staff need an internal intranet site, no VPN | Application Proxy |
| A contractor needs RDP to an on premises server, no VPN | Entra Private Access |
A worked scenario
A company wants developers to deploy to a resource group, but only a few engineers to manage subscriptions. The architect assigns Contributor at the resource group to the developer group, makes subscription Owner an eligible PIM assignment with MFA and approval, and keeps two break glass accounts. Remote staff reach an on premises intranet app through Application Proxy with Conditional Access, and contractors use Private Access for RDP to a lab server.
What to remember for the exam
- Azure RBAC governs Azure resources, and Entra roles govern the directory. Neither role set can be used in the other's custom roles.
- Global Administrator has no Azure access until it elevates. Classic roles are retired.
- Assign roles to groups at the lowest workable scope. Contributor cannot grant access, and User Access Administrator can.
- PIM needs Entra ID P2. Use eligible, time bound assignments with MFA and approval.
- Application Proxy publishes web apps with outbound only connectors. Private Access covers non web apps.
"Least privilege" and "only when needed" together mean RBAC at a narrow scope plus PIM.
How the exam asks about this
- "A user must be able to assign roles but not change resources." User Access Administrator.
- "Privileged roles must be granted only for a few hours after approval." PIM eligible assignments with approval.
- "Publish an on premises web app with no inbound ports." Entra Application Proxy.
- "Access RDP on on premises servers with no VPN." Entra Private Access.
Common mistakes
Assigning Owner at the subscription for convenience.
Mixing up Entra roles and Azure roles.
Assigning roles to individuals. Use groups.
Expecting Application Proxy to publish RDP. Private Access does non web.
Check yourself
What does PIM require?
Microsoft Entra ID P2 (or Entra ID Governance).
Which role can manage access but not resources?
User Access Administrator.
Which service publishes an on premises web app with outbound only connectors?
Microsoft Entra Application Proxy.
Topic 3 of 6 in Design identity, governance, and monitoring solutions
Test yourself on Design identity, governance, and monitoring solutions
The full Microsoft AZ-305 question bank has 755 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.