Identity, Access and Security

What it is

Identity is who a user or application is. Access is what that identity may do. Security is the set of protections around both.

Azure handles identity with Microsoft Entra ID, controls access with roles and policies, and protects workloads with layered security and monitoring. The exam tests the purpose of each piece.

How it works

Directory services

Microsoft Entra ID is Microsoft's cloud identity and access management service. It holds users, groups and applications, and signs people in to Azure, Microsoft 365 and thousands of other apps. It was formerly called Azure Active Directory.

Microsoft Entra Domain Services gives you managed domain services such as domain join, group policy, LDAP and Kerberos in Azure, without running your own domain controllers.

Authentication methods

• Single sign on (SSO): sign in once and reach many applications without signing in again.
• Multifactor authentication (MFA): requires two or more kinds of proof, such as something you know, something you have and something you are.
• Passwordless: replaces the password with something stronger, such as Windows Hello for Business, the Microsoft Authenticator app or a FIDO2 security key.

External identities

External identities let people outside your organization, such as partners and customers, use your resources or apps with identities they already have. Guests can be invited to collaborate with the organization's resources, and applications can offer sign in to customers. Microsoft Entra External ID is the service that covers this.

Conditional Access

Conditional Access is an if then policy engine. It looks at signals such as the user, location, device and sign in risk, and then decides to allow access, block it, or require something extra such as MFA or a compliant device. It needs Microsoft Entra ID P1 or higher licensing.

Azure role-based access control (RBAC)

RBAC controls what an identity can do to Azure resources. A role assignment has three parts: who gets the role, which role, and the scope where it applies. The scope can be a management group, subscription, resource group or single resource, and it is inherited downward.

Follow least privilege: give only the access needed, at the narrowest scope that works.

Zero Trust

Zero Trust assumes no request is safe because of where it comes from. Its principles are to verify explicitly, use least privilege access, and assume breach.

Defense in depth

Defense in depth uses several layers so that one failure does not expose everything. The layers run from physical security, through identity and access, perimeter, network, compute and application, to data.

Microsoft Defender for Cloud

Defender for Cloud assesses and improves the security of your resources. It gives a secure score, recommendations for fixing weaknesses, and threat protection for workloads in Azure, on premises and in other clouds.

Authentication and authorization

These two words are often confused, so learn both.

• Authentication proves who you are, for example with a password and MFA.
• Authorization decides what you are allowed to do once you are known, for example with an RBAC role.

A user can be authenticated and still be refused, because they are not authorized for that resource.

Entra ID compared with Active Directory

Microsoft Entra Domain Services bridges the gap. It gives managed domain services in Azure for older applications that need Kerberos or LDAP, without you running domain controllers.

A worked example

A user signs in to a finance application. Conditional Access checks the signals: the user is outside the office and the device is not compliant, so it requires MFA. After the user passes MFA, RBAC decides that they may read the finance resources but not change them.

That one sign in used three ideas from this page: authentication with MFA, a Conditional Access decision, and authorization through RBAC.

Customer identities

External identities cover people outside your organization. A supplier can be invited as a guest to use your resources with their own sign in. A customer-facing application can let shoppers sign in with their own accounts, without creating them as employees.

How the exam asks about this

• "Which feature requires a second proof of identity?" Multifactor authentication.
• "Which feature signs a user in once for many applications?" Single sign on.
• "Which feature grants permissions based on the role a person holds?" Azure role-based access control.
• "Which principle says to give only the access that is needed?" Least privilege, part of Zero Trust.
• "Which service gives a secure score?" Microsoft Defender for Cloud.