Design security operations, identity, and compliance capabilities · Topic 3 of 7
Identity and Access Solutions with Microsoft Entra
SC-100 identity design: Entra ID tenants, hybrid identity with Connect and Cloud Sync, and access to SaaS, PaaS, IaaS and multicloud resources.
- 5 min
- Password hash sync is the recommended default sign in method. Federation adds infrastructure to protect.
- Entra Connect Sync is full featured. Cloud Sync uses lightweight agents and supports disconnected forests.
- Application proxy publishes on premises web apps. Private Access gives identity based access to private resources.
What it is
In Zero Trust, identity is the new perimeter. Microsoft Entra ID is the identity provider for Microsoft 365, Azure and thousands of other apps. This topic covers designing the Entra tenant and hybrid identity (connecting to on premises Active Directory), and then designing access to every kind of resource: SaaS, PaaS, IaaS, on premises and other clouds, using identity, network and application controls together.
How it works
Tenant and hybrid identity design
| Decision | Options and guidance |
|---|---|
| Tenants | Prefer one production tenant for the workforce. Extra tenants add management cost, but may be needed for separation (customers, test, acquisitions). Use cross tenant access settings between them |
| Synchronize from AD DS | Microsoft Entra Connect Sync (full featured, runs on a server) or Microsoft Entra Cloud Sync (lightweight agents, multiple disconnected forests, easy high availability by installing several agents) |
| Authentication method | Password hash synchronization (PHS) is the recommended default: simple, resilient and enables leaked credential detection. Pass-through authentication validates on premises. Federation (AD FS) keeps authentication on premises but adds infrastructure to defend. Passwordless is the target |
| Single sign on | Seamless SSO for domain joined devices, or a Primary Refresh Token with Entra joined or hybrid joined devices |
| Resilience | Install a second Connect server in staging mode for quick failover, or several Cloud Sync agents. Monitor with Microsoft Entra Connect Health |
| Cloud only | New organizations and workloads should be cloud native where possible |
Reduce on premises dependency over time: move authentication to the cloud, join devices to Entra ID, and retire AD FS where you can. Microsoft Entra Domain Services provides managed domain services (LDAP, Kerberos) for legacy apps in Azure without domain controllers.
Identity as the foundation for multicloud
Entra ID can serve as the central identity provider for other clouds and SaaS: federate AWS IAM Identity Center or AWS accounts, and Google Cloud, with SAML or OpenID Connect, so users sign in with one identity and one set of Conditional Access policies. Workload identity federation lets workloads in other clouds or CI systems obtain tokens without stored secrets.
Access to SaaS, PaaS, IaaS, on premises and multicloud
Each resource type uses identity, network and application controls together.
| Resource | Identity controls | Network controls | Application controls |
|---|---|---|---|
| SaaS | SSO with SAML or OIDC from the Entra application gallery, automatic provisioning (SCIM), Conditional Access | Entra Internet Access or IP restrictions with named locations, tenant restrictions | Consent policies, app governance, Defender for Cloud Apps session controls |
| PaaS (App Service, SQL, Storage) | Managed identities and Microsoft Entra authentication instead of keys or SQL logins, Azure RBAC | Private Link and private endpoints, service endpoints, firewall rules, disabling public access | Key Vault for secrets, WAF in front |
| IaaS (VMs) | Entra ID login for Windows and Linux VMs with Azure RBAC, just in time (JIT) VM access, no shared local admin (use LAPS) | NSGs, Azure Bastion instead of public RDP or SSH, Azure Firewall | Endpoint protection, update management |
| On premises web apps | Entra SSO and Conditional Access in front of the app | Microsoft Entra application proxy publishes it with an outbound connector and no inbound firewall hole | Pre authentication through Entra |
| On premises and private apps generally | Entra ID Conditional Access | Microsoft Entra Private Access gives identity based access to private resources over TCP and UDP without a VPN | Per app segments |
| Other clouds | Federation with Entra, workload identity federation | Private connectivity, firewalls | Cloud native controls, monitored by Defender for Cloud |
Principles that run through all of these: authenticate with identity, not network location, prefer managed identities and passwordless methods, apply Conditional Access consistently, give least privilege with Azure RBAC, and monitor sign ins with Entra logs and Identity Protection.
Application registration and consent
Apps that use Entra need an app registration (a definition) and a service principal (the instance in a tenant). Control risk from third party apps: restrict user consent, require admin consent workflows, review enterprise applications and their permissions regularly, and use app governance to detect overprivileged or risky OAuth apps.
A worked scenario
A company has Active Directory on premises, a legacy intranet app, SaaS apps, Azure VMs and an AWS account. The architect chooses password hash synchronization with Entra Connect (and a staging server), joins devices to Entra ID, publishes the intranet app through application proxy with Conditional Access, enables Entra login with JIT access and Bastion for Azure VMs, uses managed identities and private endpoints for PaaS, and federates AWS IAM Identity Center to Entra so one identity governs everything.
What to remember for the exam
- Password hash sync is the recommended default sign in method. Federation adds infrastructure to protect.
- Entra Connect Sync is full featured. Cloud Sync uses lightweight agents and supports disconnected forests.
- Application proxy publishes on premises web apps. Private Access gives identity based access to private resources.
- PaaS: managed identities and Private Link. IaaS: Entra login, JIT and Bastion.
- Entra can be the identity provider for AWS and other clouds through federation.
"No inbound firewall ports and an on premises web app needs Entra pre authentication" is application proxy.
How the exam asks about this
- "Synchronize several disconnected AD forests with minimal infrastructure." Entra Cloud Sync.
- "Remove the need for access keys between an app and Azure SQL." Managed identity with Microsoft Entra authentication.
- "Give contractors identity based access to internal apps without a VPN." Entra Private Access.
- "Single identity and policy for AWS console access." Federate AWS IAM Identity Center with Entra ID.
Common mistakes
Federating when it is not required. It adds infrastructure to attack.
Single Connect server with no standby. Sync stalls until it is rebuilt.
Using connection strings and keys for PaaS. Use managed identities.
Network location as trust. Zero Trust verifies every request.
Check yourself
Which sign in method is the recommended default for hybrid identity?
Password hash synchronization.
Which service publishes an on premises web app without opening inbound ports?
Microsoft Entra application proxy.
How can a workload in another cloud get Azure tokens without a stored secret?
Workload identity federation.
Topic 3 of 7 in Design security operations, identity, and compliance capabilities
Test yourself on Design security operations, identity, and compliance capabilities
The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.