Identity Concepts

What it is

An identity is how a system knows who or what is asking for access. It can be a person, a device or an application. As work moved to the cloud and to remote locations, the network edge faded, so identity became the main boundary that decides who gets in.

This is why modern security is described as treating identity as the primary security perimeter.

How it works

Authentication and authorization

These two words are easy to confuse, and the exam tests the difference.

You must be authenticated before you can be authorized. A third idea, accounting or auditing, records what the identity did.

Identity providers

An identity provider is a service that creates and manages identities and checks them when someone signs in. Applications trust the provider instead of keeping their own passwords. Microsoft Entra ID is an identity provider. A social sign in with another company's account uses that company's identity provider.

When you sign in, the provider issues a security token that the application accepts as proof. The token holds claims, which are statements about the user, such as name, email address or group membership. A token also has an expiry time, which limits how long a stolen token can be used.

Directory services and Active Directory

A directory service stores information about users, groups, devices and resources, and lets applications look them up. Active Directory Domain Services (AD DS) is the directory service that runs on Windows Server inside an organisation.

AD DS is organised in a logical structure.

• A domain is a group of objects that share a database and security boundary.
• A forest is one or more domains that share a common structure.
• An organizational unit is a container inside a domain used to arrange and manage objects.

Microsoft Entra ID is a different service, built for the cloud. It does not use the same structure and is not simply a copy of AD DS.

Federation and single sign on

Federation is a trust between two identity providers or between a provider and an application, so a user signed in at one can use the other without a new password. The user proves identity once to their own provider, and the partner accepts the resulting token. Single sign on (SSO) is the result users notice: one sign in gives access to many applications.

On premises, Active Directory Federation Services (AD FS) provides claims based federation. In the cloud, protocols such as SAML, OpenID Connect and OAuth carry the sign in and tokens between providers and applications.

A worked scenario

A company's staff sign in to Microsoft Entra ID each morning, proving their identity with a password and a prompt on their phone. That is authentication. Entra ID then issues a token with claims such as the user's department. A finance application trusts the token, and its own rules say that only members of the finance group may approve payments, which is authorization. The same token lets the user open several other applications without signing in again, which is single sign on, made possible by the trust between the apps and the identity provider.

Protocols that carry sign in

You do not need the details of each protocol for the exam. Remember that modern cloud sign in uses tokens, and that OpenID Connect proves who you are while OAuth grants access.

Why identity became the perimeter

Years ago a company network had a clear edge, and being inside it meant being trusted. Today staff use cloud apps from home, from phones and from other companies' networks, so there is no single edge to guard. Attackers take advantage with phishing, password guessing and stolen credentials. If they sign in with a valid identity, the network firewall does not stop them. Strong identity controls such as multifactor authentication, Conditional Access and least privilege therefore sit at the heart of modern defence.

Directory services compared