2.4 — Describe Azure identity, access, and security

Microsoft Entra ID (formerly Azure Active Directory)

Microsoft Entra IDMicrosoft's cloud-based identity and access management (IAM) service — the backbone of authentication for Azure, Microsoft 365, and thousands of SaaS apps. Uses OAuth 2.0, OIDC, and SAML (not Kerberos/NTLM like on-premises AD DS). is the cloud IAM service that underpins authentication across Azure, Microsoft 365, and thousands of SaaS apps. Key capabilities:

• Authentication — verifies who you are.
• Authorization — determines what you can do after authentication.
• SSO (Single Sign-On) — sign in once and access multiple apps without re-entering credentials.
• Application management — register and manage cloud/on-premises apps.
• B2B/B2C — collaborate with external users or let customers sign in with social identities.

Microsoft Entra Connect synchronizes on-premises Active Directory Domain Services (AD DS) with Entra ID, enabling hybrid identity scenarios. For legacy apps that require traditional AD features without managing domain controllers, Microsoft Entra Domain ServicesProvides managed domain services such as domain join, Group Policy, LDAP, and Kerberos/NTLM authentication — all without deploying, managing, or patching domain controllers. Useful for lifting and shifting legacy apps that require traditional AD features. provides managed domain join, Group Policy, LDAP, and Kerberos/NTLM as a fully managed service.

Authentication Methods

MFA is one of the most effective controls against credential attacks. Even if a password is stolen, a second factor blocks unauthorized access.

Passwordless authentication is the most phishing-resistant approach because there is no password to steal. FIDO2 security keys use public-key cryptography and are hardware-bound.

External Identities

Microsoft Entra External Identities covers two scenarios:

• B2B Collaboration — invite external users (partners, vendors) to your tenant using their existing identity (Microsoft, Google, etc.). They appear as guest users.
• B2C (External Customers) — separate service for consumer-facing apps; lets customers sign in with social identities (Google, Facebook) or local accounts.

Conditional Access

Conditional AccessThe policy engine of Microsoft Entra ID that evaluates signals and enforces access controls before granting access. Signals include user identity, group membership, device compliance, location (IP/network), application being accessed, and sign-in risk score. Requires Microsoft Entra ID P1 minimum. is the policy engine that evaluates contextual signals — identity, device compliance, location, and risk score — before granting access. It requires Microsoft Entra ID P1 at minimum. Common Conditional Access policy actions:

• Require MFA for all admin sign-ins.
• Block access from untrusted locations.
• Require a compliant or Hybrid Entra joined device.
• Limit session duration.
• Block legacy authentication protocols.

Security defaults provide a free baseline (requires MFA for all users, blocks legacy auth) but are less granular than Conditional Access.

Azure RBAC (Role-Based Access Control)

Azure RBACControls authorization — what authenticated users can do with Azure resources. Roles are assigned to security principals (users, groups, managed identities, service principals) at a scope. RBAC is additive — permissions from multiple assignments are combined with no explicit deny in standard RBAC. controls what authenticated users can do with Azure resources by assigning roles to security principals at a scope. Permissions are additive — multiple role assignments are combined, with no explicit deny in standard RBAC. Scope hierarchy (broadest to narrowest):

1. Management Group → 2. Subscription → 3. Resource Group → 4. Resource

Built-in roles:

Zero Trust

Zero TrustA security model based on three principles: Verify Explicitly (always authenticate using all available data points), Use Least Privilege Access (just-in-time and just-enough-access), and Assume Breach (minimize blast radius, segment access, verify end-to-end encryption). contrasts with the traditional perimeter model ("trust everything inside the firewall"). In Zero Trust, location inside the corporate network does not automatically grant trust — every access request is verified explicitly.

Defense-in-Depth

Defense-in-depthA layered security strategy where multiple independent controls slow down attackers. Each layer provides protection in case a previous layer is bypassed. uses multiple independent security layers so that bypassing one layer does not grant full access. The layers from outermost to innermost are:

Microsoft Defender for Cloud

Microsoft Defender for CloudA cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that assesses Azure (and multi-cloud/on-premises) security posture with a Secure Score, detects threats, and provides actionable remediation recommendations. Works natively across Azure, AWS, and GCP. provides both posture management and threat protection across Azure, AWS, and GCP from a single pane of glass. Key features:

• Secure Score — a percentage showing how well your configuration aligns with security best practices.
• Security alerts — real-time detections of suspicious activity (brute force, crypto mining).
• Regulatory compliance dashboard — maps your configuration against ISO 27001, PCI DSS, NIST.
• Defender plans — enhanced threat protection per workload type (Defender for Servers, Containers, SQL, etc.).