Azure Identity & Entra ID

Microsoft Entra ID (formerly Azure Active Directory)

Microsoft Entra ID is Azure's cloud-based Identity and Access Management (IAM) service. It is NOT the same as Windows Server Active Directory - it is a flat, cloud-native directory service accessible over HTTP/HTTPS.

Key Concepts

• Tenant: a dedicated, trusted instance of Entra ID representing an organisation.
• Directory: synonymous with tenant - each organisation gets one directory.
• Subscription: linked to exactly one tenant; a tenant can have many subscriptions.
• Users: can be cloud-only (created in Entra ID) or synced from on-premises AD via Entra ID Connect.
• Groups: Security groups (access management) and Microsoft 365 groups (collaboration).
• Service Principals: identity for applications and services - non-human accounts used by apps.
• Managed Identities: special service principals managed by Azure - no credential management needed.

Entra ID Editions

RBAC (Role-Based Access Control)

Controls access to Azure resources (subscriptions, resource groups, VMs, storage accounts, etc.).

Scope Hierarchy

Management Group
  └── Subscription
        └── Resource Group
              └── Resource

• Permissions assigned at a higher scope are inherited downward.
• Deny assignments override Allow assignments.

Built-in Roles

• Service-specific roles exist (e.g., Virtual Machine Contributor, Storage Blob Data Reader).
• Custom roles: define your own set of allowed/denied actions per provider.

Entra ID Roles vs Azure RBAC Roles

Exam tip: Entra ID roles manage the directory itself. Azure RBAC roles manage Azure resources. They are separate systems.

Conditional Access

• If-Then access policies: if a user matches certain conditions, then require specific controls.
• Conditions: user/group, application, device platform, location (IP range / named location), device compliance state, sign-in risk (Entra ID P2).
• Grant controls: block access, require MFA, require compliant device, require hybrid Azure AD join.
• Session controls: sign-in frequency, persistent browser session, app-enforced restrictions.
• Requires Entra ID P1 or P2.

Multi-Factor Authentication (MFA)

• Supported methods: Microsoft Authenticator app, SMS, voice call, hardware OATH token.
• Can be enforced via: Conditional Access (recommended), per-user MFA settings, security defaults.
• Security defaults: free preset of MFA settings; blocks legacy authentication protocols.

Privileged Identity Management (PIM)

• Just-in-time privileged access to Entra ID and Azure roles.
• Users are eligible for a role but must activate it (with justification + optional approval + MFA).
• Activation is time-limited (1 hour default, configurable).
• Provides: access reviews, activation history, alerts on standing privileged access.
• Requires Entra ID P2.

Exam tip: PIM = least privilege for admin accounts. Users don't have permanent admin rights; they activate when needed and access expires automatically.

Managed Identities

Allow Azure resources to authenticate to other Azure services without storing credentials in code.

• Supported resources: VM, App Service, Functions, AKS, Logic Apps, etc.
• Use case: App Service needs to read from Key Vault → assign managed identity to App Service → grant Key Vault access to that identity. No secrets in config.

Guest Users (B2B)

• Invite external users to collaborate using their own organisation's credentials (Microsoft, Google, email).
• Guest users have limited directory access by default.
• Entra ID B2B: collaboration with external organisations (guest users in your tenant).
• Entra ID B2C: customer-facing identity for your applications (social login, custom flows) - separate service.

Enterprise Applications & App Registrations

• App Registration: registers your application in Entra ID to enable authentication (defines client ID, redirect URIs, certificates/secrets).
• Enterprise Application (Service Principal): the instance of an app registration in a tenant - grants consent, assigns users/groups.
• OAuth 2.0 / OpenID Connect: standard protocols used for authentication/authorisation.
• Consent: users or admins grant the application specific permissions to access Entra ID data or APIs.

Entra ID Connect (Hybrid Identity)

• Synchronises on-premises Active Directory users/groups to Entra ID.
• Password Hash Sync (PHS): hash of password hash synced to cloud - simplest, most resilient.
• Pass-Through Authentication (PTA): cloud auth request validated by on-premises agent in real-time.
• Federation (AD FS): full federation with on-premises ADFS; most complex, most control.
• Seamless SSO: automatically signs in users on domain-joined machines on the corporate network.

Exam tip: Know the three sync modes and their trade-offs (resilience vs complexity vs features).