Identity & Security (Entra ID)

Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. It handles authentication, authorization, and single sign-on for Azure resources and Microsoft 365.

• Authentication — Verifying identity (who are you?).
• Authorization — Determining access (what can you do?).
• Single Sign-On (SSO) — One login for multiple applications.
• Multi-Factor Authentication (MFA) — Additional verification beyond password.
• Conditional Access — Policies that control access based on conditions.

Authentication Methods

Conditional Access

Conditional Access policies control access to resources based on conditions like user, location, device, risk level, and application. They are the core of modern identity security.

• User/Group — Apply to specific users or groups.
• Location — Block or require MFA from specific locations.
• Device — Require compliant or hybrid-joined devices.
• Application — Apply different policies per application.
• Risk level — Respond to sign-in or user risk.
• Require MFA — Force additional authentication.

Defense in Depth

Defense in depth uses multiple layers of security controls. If one layer fails, the next layer catches the threat. Azure provides security tools at every layer.

1. Physical security — Data center access, biometric locks.
2. Identity and access — Entra ID, MFA, RBAC.
3. Perimeter — DDoS protection, Azure Firewall.
4. Network — Network Security Groups, Application Security Groups.
5. Compute — Endpoint protection, just-in-time VM access.
6. Application — Web Application Firewall, API Management.
7. Data — Encryption at rest and in transit, Key Vault.

Zero Trust Model

Zero Trust assumes no user, device, or network is inherently trusted. Every access request is verified regardless of origin. This is the modern security paradigm that replaces traditional perimeter-based security.

• Verify explicitly — Always authenticate and authorize based on all available data.
• Use least privilege access — Limit access with just-in-time and just-enough-access.
• Assume breach — Minimize blast radius, segment access, verify end-to-end encryption.

Key Terms to Memorize

• Entra ID — Cloud identity and access management.
• MFA — Multi-Factor Authentication.
• SSO — Single Sign-On.
• PIM — Privileged Identity Management (just-in-time admin access).
• PAM — Privileged Access Management.
• Identity Protection — Risk-based sign-in detection.
• Key Vault — Secrets, keys, and certificates management.
• Microsoft Defender for Cloud — Cloud Security Posture Management (CSPM).

Useful Commands

# Check sign-in logs
az ad sign-in list --output table

# List users
az ad user list --output table

# Check role assignments
az role assignment list --output table

# List Key Vault secrets
az keyvault secret list --vault-name my-vault --output table

# Check Defender status
az security status --output table