AZ-500 · Domain 1
Manage Identity and Access
About 30% of the exam
Entra ID building blocks
- Tenant
- one directory boundary per organization
- User and group
- identities and their memberships
- Administrative unit
- scopes a directory role narrowly
- App registration
- the application definition in one tenant
- Service principal
- the application identity per tenant
- Directory role
- permission inside the directory
- Azure role
- permission on Azure resources
- Break glass account
- excluded from Conditional Access
Directory roles govern the tenant while Azure roles govern resources, and the two are granted in different places
Conditional Access anatomy
- Assignment
- users, workloads and target resources
- Condition
- risk, platform, location, client
- Client apps condition
- modern against legacy authentication
- Device filter
- matches device properties precisely
- Grant control
- what must be true to allow
- Session control
- limits what happens after sign-in
- Combination
- all applicable policies must pass
- Report only
- logs the effect without enforcing
Grant and session controls
- Require multifactor authentication to proceed
- Require a compliant or joined device
- Require an approved client application
- Require an application protection policy
- Require terms of use acceptance
- Sign-in frequency limits the session length
- Token protection binds the session
Identity Protection
- Risky users and risky sign-ins
- Anonymous address raises medium risk
- User risk policy forces password change
- Sign-in risk policy forces stronger authentication
- Workload identity risk covers service principals
- Confirming compromise feeds the model
Continuous access evaluation
- Near real time revocation of access
- Password change ends existing sessions
- Account disable propagates quickly
- Strict location enforcement needs support
- Client and resource must both support
- Reduces the long lived token problem
Privileged Identity Management
Eligibility
- Eligible instead of permanently assigned
- Activation for a bounded window
- Approval required for sensitive roles
Conditions
- Multifactor authentication at activation
- Justification recorded for every elevation
- Authentication context binds a policy
Oversight
- Alerts on unexpected activations
- Access reviews of eligible members
- Audit logs exported for correlation
Azure role based access control
- Role definition
- actions, exclusions and data actions
- Scope
- management group down to resource
- Inheritance
- assignments flow down the hierarchy
- Owner
- full access including access management
- Contributor
- manages resources but not access
- User Access Administrator
- manages access, not the resources
- Reader
- view only across the scope
- Condition
- narrows a grant by attribute
Role based access against policy
- Access control decides who may act
- Policy decides what may exist
- The deny effect blocks the creation
- The audit effect records without blocking
- Deploy if not exists remediates afterward
- Initiatives group policies into baselines
- Locks stop deletion regardless of role
Managed identities
- System assigned
- tied to one resource lifecycle
- User assigned
- shared across many resources
- Credentials
- never stored, never rotated manually
- Token source
- metadata endpoint on the host
- Recreation
- a new object identifier appears
- Federated credential
- external token trusted by subject
- Best use
- application to service authentication
- Common trap
- attach the identity before use
External identities
Collaboration
- Guests invited into your tenant
- The home tenant still authenticates them
- Conditional Access applies to guests
Cross-tenant settings
- Inbound and outbound access rules
- Trust the partner multifactor claim
- Direct connect for shared channels
Entitlement
- Access packages bundle resource roles
- Assignment policy sets approval and expiry
- Reviews remove inactive guests
Governance and reviews
- Access reviews on a recurring schedule
- Default decision when reviewers stay silent
- Dynamic groups follow attribute changes
- Lifecycle workflows automate joiner and leaver
- Temporary access pass bootstraps passwordless
- Protected actions gated by authentication context
Roles and scopes to remember
- Global Administrator
- everything in the directory
- Privileged Role Administrator
- manages directory role assignments
- Security Reader
- reads posture and recommendations
- Security Administrator
- manages security features and alerts
- Machine Administrator Login
- signs in with directory credentials
- Crypto Service Encryption
- lets a service use keys
- Blob Data Reader
- reads blob data, not keys
- Reader and Data Access
- reads plus account key retrieval
Identity mistakes
Policy gaps
- Legacy authentication never blocked
- Break glass excluded and unmonitored
- New users outside the policy scope
Standing privilege
- Permanent Global Administrator assignments
- Contributor granted at subscription scope
- Service principals holding owner rights
Credentials
- Client secrets stored in code
- Storage account keys shared widely
- Guest accounts that never expire
Service names to know
- Risk detection and response
- Entra ID Protection
- Time bound privileged roles
- Privileged Identity Management
- Access package requests
- entitlement management
- Automatic user provisioning
- cross-domain identity provisioning
- Guardrails at scale
- Azure Policy initiatives
- Passwordless bootstrap
- temporary access pass
- Attribute based narrowing
- a role assignment condition
- Sign-in and audit records
- Entra ID logs
Know the order
- Authenticate
- Conditional Access
- Directory role
- Azure role
- Policy and locks
Conditional Access decides whether the sign-in happens at all, and the role assignments decide what happens next
Reference strip: directory, access policy, privilege, resources, workloads
Directory
- Tenants, users and groups
- Administrative units narrow scope
- Applications and service principals
- Directory roles for the tenant
Access policy
- Assignments, conditions and controls
- Grant and session controls
- Report only before enforcement
- Legacy authentication blocked
Privilege
- Eligible rather than permanent
- Activation with approval and justification
- Alerts on every elevation
- Reviews of eligible members
Resources
- Management group to resource scope
- Owner, Contributor and Reader
- Conditions narrow a grant
- Locks resist deletion
Workloads
- System and user assigned identities
- Federated credentials for pipelines
- No secrets in configuration
- Least privilege per workload
Quick exam traps
- Trap: A Conditional Access policy applies only one of its grant controls
- Trap: Recreating a resource keeps its system assigned identity
- Trap: Contributor can grant other people access to the resource
- Trap: Legacy authentication is blocked automatically in new tenants
- Trap: Privileged Identity Management removes the need for multifactor authentication
- Trap: Azure Policy and role assignments are two ways of doing the same thing
- Trap: A user assigned identity works the moment it is created
cybercertprep.com · original revision sheet written from the public body of knowledge