Microsoft Azure Identity
Microsoft Azure identity uses Microsoft Entra ID to represent people, applications, devices, and workloads. It verifies those identities and helps decide what they may access across Azure and connected services.
itCloud computing | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Microsoft Azure Identity
Azure identity starts with two questions. Who or what is making this request? What may that identity do?
Microsoft Entra ID answers the first question as Azure's cloud identity provider. Azure role-based access control, Microsoft Entra roles, application permissions, and resource-specific controls answer the second. Keeping those questions separate is the foundation of sound access design.
The tenant is the identity boundary
A Microsoft Entra tenant is a dedicated directory instance. It stores users, groups, applications, devices, and other identity objects. Azure subscriptions trust a tenant for their identities.
That relationship matters. A subscription contains Azure resources and billing boundaries. A tenant contains the identities that can receive access. One tenant can support several subscriptions, but a subscription trusts one tenant at a time.
Think of the tenant as the identity control plane. It issues tokens, stores directory objects, and holds identity policies. The subscription and its resource hierarchy provide scopes where Azure permissions apply.
Four kinds of identity
Human identities represent employees, administrators, guests, customers, and partners. They sign in interactively and often need multifactor authentication.
Workload identities represent applications, services, scripts, and containers. They should authenticate without pretending to be a person.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://learn.microsoft.com/en-us/entra/fundamentals/identity-fundamental-concepts
Supports
- IAM controls which people, machines, and software components access resources
- Authentication proves identity while authorization grants or denies access
- Human, workload, device, and agent identity categories
- MFA factor categories and SSO concepts
- Microsoft Entra as a cloud identity provider
- https://learn.microsoft.com/en-us/entra/architecture/guide-for-independent-software-developers
Supports
- A tenant is a dedicated Microsoft Entra directory instance
- Tenants store accounts, groups, applications, devices, and other objects
- OAuth 2.0, OpenID Connect, SAML 2.0, and SCIM have distinct roles
- Applications request tokens from tenant endpoints
- Conditional Access can evaluate identity, device, credential strength, location, and risk
- https://learn.microsoft.com/en-us/entra/fundamentals/faq
Supports
- Azure subscriptions trust a Microsoft Entra tenant
- Azure subscriptions rely on the tenant to authenticate and authorize principals and devices
- Microsoft Entra ID does not directly provide LDAP or secure LDAP
- https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-howitworks
Supports
- Microsoft Entra MFA requires two or more authentication method categories
- Knowledge, possession, and inherence factor examples
- Conditional Access can determine when MFA is required
- https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview
Supports
- Conditional Access is Microsoft's Zero Trust policy engine
- Policies combine signals, decisions, and enforcement controls
- User, application, device, location, and risk are common signals
- Conditional Access is enforced after first-factor authentication
- Conditional Access can block access or require controls
- https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-overview
Supports
- Microsoft Entra roles control directory resources
- Azure roles control Azure resources
- The two role systems have separate permissions
- https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments
Supports
- Azure role assignments bind a principal, role definition, and scope
- Principals include users, groups, service principals, and managed identities
- Scope can be a management group, subscription, resource group, or resource
- The smallest required scope is recommended
- Deleted principals can leave role assignments behind
- https://learn.microsoft.com/en-us/entra/identity-platform/application-model
Supports
- An application object describes an application
- A service principal is an application instance in a tenant
- Multitenant applications have service principals in consenting tenants
- https://learn.microsoft.com/en-us/entra/architecture/service-accounts-managed-identities
Supports
- Managed identities provide Azure-managed credentials
- Workloads use managed identities to obtain tokens without application credential management
- Target services still authenticate and authorize the workload
- System-assigned identity lifecycle follows one Azure resource
- User-assigned identity lifecycle is independent and can serve multiple resources
- https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-deployment-plan
Supports
- PIM supports just-in-time and time-bound privileged access
- PIM supports Microsoft Entra roles, Azure roles, and PIM for Groups
- Activation can use approval, MFA, justification, notification, and review controls
- Eligible and active assignments have distinct states
- https://github.com/merill/awesome-entra
Supports
- Maester is listed as an automated test framework for Conditional Access and Microsoft Entra configuration
- Graph Explorer is listed as a web tool for understanding and testing Microsoft Graph APIs
- Entra Exporter is listed as a tenant configuration export tool
- CA Optics is listed as a Conditional Access gap analyzer
- https://maester.dev/
Supports
- Maester provides automated tests for Microsoft security configuration
- https://developer.microsoft.com/en-us/graph/graph-explorer
Supports
- Graph Explorer provides a web interface for trying Microsoft Graph APIs
- https://github.com/microsoft/EntraExporter
Supports
- Entra Exporter exports a local copy of Microsoft Entra tenant configuration
- https://github.com/jsa2/caOptics
Supports
- CA Optics analyzes Conditional Access policy gaps