Don't Panic — Microsoft Azure Identity

Azure identity is the collection of decisions that prevents a request from wandering into a resource wearing a convincing hat. The central character is Microsoft Entra ID, the cloud identity provider that stores identity objects, authenticates them, issues tokens, and applies identity policies. That is plenty of responsibility for one directory, so it is useful to stop asking it to do every other job as well.

The first useful split is authentication versus authorization. Authentication establishes who or what is asking. Authorization decides what that authenticated identity may do at a target. A successful sign-in is therefore not a permission slip. It is more like getting through the building entrance; the storage room still has its own lock.

The next split is the tenant versus the subscription. The tenant is the identity boundary. It holds users, groups, applications, devices, and policies. The subscription contains Azure resources and supplies a management and billing boundary. They cooperate, but confusing them is how a request for one resource becomes an argument about the whole estate.

People, workloads, devices, and agents each arrive by different routes. A person commonly signs in interactively and faces MFA or Conditional Access. A workload should use a managed identity when Azure supports it, so the workload can request a token without a secret tucked into code like an administrative fossil. The managed identity still needs explicit authorization at its target. It is a credential-management answer, not automatic access.

Azure then offers two role systems with names that look as though a committee designed them during a fog. Microsoft Entra roles administer directory resources such as users and applications. Azure roles govern Azure resources through Azure Resource Manager. An Azure role assignment joins a principal, a role definition, and a scope. The smallest useful role and scope are the dependable starting point.

Conditional Access adds context after first-factor authentication. It can block a sign-in or require a control such as MFA or a compliant device. It does not replace the target's permission check. Privileged Identity Management adds a time limit, making eligible access activatable when work requires it rather than permanently active for decoration.

Read the intro for the full control path and vocabulary. Use the slides to keep the boundaries in view. The cheatsheet is the compact map for assignments, scopes, identities, and failure patterns. Then use the practice technique and exercise to turn one request into a design that another person can actually review.

Don't Panic — Microsoft Azure Identity

Relevant careers