Services at a glance

Authentication vs Authorization

• Authentication (AuthN): who are you? (password, MFA, certificate)
• Authorization (AuthZ): what are you allowed to do? (roles, permissions)

Microsoft Entra ID

A cloud directory and identity provider. Every Azure subscription trusts one tenant.

• Users, groups, devices, app registrations, service principals
• Single sign-on (SSO) to thousands of SaaS apps using OAuth 2.0, OpenID Connect and SAML
• Multi-factor authentication (MFA): something you know + have + are
• Passwordless: Windows Hello, FIDO2 keys, Authenticator app
• Self-service password reset (SSPR)
• External identities: B2B (guests from other orgs) and B2C / External ID (customers)
• Hybrid identity: Entra Connect syncs on-prem Active Directory to the cloud (password hash sync, pass-through auth, federation)

LDAP/Kerberos background is in the Networking protocol notes (Directory Access Protocols).

Conditional Access

If-then rules evaluated at sign-in:

• If user is an admin, and location is outside the country → then require MFA or block
• Signals: user, device compliance, location, app, sign-in risk
• Controls: allow, block, require MFA, require compliant device

Privileged Identity Management (PIM)

Admins are eligible for a role and activate it for a limited time with approval and MFA, instead of holding it permanently.

Azure RBAC

Role-based access control for resources. An assignment is who + role + scope.

• Scope inherits downward: management group → subscription → resource group → resource
• Built-in roles: Owner (everything + assign roles), Contributor (everything except assign roles), Reader (view only), User Access Administrator
• Custom roles for fine-grained needs
• Entra roles (manage the directory) are separate from Azure roles (manage resources)

$ az role assignment create \
    --assignee user@contoso.com \
    --role "Reader" \
    --scope /subscriptions/<sub-id>/resourceGroups/rg-demo
$ az role assignment list --assignee user@contoso.com -o table

Managed Identities

An identity for an Azure resource (VM, App Service, Function) managed by Azure, so no secrets in code.

• System-assigned: tied to one resource's lifecycle
• User-assigned: standalone, reusable across resources

$ az webapp identity assign -g rg-demo -n my-unique-webapp

Then grant that identity a role (e.g. Key Vault Secrets User) and fetch tokens from code with DefaultAzureCredential.

Azure Key Vault

Central store for secrets (connection strings), keys (encryption) and certificates.

• Access by RBAC or access policies
• Soft delete and purge protection
• Standard (software keys) vs Premium (HSM-backed keys); Managed HSM for single-tenant
• Rotation and versioning

$ az keyvault create -g rg-demo -n kv-demo-12345
$ az keyvault secret set --vault-name kv-demo-12345 -n DbPassword --value 'S3cret!'
$ az keyvault secret show --vault-name kv-demo-12345 -n DbPassword

Defense in Depth and Zero Trust

Layers, outside in: physical → identity & access → perimeter → network → compute → application → data.

Zero Trust principles: 1. Verify explicitly: always authenticate and authorise on all signals 2. Least privilege: just-in-time, just-enough access 3. Assume breach: segment, encrypt, monitor

Microsoft Defender for Cloud

• CSPM: secure score and recommendations to harden configuration
• CWPP: threat protection for servers, containers, databases, storage
• Works across Azure, AWS, GCP and on-prem

Microsoft Sentinel

Collects logs from many sources, detects threats with analytics rules, investigates and automates responses with playbooks (Logic Apps).

Encryption and Compliance

• At rest: storage, SQL (TDE), disks (Azure Disk Encryption / server-side)
• In transit: TLS
• Compliance resources: Microsoft Trust Center, Service Trust Portal, Compliance Manager
• Privacy: Microsoft Privacy Statement, Online Services Terms, Data Protection Addendum