Describe Azure architecture and services
Azure Identity, Access, and Security
CoreSeparate directory, authentication, authorization, access policy, security strategy, layers, and posture protection.
Aligned to the AZ-900 skills measured as of July 20, 2026; product behavior verified August 23, 2026.
Why this matters
Identity and security terms overlap in everyday language. AZ-900 expects the exact purpose boundary: who a principal is, how sign-in is verified, what actions are allowed, and which broader controls reduce risk.
Must Know
- Microsoft Entra ID is Azure’s cloud identity and access service. Microsoft Entra Domain Services provides managed domain features such as domain join, Group Policy, LDAP, and Kerberos/NTLM without customer-managed domain controllers.
- SSO reduces repeated sign-ins across integrated applications; MFA requires more than one factor; passwordless methods authenticate without a traditional password.
- Microsoft Entra External ID supports identities outside the workforce tenant, such as partner collaboration and customer identities. External identity does not by itself grant resource authorization.
- Conditional Access uses signals such as user, device, location, application, and risk to make if-then access decisions and can require controls such as MFA.
- Azure RBAC authorizes actions on Azure resources by combining security principals, role definitions, and scopes.
- Zero Trust is a strategy built on verify explicitly, use least privilege, and assume breach. Defense in depth uses multiple security layers so one failed control is not the only protection.
- Microsoft Defender for Cloud provides cloud security posture management and workload protection across supported Azure, hybrid, and multicloud resources.
Compare and Distinguish
- Authentication vs authorization: prove identity versus decide allowed actions.
- Entra ID vs Azure RBAC: supply identities and authentication versus authorize Azure-resource actions.
- SSO vs MFA vs passwordless: reuse a sign-in, verify with multiple factors, and sign in without a traditional password.
- Conditional Access vs MFA vs Zero Trust: signal-driven policy, a possible authentication grant control, and the broader strategy.
- Azure Policy vs RBAC: resource compliance versus user/action authorization.
- Zero Trust vs defense in depth: guiding strategy versus layered protection model.
- Defender for Cloud vs Azure Monitor: security posture/workload protection versus general telemetry and observability.
Scenario examples
- A legacy app needs managed domain join, so the team evaluates Entra Domain Services.
- A sign-in from a risky context must require MFA, so Conditional Access evaluates signals and applies the grant control.
- A user needs read access to one resource group, so Azure RBAC supplies authorization at that scope.
- A security team needs posture recommendations and workload protection across clouds, so it evaluates Defender for Cloud.
Exam traps
- SSO is not MFA, and MFA is not authorization.
- Conditional Access is not a replacement name for Zero Trust.
- An external identity still requires appropriate authorization.
- Defender for Cloud is not the same service as Azure Monitor or Service Health.
Key takeaways
- Identity, authentication, and authorization are separate layers.
- Use RBAC for Azure-resource permissions and Conditional Access for signal-driven sign-in decisions.
- Zero Trust guides decisions; defense in depth layers controls; Defender for Cloud assesses and protects cloud workloads.
Ready for the quiz?
- How do Entra ID and Entra Domain Services differ?
- What separates Conditional Access from MFA?
- Which service authorizes Azure resource actions?
- How do Zero Trust and defense in depth differ?
Related objectives
- D2.4.S1 — Describe directory services in Azure, including Microsoft Entra ID and Microsoft Entra Domain Services
- D2.4.S2 — Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless
- D2.4.S3 — Describe external identities in Azure
- D2.4.S4 — Describe Microsoft Entra Conditional Access
- D2.4.S5 — Describe Azure role-based access control (RBAC)
- D2.4.S6 — Describe the concept of Zero Trust
- D2.4.S7 — Describe the purpose of the defense-in-depth model
- D2.4.S8 — Describe the purpose of Microsoft Defender for Cloud