Describe the concepts of security, compliance, and identity
Identity, Authentication, and Trust
CoreSeparate identity, authentication, authorization, identity providers, directories, and federation.
Aligned to the SC-900 skills measured as of July 28, 2026; product behavior verified September 10, 2026.
Why this matters
Modern users, devices, workloads, and agents access resources from many locations. Identity therefore becomes a primary control point for deciding who or what is requesting access and what it may do.
Must Know
- An identity is a representation of a person, device, workload, or other entity; protecting identity signals makes identity a primary security perimeter.
- Authentication verifies a claimed identity. Authorization determines the actions and resources an authenticated identity is allowed to use.
- An identity provider creates, maintains, and authenticates identities and can issue security tokens to applications.
- A directory service stores and organizes information about identities and resources. Active Directory Domain Services provides directory capabilities for Windows domain environments.
- Federation establishes trust between identity systems so an identity authenticated by one system can access resources that trust it.
Compare and Distinguish
- Authentication vs authorization: proving who or what you are versus deciding what you may do.
- Identity provider vs directory service: the provider performs identity and sign-in functions; a directory is the organized identity and resource store supporting those functions.
- Federation vs synchronization: federation uses a trust relationship for authentication; synchronization copies selected identity data between directories.
- Identity perimeter vs network perimeter: identity-based controls travel with the requester and resource relationship rather than relying only on network location.
Scenario examples
- An application accepts a token issued by a trusted identity provider instead of maintaining a separate password for every user.
- A partner signs in with its home organization and accesses a resource because the organizations have established trust.
- A service authenticates an employee, then evaluates authorization before allowing an administrative action.
Exam traps
- A successful sign-in does not automatically grant every permission.
- A directory entry is not proof that the current requester has authenticated.
- Federation does not merge two organizations into one directory.
- Identity as a primary perimeter does not make network and device controls unnecessary.
Key takeaways
- Authenticate first; authorize actions separately.
- Identity providers establish identity claims and tokens; directories organize identity information.
- Federation extends trust across identity systems.
- Identity-centered controls complement other security layers.
Ready for the quiz?
- What question does authentication answer?
- How does federation differ from copying accounts?
- Why can an authenticated user still be denied?
Related objectives
- D1.2.S1 — Define identity as the primary security perimeter
- D1.2.S2 — Define authentication
- D1.2.S3 — Define authorization
- D1.2.S4 — Describe identity providers
- D1.2.S5 — Describe the concept of directory services and Active Directory
- D1.2.S6 — Describe the concept of federation