Explore identity in Microsoft Entra ID

 Introduction:

👉This module introduces identity and access management in the Microsoft Cloud, focusing on Microsoft Entra ID and its connection to Microsoft 365. 

👉It covers the basics of authentication, authorization, and access tokens, then explains how identity forms the foundation of security through governance and lifecycle management.

👉 It also introduces the Zero Trust model, where every access request must be verified. The module explains Microsoft Entra ID architecture as the backbone for managing users, groups, and access in Microsoft 365. 

👉Finally, it highlights how PowerShell and Microsoft Graph can be used to automate and manage identity solutions, preparing you with the technical knowledge needed for secure identity management in the cloud.

Explain the identity landscape

How Microsoft Thinks About Identity

• Microsoft treats identity as the foundation of security.

• Everything — apps, devices, and users — must be tied to a trusted identity.

• Instead of only protecting networks or devices, Microsoft focuses on protecting identities first because attacks often target user accounts.

• This is why services like Microsoft Entra ID are central to all Microsoft Cloud solutions.\

1) Zero Trust               

 Verify Explicitly, Use Least Privilege, Assume Breach

2) Identity

Business to Business (B2B), Business to Consumer (B2C), Verifiable Credentials, (Decentralize Providers)

3) Actions 

Business to Business (B2B), Authorize - Get - AuthZ, Administer - Configure, Audit - Report

4) Usage 

Access applications and data, Secure - Cryptography, Dollars - Licenses

5) Maintain

Protect - Detect - Respond

1) Zero Trust First – Always verify access requests; never assume past access means future access.

2)Verified Accounts – Provide trusted identities for users and apps through Microsoft Entra ID, federation (B2B/B2C), or decentralized identity providers.

3)Core Identity Actions – Identities must authenticate and authorize to access systems, while admins govern, monitor, and maintain security

4)Use After Verification – Once credentials are confirmed, users can securely access apps, data, and other identity-driven services.

5)Stay Updated – Keep identity systems current with the latest security updates and practices.

👉 This flow shows that Microsoft’s approach to identity is not just about logging in, but about continuous verification, governance, and protection.

From classic identity to Zero Trust identity

In the past, when firewalls were the primary security measure, access required only a username and password. Once entered, users were granted full access. If these credentials were stolen, attackers could misuse the data and systems. This approach is known as Classic Identity.

Today, we use Zero Trust Identity, where access and data are protected with policies. Instead of relying only on usernames and passwords, every access request is verified continuously, ensuring stronger security with MFA.

Explore Zero Trust with identity

👉Organizations now operate in hybrid and multicloud environments, with employees working from different locations and devices. Traditional firewalls are no longer enough to keep everything safe. 

👉That’s why the Zero Trust model is used—it assumes that no request is automatically safe. Every access attempt, whether from inside or outside the network, is verified with strict checks. In short, Zero Trust means always verify before giving access to protect people, devices, apps, and data anywhere.

Zero Trust principles - guidance for architecture design

1. Verify Explicitly

Always validate every request using as much data as possible, such as:

• User identity and location

• Device health

• Service or workload context

• Data classification

• Anomalies and unusual behavior

---

2. Use Least Privilege Access

Grant users only the access they need to perform their tasks, no more. This is achieved through:

• Just-in-time (JIT) access → temporary permissions when required

• Just-enough-access (JEA) → minimal permissions necessary for the task

• Risk-based adaptive policies → adjust access based on risk level

• Data protection against out-of-band vectors (unexpected access paths)

---

3. Assume Breach

Work with the mindset that a breach may already exist. Limit potential damage by:

• Segmenting access by network, user, device, and app awareness

• Encrypting all sessions end-to-end

• Using analytics to detect threats, monitor posture, and strengthen defenses

Deploy Zero Trust solutions

Zero Trust is a security approach that assumes no user, device, or service is automatically trustworthy, whether they are inside or outside your network. Instead, access is continuously verified before granting permissions.

The strategy covers six foundational elements:

1. Identity – Who or what is accessing resources

2. Endpoints – Devices used to access resources

3. Data – Protecting sensitive information

4. Applications (Apps) – Securing software and services

5. Infrastructure – Servers, cloud, and on-prem systems

6. Network – Communication paths and connections

Each element acts as:

• A source of signal – provides information about activity

• A control plane – enforces security policies

• A resource to defend – must be protected from threats

---

Focus on Identity in Zero Trust

Why identity is critical:

• Every access request comes from some identity: a person, a service, or an IoT device.

• The identity defines the control plane — essentially, it decides whether access should be allowed.

Key Principles for Identity Security:

1. Strong Verification:

   • Confirm the identity using multi-factor authentication (MFA) or other strong methods.

2. Conditional Access:

   • Only allow access if it is compliant with policies (location, device health, risk level).

3. Least Privilege Access:

   • Give users or devices only the minimum access they need to perform their tasks.

   • Limits potential damage if an account is compromised.

4. Continuous Monitoring:

   • Track behavior to ensure access patterns are typical and safe.

Zero Trust treats every access attempt as untrusted until verified, and identity is the central pillar that controls access safely, ensures compliance, and protects the digital estate.

Zero Trust architecture

Security Policy is Central:

Policies govern who can access what, when, and how.

Identity is the Core:

Every user, device, or service is verified before access.

Access decisions are based on identity, device health, sign-in risk, and other signals.

Integrated Solutions:

Tools like identity & access management, endpoint management, data protection, cloud security, and network security work together.

They enforce policies in real time and protect resources across the organization.

Policy Engine & Signals:

A central policy engine uses rich signals to make dynamic access decisions at critical points (networks, apps, data).

Threat Detection & Response:

SIEM and XDR solutions provide end-to-end threat visibility, detection, and response.

They help identify what matters most and act quickly to remediate threats.

Goal:

Ensure only the right people get the right access, improving both security and productivity.

1)Identity & Policy are at the heart.

2)Access is verified continuously using signals like device health and sign-in risk.

3)Apps, Data, Network, and Infrastructure are protected in real time.

4)SIEM + XDR provide full visibility and quick response.

👉Zero Trust continuously verifies identities, enforces policies, and integrates security tools to protect resources and respond to threats in real time.

Discuss identity as a control plane

What is a Control Plane?

• In networking, a control plane is the part of the system that decides how traffic flows.

• In security, it’s a tool or service that directs access to resources based on policies and criteria.

---

Why Identity is the Control Plane

• Every user, app, device, or service has an identity.

• Identity is the common denominator across networks, devices, and applications.

• By verifying identity first, you can trust or deny access to all other resources.

• Without knowing the identity, no other security control matters.

---

How it Works

1. User or device requests access.

2. Identity is verified using authentication (password, MFA, device health, etc.).

3. Access policies evaluate the request based on least privilege and compliance.

4. Access is allowed or denied to apps, data, cloud services, or on-prem resources.

---

Diagram: Identity as the Control Plane

                     [ Identity Control Plane ]
                             |
      -----------------------------------------------------
      |           |            |           |             |
  [ On-Prem ]  [ Cloud Apps ] [ Devices ] [ Network ] [ Data ]
      |           |            |           |             |
  Access decisions made dynamically based on identity verification

Key Idea:

• Identity is at the center of trust.

• All access requests, whether to cloud, on-prem, apps, devices, or networks, go through the identity control plane.

• It ensures explicit verification of every access attempt.

Explore why we have identity

“Why is identity used as the central mechanism (control plane) for granting access to resources in Zero Trust security architectures?”

Identity gives the ability:

To prove who or what, we are - Authentication

To get permissions to do something - Authorization

To report on what was done - Auditing

To IT manage and self administer an identity - Administration

Authentication	Authorization	Administration	Auditing
User sign on experience	User sign on experience	Single view management	Track who does what, when, where and how
Trusted source(s)	Can a user access the resource	Application of business rules	Focused alerting
Federative protocols	What can they do when they access it?	Automated requests, approvals, and access assignment	In-depth collated reporting
Level of assurance		Entitlement management	Governance & compliance

 What is an identity provider (IdP)

An identity provider (IdP) is a system that creates, manages and stores digital identities. Microsoft Entra ID is an example. The capabilities and features of identity providers can vary. The most common components are:

• A repository of user identities
• An authentication system
• Security protocols that defend against intrusion
• Someone we trust

An identity provider is a trusted service that confirms who you are, using methods like a password, fingerprint, or other verification steps. It often works with single sign-on (SSO), which lets you access multiple apps or resources with just one login. 

SSO makes things easier for users by reducing the need to remember many passwords and improves security by lowering the chances for attacks. Identity providers also help users connect smoothly to cloud services, so you don’t have to keep logging in when using mobile devices or working remotely.

Common identity protocols

OpenID provider - OpenID Connect (OIDC) is an authentication protocol based on the OAuth2 protocol (which is used for authorization). OIDC uses the standardized message flows from OAuth2 to provide identity services. Specifically, a system entity (called an OpenID-Provider) issues JSON-formatted identity tokens to OIDC relying parties via a RESTful HTTP API.

 SAML identity provider - Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between an identity provider and a service provider. SAML is an XML-based markup language for security assertions, which are statements that service providers use to make access-control decisions.

Feature	OIDC (OpenID Connect)	SAML (Security Assertion Markup Language)
Based on	OAuth 2.0 (modern)	XML standard (older)
Data format	JSON	XML
Best suited for	Web & mobile apps, APIs	Enterprise apps (SSO in corporate systems)
Ease of use	Lightweight, developer-friendly	More complex, heavier to implement
Token type	ID Token (JWT)	SAML Assertion
Transport	REST/HTTP APIs	Browser redirects + XML exchange

Define identity administration

Identity administration is how identity objects are managed over the lifetime of the identity’s existence. This administration can be manual or automated. Here's a simple example of what happens without governance and administration of your identities

Identity administration provides

*A system that is highly configurable around business processes

*The agility to scale resources according to demand

*Cost savings through the distribution and automation of management

*Flexibility around synchronization, proliferation, and change control.

Common identity administration tasks

There are many common tasks performed during identity administration.

Identity Proliferation – This is about where identity records are stored in an organization. They might be in Active Directory, other directory services, or application-specific databases.

Provisioning & Deprovisioning – Provisioning means creating a new user identity and giving it access. Deprovisioning means removing that identity’s access (like deleting the account or disabling it) when it’s no longer needed.

Identity Updates – This is how user details (like phone number, role, or department) are updated. Instead of doing it manually, the goal is to make updates automated and consistent across systems.

Synchronization – This ensures that all identity systems are up to date with the latest information. Sync can happen manually, on a schedule, or automatically whenever changes occur.

Password Management – Deals with how passwords are created, reset, or recovered. Many organizations still depend on the IT helpdesk for forgotten passwords, though self-service methods are becoming common.

Group Management – Groups (like in Active Directory or LDAP) are used to assign access permissions. Managing these groups is critical but also costly and time-consuming.

Application Entitlement Management – This defines how users are granted access to applications. Coarse-grained entitlements give general access at the app level, while fine-grained entitlements control access at a more detailed level (based on user attributes).

User Interface – This is how users interact with the system to request or update identity details. In many cases, users still contact the helpdesk instead of using self-service portals.

Change Control – This is about how identity-related changes are handled. Some organizations rely on manual processes (like emails), while others use automated workflows to streamline and secure the process.

Identity management automation

🔹 PowerShell vs CLI

Feature	PowerShell	CLI (Command Line Interface)
Platform	Cross-platform (Windows, macOS, Linux)	Cross-platform (Windows, macOS, Linux)
Runs in	Windows PowerShell or PowerShell Core	Windows Command Prompt, PowerShell, Bash, etc.
Type	Scripting language (used for automation)	Command-based tool (focused on executing actions)
Focus	Action-oriented scripting, automation, workflows	Direct command execution for quick tasks

🔹 Example: Create a User

Using Azure CLI:

az ad user create --display-name "New User" --password "Password" --user-principal-name NewUser@contoso.com

Using Microsoft Graph PowerShell:
New-MgUser -DisplayName "New User" -PasswordProfile Password `
-UserPrincipalName "NewUser@contoso.com" -AccountEnabled $true -MailNickName "NewUser"

When picking the right tool, consider your past experience and current work environment. Azure CLI syntax is similar to that of Bash scripting. If you work primarily with Linux systems, Azure CLI feels more natural. PowerShell is the Microsoft scripting engine. If you work primarily with Windows systems, then PowerShell is a natural fit. Commands follow a verb-noun naming scheme and data is returned as objects.

Microsoft Graph

Microsoft Graph is a single gateway (https://graph.microsoft.com) that lets you access 
data and insights across Microsoft cloud services like Microsoft Entra ID, Microsoft 365, 
Windows, devices, and more. You can use REST APIs or SDKs to build apps that connect to 
this data for scenarios such as productivity, collaboration, and education.

It also provides services for managing user and device identities, ensuring access control,
 compliance, and security to help protect organizations from data loss.
Graph Connectors bring in data from external sources (like Box, Google Drive, Jira, 
      Salesforce) into Microsoft Graph, enhancing Microsoft 365 experiences such as
     
      Microsoft Search.
Graph Data Connect allows secure, large-scale transfer of Microsoft Graph data into
      Azure data stores, enabling developers to use that data with Azure tools to build
     
      intelligent applications.

Together, the API, connectors, and Data Connect make Microsoft Graph a powerful platform to 
integrate data, gain insights, and extend Microsoft 365 and Azure with smart, customized 
solutions.
Contrast decentralized identity with central identity systems
A Centralized Identity Management system is a single place where user credentials are 
stored and managed to provide authentication and authorization. It can be set up either
on-premises or in the cloud and is controlled by an identity authority or administrator.
This central system ensures that users are verified once and then granted secure access
to applications, data, and other resources across the organization.


Credentials are verified when stored
Management is by single authority
      Admin or Admin group
Used for identity and access management
        Example: Microsoft Entra ID
👉Secure adaptive access ensures strong authentication and risk-based policies to protect 
      resources without disrupting users. 
👉At the same time, a seamless sign-in experience helps users stay productive by reducing password 
      management efforts. With unified identity management, all identities and app access—whether in the
     cloud or on-premises—can be managed from one central place, giving better visibility and control. 
👉Finally, simplified identity governance automates access control for users and admins, ensuring that 
     only authorized individuals can access apps and data efficiently.
Decentralized Identity
 A decentralized identity system lets people, organizations, and devices interact securely while giving
 individuals full control over their own digital identities and credentials. Instead of being managed by a
 central authority, Decentralized Identifiers (DIDs) are self-created, user-owned, and globally unique, 
 stored in decentralized systems with  features like immutability and resistance to tampering or censorship.
 To use a DID, aperson installs a DID User Agent app on their device, which manages identifiers,
 authentication, encryption, and permissions—similar to how a web browser manages internet  access. 
 Unlike the misconception that all identity data is exposed on blockchainsonly identifiers and non-
 sensitive metadata are anchored in decentralized systems, while actual identity data remains encrypted
 and under the user’s sole control “off-chain.”



Components of decentralized identity
 W3C Decentralized Identifiers (DIDs) are unique digital IDs that users create, own, and control
 themselves, without depending on any organization or government. These IDs are connected to
 Decentralized Public Key Infrastructure (DPKI), which uses JSON documents containing public keys,
 authentication details, and service endpoints. DIDs are rooted in decentralized systems such as 
 blockchains or ledgers, which provide the trust, immutability, and features required for secure identity 
 management.
 To make DIDs usable, DID User Agents (like wallet apps) help people create and manage their identifiers,
 control permissions, and verify claims. Tools like the DIF Universal Resolver provide a standard way to
 look up DIDs across different blockchains and return the associated DID Document (DDO) with its 
 public key data. DIF Identity Hubs act as encrypted personal data stores—spread across cloud and edge
 devices like PCs, phones, or smart speakers—that let users store and share identity data securely.

DID attestations allow users to sign and present claims that others can verify, forming the basis of trust
 in the ecosystem. When combined with Identity Hubs, DIDs also enable a new wave of decentralized
 apps and services, where data stays with the user and apps only access it under the permissions granted.

Discuss identity management solutions
Identity = “Who are you?” (user, device, or app)
Authentication = “Prove it” (password, biometrics, MFA)
Authorization = “What can you do?” (read data, edit files, access apps)
So, IAM ensures the right people (or devices/apps) get the right access at the right time.

🔑IAM in Azure with Microsoft Entra ID
   Microsoft Entra ID (formerly Azure AD) is Microsoft’s IAM solution in the cloud.
   It helps organizations:
Enforce MFA (multi-factor authentication).
Provide SSO (single sign-on) → one login to access multiple apps.
Set Conditional Access Policies (e.g., only allow login if the device is
compliant and user is in the office network)Manage users and groups 
          (employees, partners, apps, devices).
 👉IAM = security gate that checks who you are and what you’re allowed to do.
👉Microsoft Entra ID = Microsoft’s cloud-based IAM service.


 Microsoft Entra ID is a universal identity platform that lets people, partners, and customers
 use a single secure identity to access apps and collaborate on any device. It simplifies
 login, strengthens security, and streamlines identity management across the organization.
Common Microsoft Entra ID terminology
Microsoft Entra ID: Cloud-based identity and access management (IAM) solution with integrated
          security, designed to be fast, scalable, and reliable.
Identity: An object that can be authenticated (e.g., user, app, or server).
Account: An identity with data associated with it (every account is tied to an identity).
Microsoft Entra Account: Identity created through Entra ID or Microsoft cloud services 
          (e.g., Microsoft 365); also called a work or school account.
User: A single verifiable identity in Microsoft Entra ID.
Group: A container of users or identities used to assign permissions collectively.
Azure Subscription: The billing entity used to pay for Azure cloud services (linked to payment 
           methods).
Microsoft Entra Tenant/Directory: A dedicated instance of Microsoft Entra ID created for an 
      organization when it subscribes to Microsoft cloud services. “Tenant” and “Directory” are often 
           used interchangeably.
Administrative Unit: A portion of a tenant used to create an administrative boundary for delegated
          management.
Explain Microsoft Entra Business to Business
Business to business communication for your applications and users is essential. You need to work with external organizations without having to maintain multiple identities. 
That creates the space for Azure Business to Business (B2B) services. And the product Microsoft Entra External Identities, part of Microsoft Entra.
Microsoft Entra External Identities
Microsoft Entra External Identities let organizations securely work with people outside their company
—such as partners, suppliers, vendors, or customers. It allows external users to use their own identities
 (like their company login, government ID, or even social accounts such as Google or Facebook) to
 access your apps and resources. 
 Their identity is verified by their own provider, while you use Microsoft
 Entra ID or Entra B2C to control what they can access. This way, collaboration is easy and secure 
 without creating new accounts for every external user.
The following capabilities make up External Identities:
Type of B2B
Usage
B2B collaboration
Collaborate with external users by letting them use their preferred identity to sign in to your Microsoft applications or other enterprise applications (SaaS apps, custom-developed apps, etc.). B2B collaboration users are represented in your directory, typically as guest users.
B2B direct connect
Establish a mutual, two-way trust with another Microsoft Entra organization for seamless collaboration. B2B direct connect currently supports Teams shared channels, enabling external users to access your resources from within their home instances of Teams. B2B direct connect users aren't represented in your directory, but they're visible from within the Teams shared channel and can be monitored in Teams admin center reports.
Microsoft Entra Business to Consumer
 Microsoft Entra B2C is a customer identity and access management (CIAM) solution that lets businesses
 provide secure sign-in for their customers. With Entra B2C, customers can use their preferred social,
 enterprise, or local accounts to access apps and APIs with single sign-on.
 It’s designed to handle millions of users and billions of logins daily, while automatically protecting 
 against threats like brute-force or  denial-of-service attacks. 
 Unlike Microsoft Entra ID (used for employees and partners), Entra B2C is specifically built for
 customer-facing applications, allowing anyone to sign up and use your services.
Compare Microsoft identity providers
An identity provider (IdP) is a system that creates, manages and stores digital identities. Microsoft Entra ID is an example. The capabilities and features of identity providers can vary. The three most common components are:
a repository of user identities
an authentication system
security protocols that defend against intrusion
 An identity provider (IdP) verifies user identities using authentication factors like passwords, 
 fingerprints, or other methods. IdPs are often trusted services that enable single sign-on (SSO), allowing
 users to access multiple apps or resources with one login. SSO improves usability by reducing password
 fatigue and increases security by lowering the potential attack surface. Identity providers also help
 connect users to cloud resources, minimizing the need to repeatedly reauthenticate on mobile or roaming
 applications.
Common identity protocols
Here’s a simple explanation of your text:
OpenID Provider (OIDC): Uses the OpenID Connect protocol (built on OAuth2) to authenticate
           users. It issues identity tokens in JSON format to apps or services, letting them verify who the user 
           is.
SAML Identity Provider: Uses the SAML standard (XML-based) to share authentication and 
         authorization data between an identity provider and a service provider. The service provider uses
         these assertions to decide what the user can access.

Compare identity providers in Microsoft Azure
Microsoft provides several different tools for identity based on your business needs and goals. Microsoft Entra ID should be your go to starting point for cloud based identity. Other services can provide supporting capabilities as you transition from on-premises to the cloud.

Microsoft Entra Domain Services
Microsoft Entra ID
Active Directory Domain Services
Provides managed domain services with a subset of fully compatible traditional AD DS features such as domain join, group policy, LDAP, and Kerberos / NTLM authentication.
Cloud-based identity and mobile device management that provides user account and authentication services for resources such as Microsoft 365, the Azure portal, or SaaS applications.
Enterprise-ready lightweight directory access protocol (LDAP) server that provides key features such as identity and authentication, computer object management, group policy, and trusts

Active Directory Domain Services (AD DS)
👉Active Directory Domain Services (AD DS) is an enterprise-ready LDAP server that manages 
      identities, authentication, computers, groups, and policies. It is a core component for on-premises IT 
      environments, providing user account authentication and computer management.
Microsoft Entra ID
Cloud-based identity and mobile device management that provides user account and authentication services for resources such as Microsoft 365, the Azure portal, or SaaS applications.
Microsoft Entra ID can be synchronized with an on-premises AD DS environment to provide a single identity to users that works natively in the cloud.
Microsoft Entra Domain Services
👉 Microsoft Entra Domain Services (Entra DS) provides managed domain services in Azure, similar to
       traditional Active Directory. It lets you join computers to a domain, apply group policies, and use LDAP 
       or Kerberos/NTLM for authentication.
👉 Entra DS works with Microsoft Entra ID (Azure AD), which can  also sync with your on-premises
      AD. This setup allows you to move existing applications to Azure easily while keeping the same
      identity and authentication system.
Define identity licensing
A license is an agreement that allows users or groups to use Microsoft software or cloud services. 
Licenses define what features a user can access and are required for many Microsoft technologies, 
including Azure and Microsoft 365.

Types of Licenses:
Microsoft Entra ID P1 / P2 License
Grants access to advanced features in Microsoft Entra ID.
P2 license is required for Privileged Identity Management (PIM).
Users who assign or manage PIM roles need a license; privileged role users do not need a license.
Microsoft 365, Office 365, and Windows Licenses
Assigned to users or groups to access Office apps or Windows.
One license per user is required.
Monthly Active User (MAU) License
Used with Microsoft Entra External Identities.
Billing is based on external users who log in during the month.
Other Licenses
Microsoft offers many additional licenses for different services and scenarios.
License
Monthly Active User (MAU) billing
Purchased agreement to allow users or guests to use a Microsoft technology.
Pricing model for external users in Microsoft Entra ID
Common SKUs / Licenses:
MAU billing available when you have a subscription
Microsoft Entra ID P1 or P2 license
Report of active users runs each month for billing
Microsoft 365 / Office 365 license
First 50,000 MAUs free monthly (P1 and P2)
Windows license
Helps establish predictable pricing
License needed per user on the service

Subscription versus a license
Subscription: An agreement with Microsoft to use cloud services.
SaaS (Microsoft 365, Dynamics 365) → charged per user.
PaaS/IaaS (Azure) → charged based on resource usage.
Can be trial (limited time/usage) or paid.
Organizations can have multiple subscriptions.
License: A right for an individual user account to access services under a subscription.
Fixed monthly fee per user.
Admins assign licenses to users.
Example: A company with 100 licenses in Microsoft 365 E5 can enable 100 users.

👉 In short: A subscription is the overall agreement for cloud services, while a license is what lets
      each individual user access those services.

Explore authentication

Authentication = Validating that a user, app, or device is really who/what it claims to be, while ensuring 
the right level of security during the process.

Capabilities of Identity Authentication:
 1)Convenience – Focus on user experience when entering credentials. If authentication is 
 easy and smooth, users are more likely to adopt it.
2)Sources – Authentication tokens can come from multiple identity providers (e.g., Microsoft 
Entra ID, federated identity systems).

3)Protocols – Organizations often use many authentication protocols. Standardizing on modern,
 secure protocols improves both security and user experience.

4)Assurance – Confidence that the user is legitimate. Involves using personalized accounts and
 stronger methods like multifactor authentication (MFA) or risk-based authentication.

In short: Authentication provides secure, flexible, and user-friendly identity validation by
 ensuring convenience for users, supporting multiple identity sources, adopting secure
 protocols, and strengthening assurance with MFA and risk-based checks.

 Federated identity

Federation is a trust relationship between multiple domains.
Trust usually covers authentication and often authorization.
It lets organizations use existing identities from trusted sources (e.g., on-premises Active Directory) across different systems or domains.
👉 In short: Federation allows users to access resources across trusted domains without needing 
    separate identities.
Common communication protocols in identity
Protocol
Description and usage
SAML - Security Assertion Markup Language
Open standard for exchanging authentication and authorization data between an identity provider and a service provider. Common SAML attributes:
Principal = generally a user or device, IdP = identity provider, SP = service provider
IdP = identity provider
SP = service provider
WS-Fed - Web Services Federation
An identity specification from Web Services Security framework to provide single-sign-on via external identity exchange and authentication.
OIDC - OpenID Connect
OIDC extends the OAuth 2.0 authorization protocol for use as an authentication protocol, so that you can do single sign-on using OAuth.
OpenID Connect
OIDC = Authentication protocol built on OAuth 2.0.
Allows secure sign-in and API access for apps.
Enables Single Sign-On (SSO) using OAuth.
Introduces:
ID Token → Verifies user’s identity + provides basic profile info.
UserInfo Endpoint → API to fetch user details.
👉 In short: OIDC extends OAuth 2.0 to provide authentication, SSO, and user identity information
    through ID tokens and the UserInfo API.
Claims-based identity in Microsoft Entra ID
Claims in Microsoft Entra ID (OpenID Connect)
Claim = A piece of information about a user (key/value pair, e.g., email=bob@contoso.com).
Issuer = Microsoft Entra ID (the trusted authority that creates claims).
Process flow:
User authenticates.
Identity Provider (IDP) sends claims.
App may normalize or add extra claims.
App uses claims for authorization.
Control of claims:
Claims returned depend on the scope parameter in the OpenID Connect request.
Entra ID sends a limited set of claims in an ID token (JSON Web Token).
Extra user info: Use Microsoft Graph API if more details are needed beyond the ID token.
👉 In short: Claims are trusted user info sent by Entra ID in tokens; apps use them for 
      authorization. For richer user details, call Microsoft Graph.
Security tokens
Security tokens let client applications access protected resources. The three main types are:
Access Token
Issued by: Authorization server (OAuth 2.0 flow).
Purpose: Grants access to web APIs and protected resources.
Content: Info about the user and the resource.
Validation: Checked by resource servers before granting access.
Refresh Token
Purpose: Used to get a new access token when the old one expires.
Lifetime: Longer than access tokens.
Behavior: Helps maintain sessions without re-authentication.
ID Token
Issued in: OpenID Connect flow.
Purpose: Authenticates the user’s identity (not resource access).
Usage: Sent to the client app, sometimes along with an access token.
👉 In short:
Access token = access resources.
Refresh token = renew access tokens.
ID token = prove who the user is.
What is a JSON Web Token (JWT)?
Definition: An open standard (RFC 7519) for securely transmitting information as a JSON
     object.
Features:
Compact & self-contained → easy to transmit in URLs, HTTP headers, or cookies.
Digitally signed → ensures data integrity and trust.
Signing methods:
Secret key (HMAC).
Public/private key pair (RSA or ECDSA).
Types of JWTs:
Signed JWTs (most common): verify authenticity of claims.
Encrypted JWTs: hide the claims from other parties (confidentiality).
Use case: Authentication & authorization (e.g., Microsoft Entra ID, OAuth, OIDC).
👉 In short: A JWT is a secure, signed JSON object used to share trusted information (claims) between parties.
Definitions within claims-based identity
There are some common terms used when discussing claims-based identity in Microsoft Entra ID.
Claim - a value pair of data within a security token. There are multiple claims transferred within the token from the claim that defines the type of the token to the encryption method. Here is an example:
   Header
   {
     "alg": "HS256",
     "typ": "JWT"
   }
   Content payload
   {
     "sub": "1234567890",
     "name": "John Doe",
     "aud": "https://jwt.io"
   }
Assertion - a package of data, usually in for form of token that share the identity and security information about a user or account across security domains.
Attribute - a value pair of data within a token.
Augmentation - the process of adding other claims to the user token to provide extra detail about the user. This could include data from human resource (HR) systems, from an application like SharePoint, or other systems.
Discuss authorization
Authorization covers what an identity can access and what are they allowed to do once they gain access. Identity authorization provides:

Methods of assigning entitlement allowing for increased security and less administration
Ability to manage policy control
Simplify enforcement by standardizing on a common approach
Authorization is all about giving access to a verified identity, what they should have access to. The tracking and enforcing that access and usage. With authorization you focus on:
Authorization concept
Description and usage
Entitlement Type
Entitlements focus on whether or not an identity has been granted (“entitled”) access to a particular resource. As such, entitlements are handled using many different types. The assignment of entitlements happens at the application level, centrally via groups, defined through role based access control or attributes (ABAC) or applied centrally using a policy based (PBAC) approach.
Access Policies
Access policies focus on a set of applications, data, and which users and groups can perform activities. Think of it as the set of rules around getting your job done. Focus on the least access you need.
Enforcement
The enforcement capability focuses on how an organization handles the enforcement of authorization activities. In most cases, organizations handle enforcement at the application layer. Meaning enforcement is completed by an API within the application itself. Some forms of enforcement consist of the use a reverse proxy (such as UAG) to externalize authorization enforcement. A current trend is to use an external policy source (such as XACML) to determine how the identity interacts with the resource.
What is authorization?
The process of setting and enforcing permissions that determine what an entity (user, app, or service) can do after authentication.


Focus:


Which resources the entity can access.


What data they can see.


What actions they can perform on that data.




Contrast with Authentication (AuthN):


AuthN = Proves who you are.


AuthZ = Decides what you’re allowed to do.




Example:


Authentication: You log in with your username/password.


Authorization: The system checks if you can view reports, edit records, or manage admin settings.





👉 In short:

Authentication = identity verification ✅

Authorization = access control & permissions 🔑
Common types of authorization approaches:
Access Control Lists (ACLs)


How it works: A direct list of who can or can’t access a resource.


Pros: Fine-grained control.


Cons: Hard to manage at scale (many users/resources).




Role-Based Access Control (RBAC)


How it works: Access is based on assigned roles (e.g., Admin, Editor, Viewer).


Pros: Most common, easier to manage than ACLs.


Cons: Roles can become too broad or rigid if not designed well.




Attribute-Based Access Control (ABAC)


How it works: Rules evaluate attributes of user, resource, and environment.


Example: Only managers (user attribute) can open “manager-only” files (resource attribute) during business hours (environment attribute).


Pros: Very flexible and dynamic.


Cons: More complex to configure and maintain.




Policy-Based Access Control (PBAC)


How it works: Uses policies + business roles to define access.


Example: A “Finance Analyst” role + a policy that says “Finance data can only be exported by senior analysts.”


Pros: Business-oriented, scalable.


Cons: Requires clear policy definitions and governance.





Authentication Context
Purpose: Adds extra security for applications and sensitive data.


Applicable to:


Custom applications


Line-of-business (LOB) apps


Apps like SharePoint


Apps protected by Microsoft Defender for Cloud Apps




How it works: Access can be conditional based on context, such as:


Device type (e.g., must connect from a managed device)


User agreements (e.g., must accept terms of use)




Example:


Lunch menu site → accessible by everyone.


Secret BBQ sauce recipe site → accessible only from managed devices + users must agree to terms.



👉 In short: Authentication Context lets organizations enforce extra access conditions beyond just username/password or role.
Explain auditing in identity
 Auditing in Identity


Auditing tracks and records all activities related to identity and access management to detect issues, ensure compliance, and troubleshoot problems.


Purpose:


Security detection: Identify attacks in progress or that have occurred.


Compliance: Track who did what for regulatory or organizational requirements.


Troubleshooting: Help developers debug errors in authentication, authorization, or access policies.




What is logged:


Sign-ins and sign-out attempts


Password changes


Multi-factor authentication usage


Configuration changes in identity or access policies




Benefits:


Provides visibility into how identities are used


Helps ensure secure and healthy access management


Enables proactive detection of anomalies




Key logs in Microsoft Entra ID:


Activity logs → overall tenant activities


Sign-in logs → user authentication attempts


Provisioning logs → account creation, updates, or deletions


Audit logs → configuration and administrative changes




Tools for monitoring & reporting:


Azure Monitor


Microsoft Sentinel



👉 In short:

Auditing records identity actions so admins can secure, monitor, and troubleshoot access to protect both users and data.
Understand concept of governance
Governance is the act of overseeing, controlling, and directing a system to ensure it operates correctly and efficiently.


Scope: Applies to any system—government, budget, or an identity solution on Azure.


Key aspects:


Processes & controls: Ensure the system is used correctly and securely.


Monitoring: Regularly track system performance and usage.


Assessment: Evaluate whether the system meets objectives and compliance requirements.


Updating: Remove outdated features, improve processes, and adapt to changing needs.




Why it matters: Without governance, even a well-built system will degrade, become insecure, or fail over time.

👉 In short: Governance = continuously monitor, evaluate, and improve your identity solution to keep it secure, efficient, and compliant.
Scenario
The simple but probably story
Juan the app developer
You have a user by the name of Juan. Juan is given an account in your company and works for several years. Over that time, the user is given admin access to deploy an application Juan helped to build. Later Juan leaves the company in good regard; however, the user account is never removed from the system. Juan's manager forgot to submit the paperwork to close the account. There's no governance system in place to notice the account is unused and that Juan is no longer listed in the HR systems. A year later, Juan falls victim of a phishing email and has a personal username and password stolen. Being like many people, Juan used a similar password for personal life and work accounts. Guess what, you now have a scenario where your systems could be broken into, by what appears to be a valid account.
Why governance? In this scenario, governance could help in many different areas:
Checking with HR regularly to see if all the accounts still exist in the HR database as employees.
Checking to see when the last time an account was logged into.
Checking to see whether the account needs all the rights it currently has.
Checking to ensure that passwords are changed regularly; or better yet that your employees use MFA.
And many other ways
Understand concept of identity lifecycle management
Identity Lifecycle Management (ILM)


ILM is the process of automating and managing the entire lifecycle of digital identities in an organization. It forms the foundation for identity governance.


Purpose:


Ensure identities are accurate, secure, and up-to-date.


Scale identity management efficiently, especially in mid-to-large organizations.


Reduce manual effort in creating, updating, and removing user accounts.




Key Concepts:


Real-world correlation: Map physical entities (employees, contractors, visitors) to their digital representations in the system.


Automation: Automatically provision, update, and de-provision identities to keep directories consistent.


Authoritative systems: Use systems of record (e.g., HR system) as the source of truth for identity information.


Directory synchronization: Compare authoritative data with application directories and resolve inconsistencies.


Visitor management: Establish processes to determine when temporary or external identities are no longer needed.




Typical Lifecycle Steps:


Identify authoritative data sources (HR systems, employee databases).


Sync and reconcile data with application directories.


Provision accounts for new identities.


Update account information as roles or attributes change.


De-provision or remove identities when no longer needed.





👉 In short: Identity Lifecycle Management = automate, maintain, and govern digital identities from creation to retirement to ensure security and operational efficiency.

 Identity Lifecycle Management (ILM) Strategy: Join, Move, Leave
Purpose: Plan how digital identities are created, updated, and removed for employees, contractors, students, or anyone with an organizational relationship.


Join


When an individual enters the organization or scope requiring access.


Action: Create a new digital identity if one does not exist.


Example: New employee gets a user account in Microsoft Entra ID.


Often automated for efficiency.




Move


When an individual changes roles, departments, or boundaries within the organization.


Action:


Remove access no longer required.


Grant new access based on the new role or department.




Example: Employee moves from Sales → Marketing.




Leave


When an individual leaves the organization or no longer needs access.


Action:


Remove access rights.


Keep the identity only for audit or forensic purposes if needed.









👉 In short: The Join-Move-Leave (JML) process ensures that digital identities accurately reflect users’ access needs throughout their lifecycle, supporting security, compliance, and operational efficiency.
Monitoring tools
Always think Zero Trust: Verify explicitly - Use least privilege access - Assume breach
Monitoring services:
Azure Monitor
Application Insights
Azure Service Health
Azure Resource Health
Azure Resource Manager
Azure Policy