L11. Identity and Security: Entra ID, RBAC, and Defender for Cloud

Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is Azure's cloud-based identity and access management service. It provides authentication and authorization for Azure resources, Microsoft 365, and third-party SaaS applications. Key Entra ID features tested on AZ-900:

• Single Sign-On (SSO): one set of credentials to access multiple applications
• Multi-Factor Authentication (MFA): requires a second form of verification beyond password
• Conditional Access: grant or block access based on conditions (user location, device compliance, risk level)
• B2B: invite external users (guests) to your tenant
• B2C: customer identity for consumer-facing applications

Azure RBAC (Role-Based Access Control)

Azure RBAC controls who can do what with Azure resources. You assign roles to identities (users, groups, service principals) at a specific scope. Key roles:

• Owner: full access including ability to delegate access
• Contributor: create and manage resources but cannot grant access to others
• Reader: view resources only; cannot make changes

Scope hierarchy: Management Group > Subscription > Resource Group > Resource Roles assigned at a higher scope inherit down to child scopes. Principle of least privilege: grant only the minimum permissions needed for a task.

Microsoft Defender for Cloud

Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) service. Two main functions:

• Secure Score: a numeric measure of your security posture; higher is better; provides prioritized recommendations
• Defender plans: paid workload protection for VMs, databases, containers, etc.

Zero Trust Security Model

Zero Trust assumes no implicit trust: "never trust, always verify." Key principles:

• Verify explicitly: authenticate and authorize based on all available data
• Use least privilege access: limit access with just-in-time and just-enough-access
• Assume breach: minimize blast radius, segment access, encrypt data

Exam tip: Entra ID is the identity plane for all Microsoft cloud services. MFA + Conditional Access is the basic Zero Trust implementation for identities on AZ-900.