Security, Identity, and Governance Revision

Exam-critical Entra ID facts: Entra ID (formerly Azure AD) is Microsoft's cloud identity service — not the same as on-premises Active Directory Domain Services (AD DS). An Entra ID tenant represents an organisation's cloud identity instance. A tenant can have multiple subscriptions but each subscription trusts exactly one tenant. Key objects: Users (individual accounts), Groups (collections of users or devices), Service Principals (application identities), and Managed Identities (Azure-managed service principals).

A commonly confused AZ-900 distinction: Azure RBAC controls access to Azure resources (VMs, storage accounts, resource groups) and is scoped to subscriptions, resource groups, or individual resources. Entra ID roles control access to Entra ID objects (users, groups, applications, devices) and are scoped within the Entra ID tenant. A Global Administrator in Entra ID does not automatically have access to Azure subscriptions. A Contributor in Azure RBAC cannot manage Entra ID users. The two role systems are separate.

Multi-Factor Authentication (MFA) requires users to verify their identity with two or more factors: something they know (password), have (authenticator app, SMS), or are (biometric). In Entra ID, MFA is enforced through Conditional Access policies. A Conditional Access policy evaluates signals (user identity, device compliance, location, app being accessed) and then enforces access controls (require MFA, block access, require compliant device). The exam tests: which Entra ID licence tier includes Conditional Access — the answer is Entra ID P1 or higher.

Microsoft's Zero Trust security model is built on three principles: Verify explicitly — authenticate and authorise every request using all available data points (identity, location, device, service, data classification). Use least privileged access — limit user access with just-in-time and just-enough-access, risk-based adaptive policies. Assume breach — minimise blast radius by micro-segmenting networks, encrypting end-to-end, and using analytics to gain visibility and drive threat detection. The AZ-900 exam expects you to identify Zero Trust principles in scenario questions.

Defender for Cloud key points for the exam: it provides a Secure Score — a percentage showing how well your environment follows Microsoft security recommendations. Recommendations are grouped into security controls (like 'Remediate security configurations', 'Implement advanced data security'). Defender for Cloud works across Azure, on-premises (via Azure Arc), and other clouds. There are two modes: Free (basic CSPM and security recommendations only) and Defender plans (paid, adds advanced threat protection per workload type — VMs, SQL, Storage, Containers, etc.).

Azure Key Vault exam facts: Key Vault stores three types of objects — Secrets (passwords, connection strings), Keys (RSA or EC keys for encryption operations), and Certificates (X.509 certificates with lifecycle management). Access to Key Vault is controlled by RBAC (newer, recommended) or the legacy Key Vault Access Policy model. Key Vault integrates with managed identity so applications never store credentials. Key Vault has two tiers: Standard (software-protected keys) and Premium (FIPS 140-2 Level 2 HSM-backed keys).

Azure Policy exam points: a Policy Definition specifies what to evaluate and what action to take (Audit, Deny, DeployIfNotExists, Modify). A Policy Assignment applies a definition to a scope (management group, subscription, or resource group). A Policy Initiative (also called policy set) groups multiple definitions together. The DeployIfNotExists effect is special — it automatically deploys a remediation resource if the condition is met (e.g., deploy a Log Analytics agent to VMs missing one). Compliance results show as percentages in the Compliance dashboard.

Management group facts: you can nest management groups up to 6 levels deep below the root. The Tenant Root Group is the top-level management group, created automatically. Policies and RBAC assignments made at a management group level are inherited by all child management groups and subscriptions below them. Common enterprise design: root → Platform (connectivity, identity, management subscriptions) → Landing Zones (production, non-production) → product-specific subscriptions. This hierarchy enables central governance at scale.

Resource lock facts: CanNotDelete lock allows read and modify but prevents deletion. ReadOnly lock allows only read operations — no modifications or deletions. Locks can be applied at the subscription, resource group, or resource level and are inherited by child resources. Only Owner and User Access Administrator roles can create or delete locks. Resource tags are key-value metadata pairs; they are NOT inherited (unlike locks and policies). Up to 50 tags per resource, max 512-character tag name, and 256-character value.

AZ-900 network security services: Azure DDoS Protection Basic is free and automatically protects all Azure resources against common Layer 3 and Layer 4 DDoS attacks. Azure DDoS Protection Standard is paid (~$2,944/month per protected VNet), adds adaptive tuning, real-time attack metrics, and post-attack analytics. Azure Firewall is a managed stateful firewall with built-in high availability and auto-scaling — it is not an NSG. Azure Firewall operates at Layer 7 (application rules with FQDN filtering), while NSGs operate at Layer 4 (port/IP rules).

Common AZ-900 security scenario patterns:

• Prevent accidental VM deletion → Resource Lock (CanNotDelete)
• Force all resources to have a CostCentre tag → Azure Policy (Deny effect)
• Alert when a user signs in from an unusual location → Entra ID Identity Protection / Conditional Access
• Store application database password securely → Azure Key Vault Secret
• View security recommendations and compliance score → Microsoft Defender for Cloud Secure Score
• Detect threats across subscription audit logs → Microsoft Sentinel

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you revised: Entra ID vs. Azure RBAC (two separate access control systems for cloud identity vs. Azure resources), Defender for Cloud Secure Score (measures security posture and surfaces recommendations), and ReadOnly locks override RBAC (even Owners cannot write to ReadOnly-locked resources). Next up we cover exam strategy and time management for the AZ-900.