AZ-305
Deep Dive
The AZ-305 architect designs the access control layer: Conditional Access policies as the central engine, phishing-resistant MFA, just-in-time privileged access with PIM, and continuous governance with access reviews. The exam question is always: which combination of controls meets the requirements with the least friction and cost?
Contents
Conditional Access (CA) is Entra ID's Zero Trust policy engine: it evaluates signals (user, location, device, app, risk) and applies controls (block, require MFA, require a compliant device). It requires an Entra ID P1 license; risk-based policies require P2.
Signals (IF)
Access controls (THEN)
Session controls
Design best practices (they show up on the exam)
| Method | Phishing-resistant | Design notes |
|---|---|---|
| FIDO2 / Passkeys | Yes | Gold standard. Hardware keys or on-device passkeys. For privileged roles and regulated environments. |
| Windows Hello for Business | Yes | Device-bound biometrics/PIN. Passwordless for a managed-Windows workforce. |
| Certificate-based auth (CBA) | Yes | Smartcards/certificates — government organizations or those migrating from ADFS. |
| Microsoft Authenticator (push + number matching) | Partial | Good usability/security balance for most users. Number matching mitigates MFA fatigue. |
| SMS / voice call | No | Vulnerable to SIM swapping. Fallback only; remove for privileged accounts. |
Authentication Strengths
Instead of requiring "generic MFA", a CA policy can require a specific authentication strength — e.g. "phishing-resistant MFA" (FIDO2, WHfB, CBA only) for global administrators. If the scenario asks for "phishing-resistant MFA for privileged roles", the answer is CA + authentication strength, not per-user MFA.
Privileged Identity Management (PIM) eliminates standing privileges: users are made eligible for a role and activate it only when needed, for a limited time, with justification, MFA and optional approval. Requires Entra ID P2.
What PIM covers
Per-role configuration
Exam signal
Phrases like "just-in-time", "only when needed", "reduce standing privileges", "approval before elevating" → PIM. If it also asks to periodically review who still holds access → PIM + Access Reviews.
Sign-in risk
Does this specific login look legitimate?
User risk
Is this identity compromised?
Recommended design: instead of legacy Identity Protection policies, create risk-based Conditional Access policies (user/sign-in risk signal as a condition). Requires P2. Leaked credential detection only works with Password Hash Sync enabled.
Access Reviews
Periodic reviews (e.g. quarterly) of who still holds access to groups, apps, Entra roles and PIM assignments. The reviewer (manager, resource owner or the user themselves) approves or revokes. It can auto-remove anyone who doesn't respond.
Exam signal: "periodically review B2B guest access" → Access Reviews.
Entitlement Management
Access packages: bundles of resources (groups + apps + SharePoint sites) that users request through an approval workflow, with automatic expiration and integrated reviews. Ideal for project onboarding and governed B2B collaboration.
Signal: "users should be able to request access with approval and expiration" → access packages.
| Requirement | Solution | License |
|---|---|---|
| Require MFA only from outside the corporate network | Conditional Access + named locations | P1 |
| Block basic POP/IMAP/SMTP | CA — block legacy authentication | P1 |
| Phishing-resistant MFA for Global Admins | CA + authentication strength (FIDO2/WHfB/CBA) | P1 |
| Require MFA when the sign-in is risky | CA based on sign-in risk | P2 |
| Force a secure reset if credentials are leaked | CA based on user risk (+ PHS) | P2 |
| Admin roles activated only when needed | PIM (eligible + JIT activation) | P2 |
| Quarterly review of guest access | Access Reviews | P2 |
| Self-service access request with approval and expiration | Entitlement Management (access packages) | P2 |
Did you get this topic?
Test what you just learned
A company requires its global administrators to: (1) not have the role assigned permanently, (2) require approval from a responsible party before using it, and (3) use phishing-resistant MFA when activating it. Which combination of services do you design?
Put what you learned to the test with original AZ-305 exam questions.
Start AZ-305 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.