AZ-900
Deep Dive
Authentication, authorization, RBAC, and Zero Trust. The identity domain represents ~25% of the AZ-900. The key is distinguishing authentication from authorization and choosing the right control for each scenario.
Contents
Every security architecture rests on three pillars. The AZ-900 tests whether you can tell which tool corresponds to each pillar.
Authentication (AuthN)
Are you who you say you are?The process of verifying identity. The system checks credentials before granting any access.
In Azure
Entra ID verifies username + password. If MFA is enabled, it requests a second factor (app, SMS, biometric).
Exam trap
AuthN answers "who are you?". It does NOT answer what you can do. That's AuthZ.
Authorization (AuthZ)
What can you do?The process of determining which resources or actions are permitted for an already-authenticated identity.
In Azure
RBAC defines what the user can do: Owner can delete. Reader can only view. Contributor can create.
Exam trap
AuthZ happens AFTER AuthN. You can't authorize someone without having authenticated them first.
Auditing
Who did what and when?An immutable record of all actions. Enables forensics, compliance, and anomaly detection.
In Azure
Azure Activity Log + Entra ID Sign-in Logs. 90-day retention by default. Send to Log Analytics for more.
Exam trap
Auditing ≠ alerts. Auditing records the past. Alerts notify in real time. They're complementary.
Formerly called Azure Active Directory (Azure AD). It's Microsoft's cloud identity service. Every Azure, Microsoft 365, or Office 365 account uses Entra ID as its underlying directory.
Main functions
Central directory
Stores all identities: users, groups, service principals, managed identities.
Single Sign-On (SSO)
One login for multiple apps. Sign in once → access Teams, Azure Portal, Salesforce, GitHub without re-authenticating.
Multi-Factor Auth (MFA)
Mandatory second factor for privileged accounts. Reduces the risk of a stolen-password compromise by 99.9%.
B2B (Business-to-Business)
Invite external users (partners, auditors) with their own company account. No need to create additional accounts.
External ID (customers)
Let customers sign up with Google/Facebook/their own email. Your app, their accounts. Successor to Azure AD B2C.
Types of identity in Entra ID
A real person. Employee, admin, or B2B guest account.
A collection of users. You assign permissions to the group, not individually.
An identity for an application. Like a "user" for your app or script.
An automatic Service Principal managed by Azure. No passwords or manual rotation.
Entra ID ≠ classic Active Directory
Entra ID is a cloud directory based on HTTP/HTTPS (OAuth, OIDC, SAML). Active Directory Domain Services (AD DS) is on-premises, using LDAP/Kerberos. They're different products, not the same thing in the cloud.
RBAC is Azure's authorization system. Instead of granting individual permissions to each person, you assign roles. Each role = a set of predefined or custom permissions.
| Role | Can create/modify | Can delete | Can assign roles | Typical use case |
|---|---|---|---|---|
| Owner | ✓ | ✓ | ✓ | Subscription admin, technical lead |
| Contributor | ✓ | ✓ | ✗ | Production developers |
| Reader | ✗ | ✗ | ✗ | Auditors, stakeholders, L1 support |
| User Access Administrator | ✗ | ✗ | ✓ | Managing permissions without touching resources |
| Custom Role | Configurable | Configurable | Configurable | DBA with SQL-only access, DevOps without billing |
Role assignment — 3 components
Security Principal
Who is it assigned to? User, group, service principal, or managed identity.
Role Definition
What can they do? A collection of permissions (actions, notActions). E.g.: "Microsoft.Compute/virtualMachines/read".
Scope
Over which resources? Management Group → Subscription → Resource Group → individual resource.
Inheritance: roles are inherited downward. Assigning Contributor at a Subscription → the user is Contributor across all RGs and resources in that Subscription.
Conditional Access
Policies that evaluate signals (user, location, device, app, risk) and apply controls. If X → then Y.
Zero Trust — the modern model
Principle: "never trust, always verify". There's no trusted network perimeter. Every access is verified, regardless of whether it comes from inside or outside the corporate network.
Verify explicitly
Always authenticate and authorize, based on all available data.
Least-privilege access
Least privilege: only the permissions needed, for the time needed.
Assume breach
Design as if the attacker is already inside. Segment, encrypt, monitor.
Configure a Conditional Access policy in Microsoft Entra ID that requires multi-factor authentication — the heart of the Zero Trust model.
+1 more...
The 3 authentication factors
Something you KNOW
Something you HAVE
Something you ARE
MFA = at least 2 factors from different categories. Password + PIN is not MFA (both are "something you know"). Password + authenticator app is MFA.
Security statistics (Microsoft, 2023)
A frequent exam question: when to use each one.
| Dimension | AD DS (on-premises) | Microsoft Entra ID (cloud) |
|---|---|---|
| Where it lives | Your own servers (Domain Controllers) | Microsoft cloud (global) |
| Protocol | LDAP, Kerberos, NTLM | HTTP/HTTPS, OAuth 2.0, OIDC, SAML 2.0 |
| Devices | Domain-joined Windows PCs | Any device, any OS, any location |
| Supported apps | Legacy corporate apps (Kerberos) | Modern apps, SaaS, API (Google, Salesforce, GitHub) |
| Native MFA | No (requires an extension) | Yes, built in |
| Conditional Access | No | Yes (Conditional Access policies) |
| Scaling | Manual (add DCs) | Automatic, global |
| Maintenance | Your team: patches, HA, AD backup | Microsoft (99.99% SLA) |
| Ideal use case | Legacy on-premises apps, GPOs, corp PC join | Cloud identities, SaaS, remote work, modern apps |
Hybrid scenario — the most common
Many companies have AD DS on-premises AND Entra ID in the cloud. They connect them with Entra Connect (identity synchronization). The user authenticates with their corporate account both on domain PCs and in Teams, Azure Portal, and Salesforce.
Navigate to the Subscriptions panel, explore the Tenant → Management Group → Subscription → Resource Group hierarchy, and practice assigning an RBAC role at the subscription level. Key concepts for the AZ-900 exam.
+2 more...
Create a new user in Microsoft Entra ID (formerly Azure Active Directory). Identity is the foundation of security in Azure and one of the most tested domains on the AZ-900.
+1 more...
Did you get this topic?
Test what you just learned
Which protocols does Microsoft Entra ID use for modern authentication and authorization?
Put what you learned to the test with original AZ-900 exam questions.
Start AZ-900 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.