Identity, Access, and Security Posture
Identity foundation
Microsoft Entra ID is the cloud identity provider. A tenant is the identity boundary; subscriptions are billing and resource boundaries. Users, groups, and service principals are directory objects. Managed identities eliminate stored credentials for Azure resources. Conditional Access evaluates signals such as user, device, location, and risk to enforce MFA or block access. Privileged Identity Management (PIM) provides just-in-time role activation.
Authorization and security posture
Azure RBAC grants permissions at a scope: management group, subscription, resource group, or resource. Azure Policy enforces configuration rules but does not grant access. Key Vault stores secrets, keys, and certificates. Defender for Cloud provides posture management and threat protection; Secure Score measures posture. Microsoft Purview governs data. Zero Trust assumes breach and verifies explicitly.
Traps
Candidates often confuse RBAC with Azure Policy, assume Owner and Contributor differ only in billing, or think a managed identity is a user account. Another trap is treating a subscription as an identity boundary. Also remember that service principals can use secrets or certificates, while managed identities avoid secret management. Azure AD DS is a managed domain service, not the same as Entra ID.
Worked example
An app running on an Azure VM must read a Key Vault secret. Creating a service principal with a secret stored in code is risky. Instead, enable a system-assigned managed identity on the VM and grant it the Key Vault Secrets User role scoped to that vault. No credential is stored.
Rule of thumb
Authenticate with identity, authorize with RBAC at the narrowest scope, enforce with policy, and protect secrets with Key Vault.