Secure Identity and Access
Two role systems, one tenant
AZ-500 identity questions hinge on keeping Microsoft Entra ID (formerly Azure AD) directory roles separate from Azure RBAC roles. Entra roles (Global Administrator, User Administrator, Security Reader) govern the directory; Azure RBAC roles (Owner, Contributor, Reader, custom roles) govern resource-plane operations at a scope - management group, subscription, resource group, or resource. Assignments inherit downward, so a subscription-level Owner is Owner on every resource group inside it. Neither system grants the other's rights: an Owner of a subscription cannot read sign-in logs unless given an Entra role.
Authentication and Conditional Access
Know the authentication methods (password plus MFA, FIDO2 passkeys, Microsoft Authenticator, certificate-based auth, Temporary Access Pass), self-service password reset, and Entra Password Protection. Conditional Access is signal plus decision: assignments (users, groups, workloads), target cloud apps, conditions (sign-in risk, user risk, device state, location, client app), then grant controls (block, require MFA, require compliant or hybrid-joined device, require approved client app) and session controls (sign-in frequency, app-enforced restrictions). Policies evaluate together and the most restrictive wins; a block always wins.
Privileged access
Privileged Identity Management delivers just-in-time activation, approvals, MFA at activation, and access reviews. Entitlement management handles access packages for internal and external users. Managed identities (system-assigned, tied to the resource lifecycle; user-assigned, standalone and shareable) remove stored secrets for Azure-to-Azure authentication.
Worked example. A team must read blobs but never delete them. Create a custom role with actions: ["Microsoft.Storage/storageAccounts/blobServices/containers/read"] and notActions: ["*/delete"], assign it at storage-account scope to a group, and require PIM activation. Traps: PIM needs Entra ID P2 and Conditional Access needs P1; a deny assignment overrides any allow; a Reader at subscription scope reads every resource in it.