Troubleshooting Authentication and Access Control Issues
Authentication and authorization troubleshooting requires separating identity proof (authentication) from permission (authorization). Know Microsoft Entra ID primitives: users, groups, service principals, managed identities (system- and user-assigned), app registrations, and enterprise applications. Conditional Access policies evaluate signals (user, device, location, app, risk) and can block or require MFA; a policy in report-only mode does not enforce. Multi-tenant scenarios involve guest invitations, cross-tenant access settings, and B2B trust.
Authorization on Azure resources uses Azure RBAC: role assignments at management group, subscription, resource group, or resource scope, with deny assignments overriding allow. Traps: assuming Owner grants data-plane access (it does not for Key Vault secrets or Storage blobs unless a data role is assigned); confusing Azure RBAC with Entra directory roles; forgetting that inherited assignments apply to child scopes; and overlooking that PIM activation may be required before a role is effective. Token issues often trace to audience mismatch, expired client secrets or certificates, or missing API permissions with admin consent.
Worked example: a managed identity receives 403 from Key Vault. Authentication succeeded (the identity obtained a token), so the fault is authorization: the identity lacks the Key Vault Secrets User role, or the vault's access policy/firewall excludes it. Check the vault's permission model first, then network restrictions.
Diagnostic order: confirm sign-in success in Entra sign-in logs, review Conditional Access "what if" evaluation, verify token claims, then check role assignments and scope inheritance.