Manage Azure identities and governance
This domain tests how you establish identity, authorization, and governance boundaries before workloads are deployed. Expect questions on Microsoft Entra ID objects, role assignments, Azure Policy, management groups, resource locks, and cost controls.
Identity objects and authentication
Entra ID stores users, groups, service principals, and managed identities. Cloud-only accounts are created in the portal; synchronized accounts come from AD DS through Entra Connect or cloud sync. Self-service password reset needs the right license, and on-premises writeback requires password writeback to be enabled. Conditional Access and PIM require Entra ID P1 or P2. Managed identities remove secrets from code: a system-assigned identity dies with the resource, while a user-assigned identity survives.
Authorization and governance
Azure RBAC is additive and inherited from management group to subscription to resource group to resource. Owner, Contributor, Reader, and User Access Administrator are common roles. A role assignment grants control-plane actions; data-plane access to blobs, queues, or tables needs a data role such as Storage Blob Data Reader. Azure Policy evaluates properties during create and update and can audit, deny, append, modify, or deployIfNotExists. Policy does not delete existing noncompliant resources unless you run remediation. Management groups nest up to six levels below the tenant root. Locks (CanNotDelete, ReadOnly) apply at any scope and block control-plane operations even for Owners.
Worked example
A team must read a storage account but never delete its resource group. Assign Reader on the resource group for control-plane visibility, add Storage Blob Data Reader if blob contents are needed, then place CanNotDelete on the resource group. Reasoning: RBAC is inherited and additive, data access is separate from management, and the lock protects the container regardless of role.
Traps
Do not treat Entra ID roles and Azure RBAC as interchangeable; Global Administrator does not grant subscription Owner. ReadOnly locks block updates, not just deletes. Deleting a resource group is blocked by a lock on the group, but a lock on a child does not protect siblings. Policy deny overrides Contributor.