What are the most common Azure Policy effects and what does each do?

`Deny`: Blocks the resource creation/update request in ARM. `Audit`: Allows the request but logs a warning event in the Activity Log and marks the resource non-compliant. `Append`: Adds extra fields to the request before execution. `Modify`: Adds, updates, or removes tags/properties (uses a Managed Identity). `DeployIfNotExists` (DINE): Deploys a remediation ARM template if a companion resource (like diagnostic settings) is missing.

Describe two common operational gotchas when applying a `ReadOnly` lock to an Azure Resource Group or Storage Account.

1. Virtual Machines cannot be started, stopped, or restarted because `start`/`deallocate` is a `POST` control-plane action blocked by `ReadOnly`. 2. Calling `ListKeys` on a Storage Account is a `POST` operation on the ARM control plane (because keys have write permissions), so a `ReadOnly` lock blocks applications or users from listing storage account keys.

What can a Global Administrator in Microsoft Entra ID do if they have lost access to all Azure Subscriptions in the tenant?

Enable the 'Access management for Azure resources' toggle in Microsoft Entra ID properties. This temporarily grants the user the `User Access Administrator` RBAC role at the Root Scope (`/`), allowing them to view all subscriptions and assign themselves or others the `Owner` role.

How does responsibility for Operating System patching and Network Controls differ between IaaS, PaaS, and SaaS in Azure?

IaaS (e.g., Azure VMs): Customer manages OS patching, middleware, and network configs. PaaS (e.g., App Service, Azure SQL): Cloud provider patches the OS; responsibility for network controls and application configuration is shared. SaaS (e.g., Microsoft 365): Cloud provider manages the OS, network, and application software.

How does Azure Policy differ from Azure RBAC?

Azure RBAC focuses on user actions (WHO can perform actions at a scope). Azure Policy focuses on resource properties and compliance state (WHAT kinds of resources and configurations are allowed, regardless of who has RBAC permission—even a Subscription Owner is blocked by a `Deny` policy).

How do Microsoft Entra ID Roles differ from Azure RBAC Roles?

Microsoft Entra ID Roles (e.g., Global Administrator, User Administrator, Application Administrator) control access to directory resources such as users, groups, enterprise applications, and domains via Microsoft Graph. Azure RBAC Roles (e.g., Owner, Contributor) control access to Azure infrastructure and PaaS resources via Azure Resource Manager (ARM).

What are Azure Blueprints (and Template Specs / Deployment Stacks) and what four artifact types can a Blueprint package?

Azure Blueprints allow cloud architects to define a repeatable set of governance tools and standard Azure resources for new subscriptions. The four artifact types are: 1. Resource Groups; 2. ARM Templates; 3. Azure Policy Assignments; 4. Azure RBAC Role Assignments.

Compare System-Assigned and User-Assigned Managed Identities in Azure.

System-Assigned: Enabled directly on an Azure resource; its lifecycle is tied 1:1 to that resource (automatically deleted when the resource is deleted) and cannot be shared. User-Assigned: Created as a standalone Azure resource; its lifecycle is independent and the same identity can be assigned to multiple Azure resources.

Under the Cloud Shared Responsibility Model, which security responsibilities ALWAYS remain with the customer across IaaS, PaaS, and SaaS?

Information and data security, endpoint device protection (mobile/PCs), and account/identity and access management. The cloud provider is always responsible for physical datacenter security, physical hosts, and physical networks.

What is the relationship between an Azure Subscription and a Microsoft Entra ID (formerly Azure AD) tenant?

A many-to-one trust relationship: multiple Azure Subscriptions can trust the same single Microsoft Entra ID tenant for authentication and identity management, whereas each Azure Subscription can trust only one Entra ID directory at any given time.

What are the three core components of a Microsoft Entra Conditional Access policy?

1. Signals / Assignments (Who: users/groups; What: target cloud apps; Where/How: IP locations, device platforms, sign-in/user risk levels); 2. Decision (Grant access or Block access); 3. Enforcement Controls (Require MFA, require compliant/Intune-enrolled device, require Entra hybrid joined device, or Session controls).

Are Azure Tags inherited automatically from a Subscription or Resource Group to child Resources?

No. By default, tags applied to a Subscription or Resource Group are NOT automatically inherited by the individual resources inside them. To enforce tag inheritance, you must assign built-in Azure Policies such as 'Inherit a tag from the resource group if missing' (which uses the `Modify` effect).

What is Microsoft Defender for Cloud's Secure Score and Regulatory Compliance dashboard?

Secure Score is a percentage-based KPI in Microsoft Defender for Cloud that continuously assesses the security posture of your Azure (and hybrid/multi-cloud) resources against the Microsoft Cloud Security Benchmark (MCSB) and provides prioritized security recommendations. The Regulatory Compliance dashboard maps resource posture against standards like ISO 27001, PCI-DSS, SOC 2, and NIST.

What licensing tier is required in Microsoft Entra ID to use Conditional Access vs. Risk-Based Conditional Access (Entra ID Protection)?

Standard Conditional Access policies (based on user, app, location, device) require Microsoft Entra ID P1. Risk-based Conditional Access policies (evaluating real-time Sign-in Risk and User Risk via Entra ID Protection, plus Privileged Identity Management) require Microsoft Entra ID P2.

What parameters must match when moving resources between Azure Subscriptions?

Both the source and destination Subscriptions must exist within the same Microsoft Entra ID tenant, both must be active, the user performing the move must have write permissions (`Microsoft.Resources/subscriptions/resourceGroups/moveResources/action`) on both source and target Resource Groups, and dependent resources (e.g., NICs with VNet or VMs with Key Vaults) must be validated or moved together.

What are best practices for configuring Emergency Access ('Break-Glass') accounts in Microsoft Entra ID?

Create at least two cloud-only accounts (`*.onmicrosoft.com`) that are not federated with on-premises AD, permanently assigned the Global Administrator role (not PIM eligible), excluded from all Conditional Access policies, protected with FIDO2 security keys or very long separated passwords stored securely offline, and monitored with high-severity log alerts on any sign-in.

Compare Assigned, Dynamic User, and Dynamic Device group membership types in Microsoft Entra ID.

Assigned: Administrators manually add and remove specific users or devices. Dynamic User: Membership is automatically calculated using attribute-based rules (e.g., `user.department -eq 'Sales'`). Dynamic Device: Membership is evaluated from device attributes (cannot mix users and devices in a dynamic group). Dynamic groups require Entra ID P1 or Intune licensing.

Compare the three hybrid authentication methods in Microsoft Entra ID: Password Hash Synchronization (PHS), Pass-Through Authentication (PTA), and Federation (AD FS).

PHS: Syncs a salted SHA-256 hash of the on-premises AD password hash to Entra ID (simplest, supports leaked credential detection, works even if on-prem is down). PTA: Lightweight on-prem agents validate passwords directly against on-prem AD without storing hashes in the cloud. AD FS: Redirects users to an on-premises STS for SAML/WS-Fed token issuance (used for complex on-prem smartcards/3rd-party MFA).

What happens to the resources inside an Azure Resource Group when the Resource Group is deleted, and can a Resource live in multiple Resource Groups?

Every Azure resource must belong to one and only one Resource Group. Deleting a Resource Group deletes all resources contained within it simultaneously. However, resources inside one Resource Group can resides in different Azure Regions from the Resource Group's metadata region, and can interact with resources in other Resource Groups.

How does Azure RBAC evaluate permissions when a user is subject to both role assignments and Azure Blueprint/Managed Application Deny Assignments?

Azure RBAC is an additive model (effective permissions are the union of all assigned roles), with one exception: Deny Assignments. Deny Assignments take precedence over all RBAC role assignments (even Owner) and explicitly block specified actions at that scope.

What are the four fundamental built-in Azure RBAC roles and how do their permissions differ?

Owner: Full access to all resources, including the right to delegate access (assign RBAC roles) to others. Contributor: Can create and manage all types of Azure resources, but cannot grant access to others. Reader: View-only access to existing resources. User Access Administrator: Can manage user access (role assignments) to Azure resources without modifying the resources themselves.

What is an Azure Policy Initiative (Policy Set) and how is remediation handled for existing non-compliant resources?

An Initiative is a collection of multiple related Azure Policy definitions grouped together toward a single compliance goal (e.g., CIS Benchmark or HIPAA) and assigned as one unit. Existing resources that violate `Modify` or `DeployIfNotExists` policies are not automatically altered until a Remediation Task is triggered using the policy's Managed Identity.

What are the Requirements and Prerequisites for enabling Self-Service Password Reset (SSPR) for hybrid users in Microsoft Entra ID?

Requires Microsoft Entra Connect (or Cloud Sync) with Password Writeback enabled so password changes in the cloud are written back immediately to on-premises Active Directory, plus appropriate licensing (Entra ID P1/P2 for hybrid writeback) and configured authentication methods (e.g., 1 or 2 gates such as Authenticator app, SMS, email).

What are the two types of Azure Resource Locks and how do they affect resource operations?

`CanNotDelete`: Authorized users can still read and modify a resource, but cannot delete it without first removing the lock. `ReadOnly`: Authorized users can only read the resource; they cannot delete it or make any state-changing updates.

What is Microsoft Entra Privileged Identity Management (PIM) and what is the difference between 'Eligible' and 'Active' role assignments?

PIM provides Just-In-Time (JIT) privileged access to Entra ID and Azure resources. An 'Eligible' assignment means the user must perform an activation workflow (e.g., MFA, business justification, approval, time-bound duration) before using the role. An 'Active' assignment means the user possesses the permissions continuously without activation.

What is the Root Management Group in Azure and how are new Subscriptions placed into the Management Group hierarchy?

Every Microsoft Entra ID directory is given a single top-level 'Root Management Group' into which all other management groups and subscriptions fold. By default, all newly created subscriptions are placed directly under the Root Management Group unless a different default Management Group is configured by a hierarchy administrator.

What is the difference between an Application Registration (Application Object) and a Service Principal (Enterprise Application) in Microsoft Entra ID?

An Application Object is the globally unique definition (template) of the app residing in its home tenant. A Service Principal is the local instantiation of that app in a specific tenant, holding the actual permissions, role assignments, and sign-in policies within that directory.

What is the four-level scope hierarchy in Azure for resource organization and governance, from broadest to narrowest?

Management Groups (up to 6 levels deep, excluding the Root Management Group) -> Subscriptions -> Resource Groups -> Resources. RBAC role assignments, Azure Policies, and Locks applied at a higher scope are automatically inherited by all child scopes beneath them.

What is the difference between `Actions`/`NotActions` and `DataActions`/`NotDataActions` in an Azure custom RBAC role definition?

`Actions` and `NotActions` govern Control Plane operations sent to the Azure Resource Manager (ARM) endpoint (e.g., creating or deleting a storage account). `DataActions` and `NotDataActions` govern Data Plane operations inside the resource itself (e.g., reading blobs inside a container or querying a Key Vault secret).

What is the purpose of the 'What If' tool in Microsoft Entra Conditional Access, and what is 'Report-only' mode?

The 'What If' tool simulates a sign-in scenario for a specific user, app, IP, and device platform to determine which Conditional Access policies would apply or not apply. 'Report-only' mode evaluates a policy during real sign-ins and logs the result to Sign-in logs without actually blocking or prompting the user.

What are the three components required to create an Azure RBAC role assignment?

1. Security Principal (Who: User, Group, Service Principal, or Managed Identity); 2. Role Definition (What: collection of allowed and denied `Actions`, `NotActions`, `DataActions`, and `NotDataActions`); 3. Scope (Where: Management Group, Subscription, Resource Group, or individual Resource).

How does Microsoft Entra B2B (Business-to-Business) collaboration differ from Entra B2C (Business-to-Consumer)?

Entra B2B invites external partner/guest users into your corporate workforce tenant using their existing external credentials (via redemption link) to access internal company resources. Entra B2C is a separate, customer-facing identity directory allowing millions of consumers to sign up/sign in to your public applications using social or local accounts.

Azure Core Identity (Entra ID, RBAC, Conditional Access & Governance)

Foundational Microsoft Azure governance and identity mastery for AZ-900 and AZ-104 covering Microsoft Entra ID tenants, RBAC role definitions and scope hierarchy, Conditional Access, Privileged Identity Management (PIM), Azure Policy, Resource Locks, Blueprints, Tags, and the Shared Responsibility Model.

Level: basic
Languages: en → en
Cards: 32
Markdown: Azure Core Identity (Entra ID, RBAC, Conditional Access & Governance) (.md)

Flashcards (32)

#	Front (Term / Question)	Back (Definition / Answer)
1	What are the most common Azure Policy effects and what does each do?	`Deny`: Blocks the resource creation/update request in ARM. `Audit`: Allows the request but logs a warning event in the Activity Log and marks the resource non-compliant. `Append`: Adds extra fields to the request before execution. `Modify`: Adds, updates, or removes tags/properties (uses a Managed Identity). `DeployIfNotExists` (DINE): Deploys a remediation ARM template if a companion resource (like diagnostic settings) is missing.
2	Describe two common operational gotchas when applying a `ReadOnly` lock to an Azure Resource Group or Storage Account.	1. Virtual Machines cannot be started, stopped, or restarted because `start`/`deallocate` is a `POST` control-plane action blocked by `ReadOnly`. 2. Calling `ListKeys` on a Storage Account is a `POST` operation on the ARM control plane (because keys have write permissions), so a `ReadOnly` lock blocks applications or users from listing storage account keys.
3	What can a Global Administrator in Microsoft Entra ID do if they have lost access to all Azure Subscriptions in the tenant?	Enable the 'Access management for Azure resources' toggle in Microsoft Entra ID properties. This temporarily grants the user the `User Access Administrator` RBAC role at the Root Scope (`/`), allowing them to view all subscriptions and assign themselves or others the `Owner` role.
4	How does responsibility for Operating System patching and Network Controls differ between IaaS, PaaS, and SaaS in Azure?	IaaS (e.g., Azure VMs): Customer manages OS patching, middleware, and network configs. PaaS (e.g., App Service, Azure SQL): Cloud provider patches the OS; responsibility for network controls and application configuration is shared. SaaS (e.g., Microsoft 365): Cloud provider manages the OS, network, and application software.
5	How does Azure Policy differ from Azure RBAC?	Azure RBAC focuses on user actions (WHO can perform actions at a scope). Azure Policy focuses on resource properties and compliance state (WHAT kinds of resources and configurations are allowed, regardless of who has RBAC permission—even a Subscription Owner is blocked by a `Deny` policy).
6	How do Microsoft Entra ID Roles differ from Azure RBAC Roles?	Microsoft Entra ID Roles (e.g., Global Administrator, User Administrator, Application Administrator) control access to directory resources such as users, groups, enterprise applications, and domains via Microsoft Graph. Azure RBAC Roles (e.g., Owner, Contributor) control access to Azure infrastructure and PaaS resources via Azure Resource Manager (ARM).
7	What are Azure Blueprints (and Template Specs / Deployment Stacks) and what four artifact types can a Blueprint package?	Azure Blueprints allow cloud architects to define a repeatable set of governance tools and standard Azure resources for new subscriptions. The four artifact types are: 1. Resource Groups; 2. ARM Templates; 3. Azure Policy Assignments; 4. Azure RBAC Role Assignments.
8	Compare System-Assigned and User-Assigned Managed Identities in Azure.	System-Assigned: Enabled directly on an Azure resource; its lifecycle is tied 1:1 to that resource (automatically deleted when the resource is deleted) and cannot be shared. User-Assigned: Created as a standalone Azure resource; its lifecycle is independent and the same identity can be assigned to multiple Azure resources.
9	Under the Cloud Shared Responsibility Model, which security responsibilities ALWAYS remain with the customer across IaaS, PaaS, and SaaS?	Information and data security, endpoint device protection (mobile/PCs), and account/identity and access management. The cloud provider is always responsible for physical datacenter security, physical hosts, and physical networks.
10	What is the relationship between an Azure Subscription and a Microsoft Entra ID (formerly Azure AD) tenant?	A many-to-one trust relationship: multiple Azure Subscriptions can trust the same single Microsoft Entra ID tenant for authentication and identity management, whereas each Azure Subscription can trust only one Entra ID directory at any given time.
11	What are the three core components of a Microsoft Entra Conditional Access policy?	1. Signals / Assignments (Who: users/groups; What: target cloud apps; Where/How: IP locations, device platforms, sign-in/user risk levels); 2. Decision (Grant access or Block access); 3. Enforcement Controls (Require MFA, require compliant/Intune-enrolled device, require Entra hybrid joined device, or Session controls).
12	Are Azure Tags inherited automatically from a Subscription or Resource Group to child Resources?	No. By default, tags applied to a Subscription or Resource Group are NOT automatically inherited by the individual resources inside them. To enforce tag inheritance, you must assign built-in Azure Policies such as 'Inherit a tag from the resource group if missing' (which uses the `Modify` effect).
13	What is Microsoft Defender for Cloud's Secure Score and Regulatory Compliance dashboard?	Secure Score is a percentage-based KPI in Microsoft Defender for Cloud that continuously assesses the security posture of your Azure (and hybrid/multi-cloud) resources against the Microsoft Cloud Security Benchmark (MCSB) and provides prioritized security recommendations. The Regulatory Compliance dashboard maps resource posture against standards like ISO 27001, PCI-DSS, SOC 2, and NIST.
14	What licensing tier is required in Microsoft Entra ID to use Conditional Access vs. Risk-Based Conditional Access (Entra ID Protection)?	Standard Conditional Access policies (based on user, app, location, device) require Microsoft Entra ID P1. Risk-based Conditional Access policies (evaluating real-time Sign-in Risk and User Risk via Entra ID Protection, plus Privileged Identity Management) require Microsoft Entra ID P2.
15	What parameters must match when moving resources between Azure Subscriptions?	Both the source and destination Subscriptions must exist within the same Microsoft Entra ID tenant, both must be active, the user performing the move must have write permissions (`Microsoft.Resources/subscriptions/resourceGroups/moveResources/action`) on both source and target Resource Groups, and dependent resources (e.g., NICs with VNet or VMs with Key Vaults) must be validated or moved together.
16	What are best practices for configuring Emergency Access ('Break-Glass') accounts in Microsoft Entra ID?	Create at least two cloud-only accounts (`*.onmicrosoft.com`) that are not federated with on-premises AD, permanently assigned the Global Administrator role (not PIM eligible), excluded from all Conditional Access policies, protected with FIDO2 security keys or very long separated passwords stored securely offline, and monitored with high-severity log alerts on any sign-in.
17	Compare Assigned, Dynamic User, and Dynamic Device group membership types in Microsoft Entra ID.	Assigned: Administrators manually add and remove specific users or devices. Dynamic User: Membership is automatically calculated using attribute-based rules (e.g., `user.department -eq 'Sales'`). Dynamic Device: Membership is evaluated from device attributes (cannot mix users and devices in a dynamic group). Dynamic groups require Entra ID P1 or Intune licensing.
18	Compare the three hybrid authentication methods in Microsoft Entra ID: Password Hash Synchronization (PHS), Pass-Through Authentication (PTA), and Federation (AD FS).	PHS: Syncs a salted SHA-256 hash of the on-premises AD password hash to Entra ID (simplest, supports leaked credential detection, works even if on-prem is down). PTA: Lightweight on-prem agents validate passwords directly against on-prem AD without storing hashes in the cloud. AD FS: Redirects users to an on-premises STS for SAML/WS-Fed token issuance (used for complex on-prem smartcards/3rd-party MFA).
19	What happens to the resources inside an Azure Resource Group when the Resource Group is deleted, and can a Resource live in multiple Resource Groups?	Every Azure resource must belong to one and only one Resource Group. Deleting a Resource Group deletes all resources contained within it simultaneously. However, resources inside one Resource Group can resides in different Azure Regions from the Resource Group's metadata region, and can interact with resources in other Resource Groups.
20	How does Azure RBAC evaluate permissions when a user is subject to both role assignments and Azure Blueprint/Managed Application Deny Assignments?	Azure RBAC is an additive model (effective permissions are the union of all assigned roles), with one exception: Deny Assignments. Deny Assignments take precedence over all RBAC role assignments (even Owner) and explicitly block specified actions at that scope.
21	What are the four fundamental built-in Azure RBAC roles and how do their permissions differ?	Owner: Full access to all resources, including the right to delegate access (assign RBAC roles) to others. Contributor: Can create and manage all types of Azure resources, but cannot grant access to others. Reader: View-only access to existing resources. User Access Administrator: Can manage user access (role assignments) to Azure resources without modifying the resources themselves.
22	What is an Azure Policy Initiative (Policy Set) and how is remediation handled for existing non-compliant resources?	An Initiative is a collection of multiple related Azure Policy definitions grouped together toward a single compliance goal (e.g., CIS Benchmark or HIPAA) and assigned as one unit. Existing resources that violate `Modify` or `DeployIfNotExists` policies are not automatically altered until a Remediation Task is triggered using the policy's Managed Identity.
23	What are the Requirements and Prerequisites for enabling Self-Service Password Reset (SSPR) for hybrid users in Microsoft Entra ID?	Requires Microsoft Entra Connect (or Cloud Sync) with Password Writeback enabled so password changes in the cloud are written back immediately to on-premises Active Directory, plus appropriate licensing (Entra ID P1/P2 for hybrid writeback) and configured authentication methods (e.g., 1 or 2 gates such as Authenticator app, SMS, email).
24	What are the two types of Azure Resource Locks and how do they affect resource operations?	`CanNotDelete`: Authorized users can still read and modify a resource, but cannot delete it without first removing the lock. `ReadOnly`: Authorized users can only read the resource; they cannot delete it or make any state-changing updates.
25	What is Microsoft Entra Privileged Identity Management (PIM) and what is the difference between 'Eligible' and 'Active' role assignments?	PIM provides Just-In-Time (JIT) privileged access to Entra ID and Azure resources. An 'Eligible' assignment means the user must perform an activation workflow (e.g., MFA, business justification, approval, time-bound duration) before using the role. An 'Active' assignment means the user possesses the permissions continuously without activation.
26	What is the Root Management Group in Azure and how are new Subscriptions placed into the Management Group hierarchy?	Every Microsoft Entra ID directory is given a single top-level 'Root Management Group' into which all other management groups and subscriptions fold. By default, all newly created subscriptions are placed directly under the Root Management Group unless a different default Management Group is configured by a hierarchy administrator.
27	What is the difference between an Application Registration (Application Object) and a Service Principal (Enterprise Application) in Microsoft Entra ID?	An Application Object is the globally unique definition (template) of the app residing in its home tenant. A Service Principal is the local instantiation of that app in a specific tenant, holding the actual permissions, role assignments, and sign-in policies within that directory.
28	What is the four-level scope hierarchy in Azure for resource organization and governance, from broadest to narrowest?	Management Groups (up to 6 levels deep, excluding the Root Management Group) -> Subscriptions -> Resource Groups -> Resources. RBAC role assignments, Azure Policies, and Locks applied at a higher scope are automatically inherited by all child scopes beneath them.
29	What is the difference between `Actions`/`NotActions` and `DataActions`/`NotDataActions` in an Azure custom RBAC role definition?	`Actions` and `NotActions` govern Control Plane operations sent to the Azure Resource Manager (ARM) endpoint (e.g., creating or deleting a storage account). `DataActions` and `NotDataActions` govern Data Plane operations inside the resource itself (e.g., reading blobs inside a container or querying a Key Vault secret).
30	What is the purpose of the 'What If' tool in Microsoft Entra Conditional Access, and what is 'Report-only' mode?	The 'What If' tool simulates a sign-in scenario for a specific user, app, IP, and device platform to determine which Conditional Access policies would apply or not apply. 'Report-only' mode evaluates a policy during real sign-ins and logs the result to Sign-in logs without actually blocking or prompting the user.
31	What are the three components required to create an Azure RBAC role assignment?	1. Security Principal (Who: User, Group, Service Principal, or Managed Identity); 2. Role Definition (What: collection of allowed and denied `Actions`, `NotActions`, `DataActions`, and `NotDataActions`); 3. Scope (Where: Management Group, Subscription, Resource Group, or individual Resource).
32	How does Microsoft Entra B2B (Business-to-Business) collaboration differ from Entra B2C (Business-to-Consumer)?	Entra B2B invites external partner/guest users into your corporate workforce tenant using their existing external credentials (via redemption link) to access internal company resources. Entra B2C is a separate, customer-facing identity directory allowing millions of consumers to sign up/sign in to your public applications using social or local accounts.