Identity: Microsoft Entra ID

Identity and Access: Microsoft Entra ID

Microsoft Entra ID is the current name for the cloud identity service formerly called Azure Active Directory. It authenticates users, groups, applications, service principals, devices, and managed identities. Azure role-based access control then authorizes management actions at a scope.

Core ideas

• A role assignment combines a principal, role definition, and scope such as management group, subscription, resource group, or resource.
• Built-in roles reduce custom-policy maintenance; custom roles should be narrow and justified.
• Managed identities remove credential lifecycle from supported Azure workload authentication.
• Conditional Access evaluates user, device, location, risk, and application signals during authentication.

Design and operating model

Federate workforce identities, require MFA, separate administrative accounts, and use Privileged Identity Management for time-bound elevation. Assign groups rather than individuals where possible. Give workloads managed identities and grant only required data-plane or control-plane roles at the narrowest scope.

Example

PRINCIPAL_ID=$(az webapp identity show \
  --resource-group learning-rg \
  --name replace-with-app \
  --query principalId -o tsv)

az role assignment create \
  --assignee-object-id "$PRINCIPAL_ID" \
  --assignee-principal-type ServicePrincipal \
  --role 'Storage Blob Data Reader' \
  --scope /subscriptions/REPLACE/resourceGroups/learning-rg

Run examples in a disposable training subscription. Replace names, Regions, identifiers, scopes, sizes, and policies with reviewed values, and confirm current Azure CLI and service requirements before production use.

Production guidance

• Avoid subscription-wide Owner or Contributor when a data or resource-specific role is sufficient.
• Review guest users, stale service principals, legacy secrets, role inheritance, and privileged groups.
• Use workload identity federation for CI/CD rather than creating long-lived service-principal secrets.

The chapter quiz follows the lesson and checks both service vocabulary and architecture decisions.