Azure Identity & Permissions in a Nutshell

🛡️ Why Identity Is the New Perimeter

Identity is the primary control surface for securing Azure. The traditional network perimeter no longer works. Users, devices, and applications connect from everywhere.

Microsoft’s Zero Trust model replaces implicit trust with explicit verification. Every access request is evaluated against identity, device state, location, and risk, regardless of where it originates. Six pillars underpin Zero Trust: Identities, Devices, Applications, Data, Infrastructure, and Network.

Microsoft Conditional Access sits at the centre, enforcing Zero Trust policies on every access attempt.

📄 Zero Trust overview

🧩 Microsoft Entra ID

Microsoft Entra ID is the cloud identity and access management service that underpins all of Azure. Formerly called Azure Active Directory (Azure AD), it handles authentication, authorisation, and SSO (Single Sign-On) for Microsoft 365, Azure, and thousands of third-party SaaS applications.

Entra ID is not a cloud version of on-premises Active Directory. Traditional AD uses Kerberos, NTLM, and LDAP over a domain structure. Entra ID uses OAuth 2.0, SAML, and OpenID Connect over a tenant-based model. The two can co-exist in a hybrid configuration through Microsoft Entra Cloud Sync, the successor to Entra Connect Sync, transitioning from April 2026.

Entra ID Plans

Entra ID vs On-Premises Active Directory

When legacy protocols are needed in Azure, for example Kerberos for lift-and-shift workloads, Microsoft Entra Domain Services provides a managed domain controller with no VMs to patch.

📄 Microsoft Entra ID overview

📄 Microsoft Entra Domain Services overview

🔑 Authentication: MFA, SSO & Passkeys

Authentication is how Entra ID verifies identity. MFA (Multi-Factor Authentication) requires something you know plus something you have or are. Entra ID supports several methods, from hardware tokens to mobile apps.

MFA Methods Available in Entra ID (2026)

SSO (Single Sign-On) lets a user authenticate once and access all connected applications. Entra ID issues a security token that other apps accept without re-prompting. Supported methods include OpenID Connect + OAuth (modern apps), SAML (enterprise federation), and Password-based (legacy apps).

📄 MFA how it works

📄 Passkeys in Entra ID

🔒 Conditional Access

Conditional Access is the decision engine that sits between a user and the resource they want. It analyses signals: who is logging in, from where, on which device, and at what risk level. It then decides what to do.

The logic is: IF (signals) → THEN (decision) → ENFORCE (controls).

📄 Conditional Access overview

🎭 Azure RBAC

Azure RBAC (Role-Based Access Control) is the authorisation system for Azure resources. It answers three questions: who can do what on which resources. Every access grant is a role assignment. It combines three elements:

The Five Fundamental Roles

Beyond these five, Azure has over 100 built-in job function roles (e.g. Virtual Machine Contributor, Storage Blob Data Reader). You can also create Custom Roles with specific permission sets for your organisation.

Scope and Inheritance

Permissions inherit downward through the hierarchy. A role assigned at subscription level automatically applies to all resource groups and resources within it. Always assign at the narrowest scope needed.

Management Group
  └─ Subscription
       └─ Resource Group
            └─ Resource            ← assign here for narrowest scope

📄 Azure RBAC overview

📄 Azure built-in roles

🔀 Azure RBAC Roles vs Entra ID Roles

Azure has two separate role systems. They look similar but control entirely different things. Mixing them up is one of the most common permission mistakes in Azure.

The two systems do not overlap. A user with Contributor on a subscription can create and manage Azure resources but cannot read or change any Entra ID directory objects. A user with User Administrator in Entra ID can create and manage users but cannot touch any Azure resources unless also assigned an Azure RBAC role.

The single most important rule: Global Administrator in Entra ID does not give access to Azure resources. It only controls directory-level operations.

📄 Azure RBAC vs Entra ID roles

⏱️ Privileged Identity Management (PIM)

PIM (Privileged Identity Management) adds just-in-time (JIT) access to Azure RBAC and Entra roles. Instead of permanently holding a privileged role, users are eligible. They activate it for a limited time window when needed. This shrinks the attack surface: a compromised account with no permanent privileges can do far less damage.

📄 Privileged Identity Management overview

🤖 Managed Identities & Service Principals

Applications and services need credentials to call Azure APIs. Storing those credentials in code or configuration files is a security risk. Azure offers two identity types that eliminate static secrets.

Managed Identities

A Managed Identity is an Entra ID identity created and managed automatically by Azure for a resource, for example a VM, Function App, or AKS pod. There are no passwords, certificates, or secrets to rotate. The identity accesses other services through RBAC role assignments, using the same mechanism as a human user.

Service Principals

A Service Principal is an Entra ID application identity used by automation, CI/CD pipelines, and third-party tools that run outside Azure. Unlike Managed Identities, Service Principals require credential management (client secrets or certificates). Use Managed Identities wherever possible; use Service Principals only when the workload runs outside Azure.

📄 Managed identities overview

🪪 App Registration vs Enterprise Application

These two blades in the Azure portal confuse almost everyone. They are two sides of the same coin, not two separate things.

When you register an application in Entra ID, two objects are created automatically:

An App Registration is the blueprint. The Enterprise Application is the running instance. One creates the other automatically. The portal presents them as two separate blades, which makes them look unrelated.

The practical split: go to App Registrations to define the app, configure permissions, and add client secrets. Go to Enterprise Applications to manage who can access the app, configure SSO, and set up provisioning.

When a user or admin consents to a third-party SaaS app (e.g. Slack, Zoom, Salesforce), Entra ID creates an Enterprise Application in your tenant automatically. You never see an App Registration for it. That lives in the vendor’s tenant.

📄 App and Enterprise Application management

🔐 Azure Key Vault

Azure Key Vault is the central store for secrets, encryption keys, and TLS/SSL certificates. Applications retrieve credentials at runtime. Nothing is stored in code or configuration files.

Key Vault Tiers (2026)

📄 Azure Key Vault overview

📋 Azure Policy & Governance Hierarchy

Azure Policy enforces organisational standards across all resources at scale. A policy definition is a JSON rule, for example: “VMs must use managed disks” or “Storage accounts must require HTTPS”. Policy evaluates both new and existing resources continuously.

Policy Effects

An Initiative groups multiple policy definitions for a compliance standard, for example PCI-DSS, ISO 27001, or CIS Azure Benchmark. Assign an initiative once to cover all constituent policies.

The Governance Hierarchy

Policies, RBAC assignments, and Resource Locks all operate within the same management hierarchy. What you assign at a higher level is inherited by everything below it.

Root Management Group  ← one per Entra tenant; cannot be deleted
  └─ Management Groups  ← up to 6 levels (not counting root or subscriptions); max 10,000 per directory
       └─ Subscriptions
            └─ Resource Groups
                 └─ Resources

Resource Locks protect critical resources from accidental change or deletion. A CanNotDelete lock prevents deletion but allows reads and edits. A ReadOnly lock prevents all changes. Even a subscription Owner must remove the lock first.

📄 Azure Policy overview

📄 Management Groups overview

🔍 Microsoft Defender for Cloud

Microsoft Defender for Cloud is the unified security posture management and workload protection platform for Azure, on-premises, and multi-cloud environments. Its category is CNAPP (Cloud-Native Application Protection Platform).

The Four Core Capabilities

• Secure Score: a 0–100 rating of your subscription’s security posture. Each implemented recommendation increases the score.
• Security Alerts: threat detections with severity (High / Medium / Low) and step-by-step remediation guidance.
• Recommendations: proactive, actionable improvements with impact on Secure Score.
• Regulatory Compliance: continuous assessment against PCI DSS, ISO 27001, SOC 2, NIST, and others.

Defender Plans by Workload

📄 Defender for Cloud overview

🏗️ Post-Build 2026 Status Map

Microsoft Build 2026 (June 2–3, San Francisco) brought significant changes to identity and security. The table below captures the current status of every service covered in this article.

📌 Quick Reference