AZ-500 Microsoft Azure Security Technologies Exam

Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!

Expert

Gauge your current knowledge

Track Readiness

Set Exam Goal

Expert

Gauge your current knowledge

Track Readiness

Set Exam Goal

Manage managed identities

Manage Microsoft Entra application access

Configure and Verify Managed Identities

Types of Managed Identities

When securing Azure resources, you can use managed identities to eliminate the need for credentials in your code. Azure provides two types of managed identities: system-assigned and user-assigned. A system-assigned managed identity is tied directly to a single Azure resource, such as a virtual machine. This identity shares its lifecycle with the resource, meaning Microsoft Entra ID automatically deletes the identity when you delete the resource. Conversely, a user-assigned managed identity is created as its own standalone Azure resource. You can associate a user-assigned identity with multiple resources, and it remains active even if those resources are deleted, requiring you to delete it manually when it is no longer needed.

Authentication and Authorization Flow

Managed identities simplify how applications authenticate by removing the risk of hard-coded credentials. When an application runs on an Azure resource, it requests an access token from the local Microsoft Entra ID token endpoint. The token endpoint returns a token that the resource uses to authenticate against other Azure services, such as Azure Storage or Azure Cosmos DB. This token-based exchange happens over secure internal channels, maintaining a strict trust boundary between the public internet and your private services. Authorization is then evaluated across two levels: the control plane, which uses Azure Role-Based Access Control (RBAC) via Azure Resource Manager, and the data plane, which uses service-specific authorization rules.

...

A sequence diagram showing an Azure resource requesting an access token from the local Microsoft Entra ID endpoint, then using that token to authenticate against a downstream Azure service like Storage or Cosmos DB.

Azure Role-Based Access Control

Securing managed identities requires applying the principle of least privilege through Azure RBAC. You assign specific roles to the identity's service principal so it only has the exact permissions needed to perform its tasks. These roles can be assigned at different scopes, including the individual resource level, the resource group level, or across an entire subscription. By restricting the scope and permissions of each identity, you minimize the potential damage if a resource is compromised.

Implementing and Auditing Managed Identities

Once enabled, you can find and manage these identities as service principal objects within the Enterprise applications portal of Microsoft Entra ID or by using the Microsoft Graph API. To verify that these identities adhere to security guidelines, you should audit their permissions and ensure they are not members of highly privileged groups. For ongoing security operations, administrators use Azure Activity logs and Sign-in logs to track token requests and audit which resources accessed specific data. This logging provides visibility into the exact operations performed by the identity and helps identify anomalous access patterns.

...

Manage and use service principals Plan and implement Network Security Groupsand ApplicationSecurity Groups

AZ-500 Microsoft Azure Security Technologies Exam

Manage managed identities

Configure and Verify Managed Identities

Types of Managed Identities

Authentication and Authorization Flow

Managed Identity Authentication Flow

Azure Role-Based Access Control

Implementing and Auditing Managed Identities

Configure and Verify Managed Identities

Types of Managed Identities

Authentication and Authorization Flow

Azure Role-Based Access Control

Implementing and Auditing Managed Identities