Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
To protect cloud resources, Microsoft Entra ID acts as the central identity provider to verify who or what is requesting access. It uses Conditional Access as an intelligent policy engine to evaluate real-time signals before granting entry. These signals include the identity of the user, their physical location, the compliance state of their device, and the specific application they want to access. Administrators use these policies to create strict rule-based gates that must be passed before any resource can be reached.
Security is further enhanced by Microsoft Entra Identity Protection, which calculates real-time risk signals during the sign-in process. It assesses user risk, which is the likelihood that a user's credentials have been compromised, and sign-in risk, which evaluates the probability that the sign-in attempt itself is malicious. Based on these calculated risks, Conditional Access can automatically block access or force the user to complete Multi-Factor Authentication (MFA) before proceeding.
To prevent users from holding permanent admin rights, Privileged Identity Management (PIM) controls access to highly sensitive roles. Users are assigned as eligible for a role rather than being assigned permanently. When they need to perform an administrative task, they must request activation of this role, which triggers a workflow requiring justification, MFA verification, or manual approval. Once approved, the identity shifts to an active state for a limited period before automatically reverting to eligible status.
Identity governance relies on Access reviews to ensure that permissions do not accumulate indefinitely. These reviews run on a recurring schedule, prompting resource owners or users themselves to confirm if access is still required. If an auditor or owner denies the renewal during a review, Microsoft Entra ID automatically revokes the target permission. This automated lifecycle ensures that organizations maintain a least-privilege posture over time.
Authorization within Azure is managed primarily through Azure Role-Based Access Control (RBAC). RBAC assigns predefined or custom roles to security principals, which can be users, groups, or application identities. These assignments are bound to a specific scope, such as a subscription, resource group, or individual resource, and inherit downward. For even more granular control, Attribute-Based Access Control (ABAC) uses security attributes to refine permissions, such as allowing access to storage resources only if specific metadata tags match.
Integrating applications into Microsoft Entra ID requires creating an app registration, which generates a global application object owned by the developer. To allow that application to run within a specific tenant, the system instantiates a service principal, which serves as the local identity representation. This identity is configured with specific permissions and credentials, such as certificates or client secrets, to prove its identity during authentication. Applications can use delegated permissions to act on behalf of a signed-in user, or application permissions to run as background services.
To secure application credentials, organizations use managed identities to eliminate the need for hardcoded secrets or certificates in application code. A system-assigned managed identity is tied directly to the lifecycle of a single Azure resource, such as a virtual machine, and is deleted automatically if that resource is removed. Alternatively, a user-assigned managed identity is created as an independent Azure resource, meaning it can be shared across multiple virtual machines or services and must be deleted manually.
During operation, a resource with a managed identity requests a token from its local non-routable metadata endpoint. The metadata service handles the security handshake with Microsoft Entra ID to fetch an access token without exposing any credentials to the developer's code. The application then presents this token to securely access downstream services like Azure Key Vault or Azure SQL databases. This design ensures that credentials are never exposed in source control or system logs.
To connect on-premises applications to the cloud without opening incoming ports in a corporate firewall, organizations deploy Microsoft Entra Application Proxy. This architecture relies on a lightweight private network connector installed on a server inside the private corporate network. The connector establishes an outbound-only connection to the Application Proxy service in the Azure cloud. Because the network boundary only allows outbound traffic, the internal network remains protected from external scanning and direct inbound attacks.
When an external user attempts to access an on-premises web application, their request is routed to the public Application Proxy endpoint in Azure. The cloud service authenticates the user, applies any relevant Conditional Access and MFA policies, and verifies their identity. Once authorized, the cloud service passes the traffic through the pre-established outbound tunnel to the on-premises connector. The connector then translates the request and forwards it to the internal web application, returning the response back through the same secure path.
Prepare and test your skills
Prepare and test your skills
A system-assigned managed identity is tied directly to the lifecycle of a single Azure resource and is automatically deleted when that resource is removed, whereas a user-assigned managed identity is an independent resource that can be shared across multiple services and must be deleted manually. Both options eliminate the need for hardcoded credentials by allowing resources to obtain access tokens from a local non-routable metadata endpoint.
User risk assesses the likelihood that a user's credentials have been compromised, while sign-in risk evaluates the probability that an individual sign-in attempt is malicious. Conditional Access policies can use both calculated risk levels to automatically block access or prompt the user for Multi-Factor Authentication (MFA).
Microsoft Entra Application Proxy avoids opening inbound firewall ports by using an on-premises private network connector that establishes an outbound-only connection to Azure. When external users authenticate and pass Conditional Access checks at the cloud endpoint, the service routes traffic through the existing outbound tunnel to the connector, which forwards the request to the internal application.
StudyCerts
StudyCerts