Chapter 8: Azure Identity Services

In Chapter 7, Azure Security, you learned skills that covered the security aspects of Azure, including security concepts, the security services themselves that you can enable, and security posture management and security operations tooling.

This chapter will outline the identity services in Azure, including Azure Active Directory (Azure AD), Active Directory (AD), hybrid identity authentication, authorization, Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Conditional Access.

This chapter aims to provide coverage of the AZ-900 Azure Fundamentals Skills Measured section: describe identity, governance, privacy, and compliance features.

By the end of this chapter, you will have learned how to do the following:

• Define Azure AD.
• Describe the functionality and usage of Azure AD.
• Explain the difference between authentication and authorization.
• Describe the functionality and usage of Conditional Access, MFA, and...

Technical requirements

To carry out the hands-on labs in this chapter, you will require the following:

• An Azure subscription that has access to create and delete resources in the subscription. If you do not have an Azure subscription, you can create a free Azure account from this URL: https://azure.microsoft.com/free.
• Access to an internet browser. You will need to log in to the Azure portal: https://portal.azure.com.
• You can alternatively use the Azure desktop app: https://portal.azure.com/App/Download.

Azure AD

Azure AD can be thought of primarily as a cloud-based centralized Identity Provider (IDP) and directory service for objects.

Azure AD is the foundation of granting access to resources through Identity and Access Management (IAM) for cloud and hybrid environments and providing authentication and authorization for users, apps, and devices.

Objects are stored in Azure AD with attributes; for user identities, the core attributes would be their sign-in name, known as their User Principal Name (UPN), password, location, assigned roles, group membership, devices, licenses, and authentication methods. The following diagram aims to visualize Azure AD as the centralized cloud IDP:

Figure 8.1 – Active AD

In addition to an organization's user management, Azure AD provides the following:

• Device management
• Application management
• Business to Business (B2B) and Business to Customer (B2C) identity services
• SSO
• MFA and Conditional...

Authentication and authorization

Accessing resources is based on a two-stage concept that consists of firstly authenticating and then authorizing; in a nutshell, identifying who you are and determining what you can do.

Authentication, also referred to as AuthN, is the process of establishing the identity of a person (or service) and proving they are who they say they are. This can be done by validating provided access credentials information against stored or known identifying information.

Authorization, also referred to as AuthZ, is the process of establishing what level of access the authenticated person (or service) has to the resource; that is, what they can access and what actions they may perform:

Figure 8.3 – Authentication and authorization

In this section, we looked at the concepts of authentication and authorization. The following section looks at SSO.

Single sign-on

SSO means only needing one set of credentials that you enter once to access all resources enabled to use SSO in your organization; you are not prompted to sign in again.

In addition, user provisioning to apps is accelerated with just-in-time access for new hires and temporary staff and allows a governed leavers process when users no longer need access to an app.

You configure Azure AD as the trusted IDP for each app you wish to enable SSO through a centralized portal. These apps can be cloud apps, public cloud provider platforms, as well as on-premises apps. You can enforce secure access with identity protection through MFA and Conditional Access, as well as risk-based access policies.

In this section, we looked at SSO. The following section looks at MFA and Conditional Access.

MFA and Conditional Access

MFA (which includes Two-Factor Authentication (2FA) provides an additional layer of security for identifying a user by requiring the user to submit two or more elements for authentication. MFA is based on the following principles:

• Knowledge: Something that only the user knows, such as a password or pin.
• Possession: Something that only the user has, such as a code sent to a phone, a token, or a key.
• Inherent: Something that only the user is, such as biometrics.

Conditional Access works alongside MFA to provide more granular levels of access control; information is collected from the sign-in process (signals), and then decisions are made upon that information to determine whether access to the requested resource will be granted or denied and whether the user will require additional factors of authentication or require taking other action, such as resetting their password. This is visualized in the following diagram:

...

Hands-on exercises

To support your learning with some practical skills, we will look at hands-on examples of some of the topics covered in this chapter.

The following exercises will be carried out:

• Exercise 1 – creating a new tenant instance of Azure AD
• Exercise 2 – creating users and groups in Azure AD

Getting started

To get started with the hands-on exercises, you will need an Azure subscription that has access to create and delete resources. You can use an existing account that you created as part of the exercises from any chapter in this book. Alternatively, you can create a free Azure account from this URL: https://azure.microsoft.com/free.

This free Azure account provides the following:

• 12 months of free services
• $200 credit to explore Azure for 30 days
• 25+ services that are always free

Exercise 1 – creating a new tenant instance of Azure AD

This section will look at creating a new tenant instance of Azure...

Summary

This chapter on Azure identity services included coverage of some of the topics for the AZ-900 Azure Fundamentals exam skills area: describe identity, governance, privacy, and compliance features.

In this chapter, you have learned the definition of Azure AD and described its functionality and usage, the difference between authentication and authorization, and the functionality and usage of Conditional Access, MFA, and SSO.

Further knowledge beyond the exam objectives was provided to prepare for a real-world, day-to-day Azure-focused role.

Assigning Role-Based Access Control (RBAC) will be covered in the following chapter.

Further reading

This section provides links to additional exam information and study references:

• Exam AZ-900: Microsoft Azure fundamentals

  https://docs.microsoft.com/learn/certifications/exams/az-900

• Exam AZ-900: Skills outline

  https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3VwUY

• Microsoft Learn: Azure Fundamentals – Describe identity, governance, privacy, and compliance features

  https://docs.microsoft.com/learn/paths/az-900-describe-identity-governance-privacy-compliance-features/

Skills check

Challenge yourself with what you have learned in this chapter:

1. Explain Azure AD.
2. List four features provided by Azure AD.
3. Explain the difference between the different Azure AD editions.
4. Explain the difference between the four security principals.
5. Explain how Azure AD differs from AD.
6. List three services that AD provides that Azure AD does not.
7. Provide a scenario where you need to synchronize AD with Azure AD.
8. Explain what is meant by AuthN and AuthZ.
9. Explain what is meant by SSO.
10. Explain the principles MFA is based on.