Microsoft AZ-305: Identity, Governance and Compliance — Study Guide

By Laurynas Brazys · 11 August 2026 · #microsoft #az-305 #certification #exam-prep #study-guide

Part of the Microsoft Azure Solutions Architect Expert AZ-305 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Identity, governance, and compliance in Azure hinge on a coherent design across Microsoft Entra ID (formerly Azure AD), policy-driven guardrails, and least-privilege access at both human and workload layers. A well-architected solution balances just-in-time elevation for administrators, risk-based adaptive controls for users, standardized resource governance at scale, and smooth external access for partners and consumers, all without sacrificing operational agility.

Privileged Access and Adaptive Risk Controls

Privileged Identity Management (PIM) converts standing admin access into time-bound, auditable entitlements. Assign privileged roles as eligible rather than active to minimize exposure; users must activate eligible roles, typically triggering multifactor authentication, ticket/justification entry, optional approval workflows, and limited activation duration. Role settings define approvers, MFA, notification, and incident ticket requirements. Combine this with privileged access groups so Azure AD roles and Azure resource roles can be governed via group membership subject to PIM activation, producing a single control plane with comprehensive auditing. Use access reviews within PIM to continually validate who retains eligible or active assignments for roles, groups, and enterprise applications. Reviews can auto-apply outcomes and remove access for non-responders, enabling periodic attestation without manual rework.

Identity Protection applies machine-learning risk detection to users and sign-ins. User risk policies evaluate compromised-credential likelihood and can require secure password change or block access until remediated; sign-in risk policies analyze the current session context (impossible travel, unfamiliar sign-in properties, malware-linked IPs) and can demand MFA or block for risky attempts. Configure remediations so that medium and high risks trigger MFA or password reset while low risk might be monitored. Feed signals into Conditional Access rather than per-user MFA; this centralizes enforcement, supports exceptions (break-glass accounts), and reduces administrative drift.

Conditional Access unifies context-aware decisions. Named locations let you classify ranges as trusted corporate networks or geolocations you block or require additional controls for; leverage verified trusted IPs and country-based rules to mitigate high-risk geographies. Device compliance integrates with Microsoft Intune so you can require a compliant device or a hybrid Azure AD joined state before granting access to sensitive apps, and optionally incorporate Defender for Endpoint risk. App-enforced restrictions narrow data exfiltration risk by returning a limited web experience in SharePoint Online and Exchange Online that disables download and sync for unmanaged devices. Session controls tune how long sessions persist and how often reauthentication is required; set sign-in frequency for regulated workloads, disable persistent browser sessions for shared kiosks, and use Conditional Access App Control (via Defender for Cloud Apps) to monitor and control in-session activities such as blocking download of sensitive files while allowing in-browser viewing. Combined with risk-based policies, these controls deliver stepped-up challenges only when needed, preserving user productivity.

External and Consumer Identity

Azure AD B2C separates customer IAM from workforce IAM and provides scalable sign-in for consumer apps. Built-in user flows cover sign-up/sign-in, profile edit, and password reset with minimal configuration. When you need complex orchestration—custom claims, conditional journeys, identity proofing, or REST API-based claims enrichment—use custom policies (Identity Experience Framework). B2C supports many identity providers: local accounts (email or phone), OpenID Connect and OAuth 2.0 providers (Microsoft, Google, Apple), SAML 2.0 identity providers, and enterprise federation. Token customization includes issuing custom attributes, optional claims, and claims transformation to downstream apps, controlling token lifetimes, and adding API connectors to validate or enrich user data at critical decision points.

For B2B collaboration, Entitlement Management standardizes external user onboarding and minimizes sprawl. Access packages encapsulate who gets access (groups, apps, SharePoint sites), who can request it, and how it’s approved. Connected organizations formalize trust with partner tenants, allowing their users to request packages without pre-creating guest accounts. Lifecycle policies ensure access doesn’t linger: set expirations, require periodic access reviews, auto-remove assignments on expiration or review failure, and revoke residual guest access if a user loses all assignments. This model aligns with least privilege and reduces manual guest lifecycle management.

Publishing internal web apps externally is best solved with Azure AD Application Proxy. Lightweight connectors installed on-premises open only outbound connections to Azure, eliminating inbound firewall holes. Group connectors for scale and affinity. Choose Azure AD pre-authentication to enforce Conditional Access before traffic reaches your network; fall back to Passthrough only for niche scenarios. For legacy apps using Integrated Windows Authentication, configure Kerberos Constrained Delegation so the connector can obtain a Kerberos ticket to the backend on behalf of the user, enabling seamless SSO from the cloud to on-premises.

Governance at Scale: Policy, Blueprints, and Management Groups

Azure Policy codifies guardrails. A policy definition uses conditions and effects with parameters so the same rule can be reused across environments. Organize related definitions into initiatives to simplify assignment and reporting. Assign policies at the right scope—management group for broad governance, subscription for platform alignment, resource group for local overrides—and rely on inheritance to push controls downward. Key effects include:

Deny to block noncompliant deployments
Audit to mark resources for compliance reporting
Append to add properties like required tags
Modify to mutate resource properties at create/update
DeployIfNotExists to auto-deploy or configure dependencies
AuditIfNotExists and Disabled for specialized needs Pair DeployIfNotExists and Modify with remediation tasks. Assign a managed identity at the assignment and grant it the minimum roles required to perform remediation; trigger remediation jobs to retroactively fix drift. Use exemptions with documented justifications to handle exceptions without disabling governance.

Azure Blueprints package a deployable, versioned landing zone. Artifacts include policy assignments, role assignments, ARM/Bicep templates, and resource group scaffolding. At assignment, input parameters bind a versioned blueprint to an environment. Resource locking modes (DoNotDelete or ReadOnly) protect foundational resources from accidental changes, enforcing separation between platform and workload responsibilities.

Management Groups provide the backbone hierarchy for enterprise-scale governance. Design a clear tree—typically platform, landing zones by line of business or region, and sandboxes—so that policy and RBAC inheritance reflect operating boundaries. RBAC assigned at a management group flows to all child subscriptions and resource groups, minimizing repetitive role assignments. Conflicts resolve by evaluation order and effect semantics; a deny from policy cannot be overridden by RBAC. Use this structure to apply global standards (security baselines, tagging) at upper levels while tailoring at lower tiers with parameterized initiatives.

Advanced Permissions and Workload Identity Federation

Microsoft Entra Permissions Management (CIEM) discovers human and machine identities and their effective permissions across Azure, AWS, and Google Cloud. It builds an activity-aware permissions graph to identify unused, excessive, and toxic combinations of privileges. Use insights to right-size roles, remove dormant access, and enforce least privilege for service principals, managed identities, and users. Access Explorer shows who can do what on which resource; automated remediation workflows can strip unneeded rights at scale, reducing blast radius and satisfying compliance audits.

Workload Identity Federation eliminates secrets for non-Azure workloads that need to call Azure APIs. Instead of storing client secrets in CI/CD, create a federated credential on an app registration/service principal that trusts a specific external issuer (for example, GitHub Actions OIDC) and restricts subject and audience claims (for example, repo, branch, or environment). The external workload exchanges its short-lived OIDC token for an Azure access token to assume the service principal identity. This provides ephemeral, scoped credentials with no secret rotation overhead and granular trust boundaries. For Kubernetes, pair federation with Azure Workload Identity so pods receive projected OIDC tokens tied to service accounts that map to federated credentials, further reducing secret management.

Practical Problem Scenario

Starbucks must modernize identity and governance while enabling secure partner access and preserving SSO to on-premises apps. They operate multiple Azure subscriptions across regions, run legacy SAP and intranet apps on-premises using Integrated Windows Authentication, build mobile consumer apps, and use GitHub Actions for CI/CD.

Establish a management group hierarchy and baseline controls

Create a root hierarchy with platform, landing zones by business unit, and sandboxes. Assign Azure Policy initiatives at upper levels for tagging, region restrictions, and security baselines. Use Azure Blueprints to deploy landing zones with baked-in policy assignments, role assignments for platform teams, and resource group structure. Locks in the blueprint protect the shared platform resources. Chosen to centralize governance and ensure consistent, auditable environments.

Implement least-privilege administration

Configure PIM with eligible assignments for Azure AD roles and Azure resource roles through privileged access groups. Require MFA, justification, and approval for high-impact roles, and limit activation duration. Schedule quarterly access reviews for privileged groups and enterprise apps with auto-apply decisions. Selected to minimize standing privilege and automate attestation.

Enforce adaptive risk-based access

Enable Identity Protection user risk and sign-in risk policies to force password reset for high user risk and require MFA for medium and high sign-in risk. Build Conditional Access using named locations to trust corporate egress IPs and restrict high-risk geographies; require compliant or hybrid-joined devices for sensitive apps; apply app-enforced restrictions to SharePoint and Exchange to limit downloads on unmanaged devices; and set sign-in frequency to 8 hours for finance workloads. This combination provides strong security without persistent friction.

Govern external partner access

Use Entitlement Management access packages for vendors and consultants, including Azure RBAC via groups, required apps, and SharePoint resources. Configure connected organizations for partner tenants and set lifecycle policies with 90-day expiration and recurring access reviews that auto-remove non-responders. Chosen to automate onboarding/offboarding without manual guest management.

Publish on-premises applications securely

Deploy Azure AD Application Proxy connectors in two data centers, place them in connector groups, and configure Azure AD pre-authentication. Enable Kerberos Constrained Delegation for SAP and intranet sites to preserve IWA SSO. Apply Conditional Access to these enterprise apps. Selected to avoid VPN dependency and extend modern controls to legacy apps.

Secure consumer applications

Implement Azure AD B2C with built-in user flows for sign-in/sign-up and password reset, integrating social IdPs such as Apple and Google. For loyalty-program use cases, add custom policies to call REST APIs for identity proofing and enrich tokens with custom attributes. Chosen to separate consumer identity from workforce identity and scale globally.

Right-size permissions and remove secrets from CI/CD

Deploy Microsoft Entra Permissions Management to discover excessive permissions for users, managed identities, and service principals across clouds and apply activity-based rightsizing. Configure Workload Identity Federation for GitHub Actions by creating federated credentials constrained to the Starbucks org/repo/branch and granting only the necessary roles on target subscriptions. Selected to eliminate long-lived secrets and enforce least privilege continuously.

All domains · Data Storage and Database Solutions →

Practice these questions → · Timed practice on ExamRoll.io →