Microsoft AZ-900: Identity, Access & Security — Study Guide

By Laurynas Brazys · 22 July 2026 · #microsoft #az-900 #certification #exam-prep #study-guide

Part of the Microsoft Azure AZ-900 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Identity, access, and security in Azure center on Microsoft Entra ID for identity management, Azure RBAC and Privileged Identity Management for authorization, and platform controls that protect secrets and harden workloads. Strong authentication and risk-based policies reduce account takeover, while central secret storage and network-edge protections close common attack paths. Continuous posture management then drives remediation of misconfigurations at scale. A cohesive design links these elements: authoritative identities synchronized from on-premises or mastered in the cloud; enforceable access policies tied to device and session risk; least-privilege roles with just-in-time elevation; secrets and keys isolated from application code; and layered defenses that include application firewalls, DDoS mitigation, and threat-driven recommendations. The result is a defensible, auditable environment aligned to business and regulatory needs.

Microsoft Entra ID: users, groups, and hybrid sync

Microsoft Entra ID is the cloud identity service for users, devices, applications, and service principals. Users can be cloud-only or synchronized from on-premises directories. Groups organize access, with support for security groups and Microsoft 365 groups. Dynamic group membership simplifies lifecycle by auto-populating groups based on user or device attributes (for example, all users in department = Finance), enabling clean scoping of app access and policy without manual updates. Hybrid organizations connect their on-premises Active Directory using Microsoft Entra Connect. Password hash synchronization is the simplest and most resilient sign-in method, providing cloud authentication with hashes derived on-premises and synchronized on a schedule. Pass-through authentication keeps password validation on-premises via lightweight agents when regulatory or policy constraints require it, and can be paired with Seamless SSO for intranet experiences. For large or distributed environments, Microsoft Entra Cloud Sync offers a lightweight agent-based approach with multi-forest support and simplified operations. Group-based licensing, app assignments, and role assignments build on these primitives. External users can be invited using cross-tenant access (B2B collaboration) while applying Conditional Access, access reviews, and lifecycle policies to reduce risk from inactive guests. Sign-in, audit, and provisioning logs provide traceability and are exportable to a Log Analytics workspace or SIEM for retention and analysis.

Primary use
- Cloud-only users: Greenfield cloud identity
- Synced users (PHS): Most common hybrid sign-in
- Synced users (PTA): Hybrid where passwords must remain on-prem
- Dynamic groups: Automated access scoping
Latency to reflect changes
- Cloud-only users: Immediate
- Synced users (PHS): Minutes (sync cadence)
- Synced users (PTA): Near real time (agent-mediated)
- Dynamic groups: Near real time (rule evaluation)
Resiliency if on-prem offline
- Cloud-only users: Unaffected
- Synced users (PHS): Unaffected for sign-in
- Synced users (PTA): Dependent on PTA agent availability
- Dynamic groups: Unaffected
Typical scenarios
- Cloud-only users: Startups, pilot workloads
- Synced users (PHS): Broad hybrid deployments
- Synced users (PTA): Regulated workloads, password policies on-prem
- Dynamic groups: License assignment, Conditional Access targeting

Authentication and risk controls: MFA, Conditional Access, passwordless, SSPR, Identity Protection, and access reviews

Strong authentication starts with multi-factor authentication (MFA) and evolves to phishing-resistant, passwordless methods. Microsoft Authenticator, SMS/voice, FIDO2 security keys, Windows Hello for Business, and certificate-based authentication cover a spectrum of assurance and usability. Conditional Access is the policy engine that ties user, device, app, location, and session risk into decisions that grant, challenge, or block. Core patterns include requiring MFA for all interactive users, blocking legacy protocols, enforcing compliant or hybrid-joined devices for high-value apps, and using sign-in risk to trigger step-up authentication. Self-Service Password Reset (SSPR) reduces helpdesk load by allowing users to reset or change passwords with configured authentication methods. In hybrid setups, password writeback updates on-premises AD securely. Combining SSPR and MFA gives a unified portal and converged registration, streamlining user onboarding and recovery. Policies should specify secure methods, minimum numbers of methods, and registration deadlines. Microsoft Entra ID Protection adds machine-driven detection of risky users and risky sign-ins. Risk policies can automatically require password change on high user risk or enforce MFA for medium-and-above sign-in risk, reducing dwell time for compromised accounts. Administrators triage risk detections and confirm, dismiss, or remediate events, while integration with Conditional Access makes risk a first-class control. Access reviews provide periodic and automated recertification of user, group, app, and privileged role access—critical for guest accounts and high-risk groups—and can enforce outcomes automatically when reviewers do not respond.

Password only
- Factor type: Knowledge
- Phishing-resistant: No
- Offline support: Yes (cached domain creds)
- Common uses: Legacy/non-critical apps
- Licensing notes: Included; not recommended alone
MFA SMS/voice OTP
- Factor type: Possession (phone)
- Phishing-resistant: No
- Offline support: Limited (phone coverage)
- Common uses: Baseline MFA, broad reach
- Licensing notes: Requires Entra ID P1 for CA enforcement
Authenticator app (push/code)
- Factor type: Possession
- Phishing-resistant: Partially (number match mitigates)
- Offline support: Limited
- Common uses: Mainstream MFA
- Licensing notes: P1 for CA; features like number matching recommended
Windows Hello for Business
- Factor type: Biometric/PIN + device-bound key
- Phishing-resistant: Yes
- Offline support: Yes (domain-joined/cached)
- Common uses: Workstations, hybrid join
- Licensing notes: Included with Windows/Entra; CA policies require P1
FIDO2 security key
- Factor type: Hardware-bound key
- Phishing-resistant: Yes
- Offline support: Yes
- Common uses: Shared kiosks, admins, high assurance
- Licensing notes: Entra ID support included; CA requires P1
Certificate-based auth (CBA)
- Factor type: Certificate
- Phishing-resistant: Yes
- Offline support: Yes
- Common uses: Highly regulated, smartcards
- Licensing notes: CBA in Entra; policy with P1/P2

Authorization with Azure RBAC and Privileged Identity Management (PIM)

Azure role-based access control (RBAC) governs who can take what actions on which resources across the management plane. Assignments are made at a scope—management group, subscription, resource group, or resource—and inherit downward. Built-in roles like Owner, Contributor, Reader, and more granular roles such as Virtual Machine Contributor, Key Vault Administrator, or Storage Blob Data Reader provide least-privilege options. Custom roles refine permissions further using specific Azure Resource Manager actions when built-ins are too coarse. Effective authorization design segments workloads into resource groups aligned to application boundaries, assigns Reader by default, and elevates contribution rights only where needed. Group-based role assignment simplifies lifecycle management, and activity logs combined with Azure Monitor alerts provide oversight on changes to role assignments. For data-plane scenarios (for example, Storage blob data or Key Vault secrets), use the corresponding data-access roles rather than coarse management roles. Privileged Identity Management (PIM) adds just-in-time, time-bound elevation for both Azure RBAC roles and Microsoft Entra directory roles. Users are Eligible for a role and must activate it—with MFA, approvals, ticket numbers, and justification—before performing privileged tasks. PIM enforces assignment start/end, limits standing access, and records activation history. Access reviews within PIM ensure that eligibility and permanent assignments do not drift, and alerts flag risky configurations such as permanent Global Administrator or Owner on subscriptions.

Primary function
- Azure RBAC: Authorize actions on Azure resources
- PIM for Azure RBAC: Just-in-time elevation for resource roles
- PIM for Entra roles: Just-in-time elevation for tenant/directory roles
Scope
- Azure RBAC: Management group → resource
- PIM for Azure RBAC: Same as RBAC target scope
- PIM for Entra roles: Tenant-wide (directory roles)
Access model
- Azure RBAC: Standing assignment
- PIM for Azure RBAC: Eligible → activated with controls
- PIM for Entra roles: Eligible → activated with controls
Typical controls
- Azure RBAC: Role definition + scope
- PIM for Azure RBAC: MFA, approval, time limit, reason, ticket
- PIM for Entra roles: MFA, approval, time limit, reason, access reviews
Licensing
- Azure RBAC: Included
- PIM for Azure RBAC: Entra ID P2
- PIM for Entra roles: Entra ID P2

Secrets, keys, and certificates with Azure Key Vault

Azure Key Vault centralizes storage for application secrets, certificates, and cryptographic keys to remove credentials from code and templates. Secrets such as connection strings and API keys are retrieved over TLS using Azure SDKs or REST, while certificates support import, generation, and automatic renewal via integrated certificate authorities. Keys enable encryption-at-rest and cryptographic operations, including envelope encryption for application data and customer-managed keys for services like Azure Storage, SQL Database, and Disk Encryption Sets. Access to Key Vault is enforced at two planes. The management plane uses Azure RBAC to control who can configure the vault. The data plane can use modern Azure RBAC for Key Vault or legacy access policies; new deployments should prefer Azure RBAC for consistency and auditing. Soft delete and purge protection are enabled by default to prevent accidental or malicious loss, and private endpoints with firewall rules restrict network access. Managed identities for Azure resources eliminate embedded credentials by granting workloads identity-based access to secrets. For higher assurance, Azure Key Vault Managed HSM provides single-tenant, FIPS 140-2 Level 3 validated HSMs for key operations with dedicated capacity and strict role separation. Operational hygiene includes versioned secrets, rotation policies, certificate auto-rotation, and exporting diagnostic logs to a SIEM. Assign narrow data-plane roles such as Key Vault Secrets User or Key Vault Crypto Officer to minimize blast radius.

Primary use
- Key Vault (multi-tenant): Secrets, certs, keys for most apps
- Managed HSM: High-assurance key operations only
Isolation
- Key Vault (multi-tenant): Multi-tenant service
- Managed HSM: Single-tenant, dedicated HSMs
FIPS level
- Key Vault (multi-tenant): 140-2 Level 2 (service boundary)
- Managed HSM: 140-2 Level 3
Data-plane model
- Key Vault (multi-tenant): Azure RBAC or access policies
- Managed HSM: RBAC-like role model specific to HSM
Common integrations
- Key Vault (multi-tenant): App Service, AKS, Storage CMK, SQL TDE, Disk Encryption Sets
- Managed HSM: Payments, regulated crypto, signing with strict controls

Security posture, Defender for Cloud, Secure Score, WAF, and DDoS protections

Microsoft Defender for Cloud delivers cloud security posture management (CSPM) and workload protection across Azure, multicloud, and hybrid. It continuously assesses resources against security standards, drives a Secure Score with prioritized recommendations, and uses Azure Policy for at-scale governance. Enabling Defender plans adds threat detection and protections for servers, containers, databases, storage, Key Vault, and PaaS services, including agent-based EDR on servers and Kubernetes threat detection. The Regulatory Compliance dashboard maps controls to frameworks such as ISO 27001, NIST, and CIS, accelerating audits. At the network and application edge, Azure provides native DDoS mitigation and a web application firewall (WAF). DDoS Protection is enabled per virtual network, automatically profiles normal traffic, and mitigates volumetric and protocol attacks against public IPs. The IP Protection SKU is cost-effective for smaller footprints with a few public endpoints, while Network Protection (Standard) covers all public IPs in a protected VNet and includes cost protection and Rapid Response support. WAF operates at Layer 7 on Azure Application Gateway (regional) or Azure Front Door (global), with managed rule sets, anomaly scoring, bot protection, and custom rules. Run WAF in prevention mode to actively block, and pair it with private origins and Zero Trust access for defense in depth. Combine these services for layered defense: DDoS to absorb floods, WAF to stop OWASP Top 10 and abuse patterns, NSGs and Azure Firewall to constrain east-west and north-south flows, and Defender for Cloud to close configuration gaps and detect threats. Feed diagnostics from WAF, DDoS, and resource logs into Log Analytics or Microsoft Sentinel for correlation and response.

DDoS Basic (platform)
- Scope: Global platform
- Primary function: Baseline multi-tenant mitigation
- Best fit: All public services
- Key inclusions: Always-on baseline, no config
DDoS IP Protection
- Scope: Per public IP
- Primary function: DDoS mitigation for select endpoints
- Best fit: Small estates, dev/test, single-IP apps
- Key inclusions: Adaptive tuning, attack analytics
DDoS Network Protection
- Scope: Per VNet (all public IPs)
- Primary function: Comprehensive DDoS with support
- Best fit: Production VNets with many endpoints
- Key inclusions: Cost protection, Rapid Response, mitigation reports
WAF on Application Gateway v2
- Scope: Regional L7
- Primary function: App-layer threat mitigation at gateway
- Best fit: Regional apps, private backends
- Key inclusions: OWASP CRS, custom rules, bot mitigation
WAF on Azure Front Door
- Scope: Global L7 CDN/accelerator
- Primary function: Global edge protection and acceleration
- Best fit: Internet-facing global apps/APIs
- Key inclusions: WAF policies, geo-filtering, rate limits

Practical Problem: Contoso Retail’s secure hybrid rollout with risk-based access and layered defenses

Scenario: Contoso Retail operates 120 stores with an on-premises AD forest and is launching a new Azure-based e-commerce platform. Employees will access internal admin portals from corporate devices, while vendors and marketing agencies require guest access. The company must cut password-related helpdesk calls, enforce phishing-resistant sign-in for admins, protect application secrets, and withstand seasonal traffic spikes and attack campaigns—all while maintaining audit evidence for PCI DSS controls.

Challenge: Design an identity-first security architecture that preserves existing identities, enforces adaptive access, removes secrets from code, minimizes standing privilege, and implements network-edge protections for a globally reachable web front end.

Recommended Approach:

Deploy Microsoft Entra Connect with password hash synchronization and Seamless SSO. Configure a staging server for rollback and sync selected OUs to limit scope.
Create dynamic security groups for Finance, Store Operations, and Administrators based on on-prem attributes; use group-based app assignments and licensing.
Enable Conditional Access: require MFA for all users; block legacy authentication; require compliant or hybrid-joined devices for admin portals; enforce sign-in risk-based MFA challenge and block access from countries where Contoso has no presence.
Roll out passwordless for privileged users using FIDO2 security keys and Windows Hello for Business; mandate number-matching for Authenticator push until fully passwordless.
Enable SSPR with password writeback and require two secure methods for reset; converge registration with MFA to reduce user friction.
Activate Microsoft Entra ID Protection user-risk and sign-in-risk policies to automatically require password changes on high user risk and challenge medium-and-above risky sign-ins.
Stand up Access Reviews for guest users in partner-facing groups and for all PIM-eligible roles, with auto-apply of remove decisions on non-response.
Implement Azure RBAC with least privilege at the resource group level per application; assign via groups. Use activity log alerts for role assignment changes.
Onboard subscriptions to PIM; make Owner and Contributor assignments Eligible with approval, MFA, and 4-hour activation windows; require ticket numbers and justification.
Provision Azure Key Vault with private endpoints and Azure RBAC for data-plane access. Store app secrets and certificates; enable rotation policies; grant the web app’s system-assigned managed identity read access to required secrets.
Front the e-commerce site with Azure Front Door Standard with WAF in prevention mode and a WAF policy using the latest managed rule set and geo-filtering; restrict origin access via private endpoints or locked-down public IPs.
Enable DDoS Network Protection on the production VNet hosting public IPs for APIs and gateways; configure diagnostics and alerting.
Turn on Microsoft Defender for Cloud plans for Servers, Containers, App Service, SQL, and Key Vault. Use Secure Score improvement actions to remediate missing MFA on subscriptions, public storage access, and weak TLS on App Gateway.
Stream Entra sign-in, audit, WAF, DDoS, and Defender alerts to a Log Analytics workspace and Microsoft Sentinel for detection and response. Create playbooks to disable tokens and force password reset on confirmed account compromise.

Azure Rationale: This design preserves identity authority on-premises while enabling resilient cloud sign-in with password hash sync. Conditional Access and Identity Protection convert static MFA into adaptive, risk-driven enforcement, while passwordless removes password phishing from the privileged path. RBAC with group assignments and PIM eliminates standing admin rights and provides full auditability. Key Vault and managed identities excise secrets from code and pipelines. Azure Front Door WAF and DDoS Protection establish layered edge defense for a global footprint, and Defender for Cloud with Secure Score drives continuous hardening and threat detection across compute and data services.

← Storage · All domains · Cost Management →

Practice these questions → · Timed practice on ExamRoll.io →