Microsoft AzureIntermediate13 submodules

Azure Identity and Security

Protect Azure access and sensitive material using Microsoft Entra ID, workload identities, conditional access, Key Vault, Defender for Cloud, and Microsoft Sentinel.

How this module works

From concept to production evidence

Authenticate every human and workload explicitly, authorize the smallest scope for the shortest time, keep secrets out of code, continuously assess posture, and correlate security signals centrally.

Learning outcomes

Administer Entra users and groups
Use service principals and managed identities correctly
Design conditional access and RBAC
Protect secrets, keys, and certificates
Use Defender and Sentinel for posture and detection

Flow diagram

Azure Identity and Security end-to-end flow

Use this sequence as the operating backbone for every submodule note and hands-on exercise.

01
Establish identityAzure Identity and Security stage 1: establish identity with an auditable result before the next stage begins.
02
Authenticate securelyAzure Identity and Security stage 2: authenticate securely with an auditable result before the next stage begins.
03
Authorize least privilegeAzure Identity and Security stage 3: authorize least privilege with an auditable result before the next stage begins.
04
Retrieve protected materialAzure Identity and Security stage 4: retrieve protected material with an auditable result before the next stage begins.
05
Assess postureAzure Identity and Security stage 5: assess posture with an auditable result before the next stage begins.
06
Detect and respondAzure Identity and Security stage 6: detect and respond with an auditable result before the next stage begins.

Integrated hands-on lab

Secure a workload identity path

Create human and workload identities
Assign scoped RBAC
Configure Key Vault access
Apply conditional-access policy
Generate and investigate a security signal

Complete module contents

13 full submodule notes

Read in order

Microsoft Entra ID

Microsoft Entra ID provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Identity and Security. It is not an isolated definition: its value appears when it supports authenticate every human and workload explicitly, authorize the smallest scope for the shortest time, keep secrets out of code, continuously assess posture, and correlate security signals centrally.

Open full notes

Users

Users provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Identity and Security. It is not an isolated definition: its value appears when it supports authenticate every human and workload explicitly, authorize the smallest scope for the shortest time, keep secrets out of code, continuously assess posture, and correlate security signals centrally.

Open full notes

Groups

Groups provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Identity and Security. It is not an isolated definition: its value appears when it supports authenticate every human and workload explicitly, authorize the smallest scope for the shortest time, keep secrets out of code, continuously assess posture, and correlate security signals centrally.

Open full notes

Service Principals

Service Principals governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Identity and Security. It is not an isolated definition: its value appears when it supports authenticate every human and workload explicitly, authorize the smallest scope for the shortest time, keep secrets out of code, continuously assess posture, and correlate security signals centrally.

Open full notes

Managed Identities

Managed Identities provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Identity and Security. It is not an isolated definition: its value appears when it supports authenticate every human and workload explicitly, authorize the smallest scope for the shortest time, keep secrets out of code, continuously assess posture, and correlate security signals centrally.

Open full notes

RBAC

RBAC controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within Azure Identity and Security. It is not an isolated definition: its value appears when it supports authenticate every human and workload explicitly, authorize the smallest scope for the shortest time, keep secrets out of code, continuously assess posture, and correlate security signals centrally.

Open full notes

Conditional Access

Conditional Access turns a manual or repeated decision into versioned, parameterized, testable, and observable execution within Azure Identity and Security. It is not an isolated definition: its value appears when it supports authenticate every human and workload explicitly, authorize the smallest scope for the shortest time, keep secrets out of code, continuously assess posture, and correlate security signals centrally.

Open full notes

Azure Key Vault

Azure Key Vault controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within Azure Identity and Security. It is not an isolated definition: its value appears when it supports authenticate every human and workload explicitly, authorize the smallest scope for the shortest time, keep secrets out of code, continuously assess posture, and correlate security signals centrally.

Open full notes

Secrets

Secrets controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within Azure Identity and Security. It is not an isolated definition: its value appears when it supports authenticate every human and workload explicitly, authorize the smallest scope for the shortest time, keep secrets out of code, continuously assess posture, and correlate security signals centrally.

Open full notes

Keys

Keys controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within Azure Identity and Security. It is not an isolated definition: its value appears when it supports authenticate every human and workload explicitly, authorize the smallest scope for the shortest time, keep secrets out of code, continuously assess posture, and correlate security signals centrally.

Open full notes

Certificates

Certificates controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within Azure Identity and Security. It is not an isolated definition: its value appears when it supports authenticate every human and workload explicitly, authorize the smallest scope for the shortest time, keep secrets out of code, continuously assess posture, and correlate security signals centrally.

Open full notes

Defender for Cloud

Defender for Cloud provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Identity and Security. It is not an isolated definition: its value appears when it supports authenticate every human and workload explicitly, authorize the smallest scope for the shortest time, keep secrets out of code, continuously assess posture, and correlate security signals centrally.

Open full notes

Microsoft Sentinel

Microsoft Sentinel provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Identity and Security. It is not an isolated definition: its value appears when it supports authenticate every human and workload explicitly, authorize the smallest scope for the shortest time, keep secrets out of code, continuously assess posture, and correlate security signals centrally.

Open full notes