AAD

Question 1

AAD SKU

Answer 1

• FREE
• OFFICE 365 Apps
• Premium P1
• Premium P2

Question 2

AAD Principals

Answer 2

User Principal
Service Principal - access is restricted by the roles
Managed Identity

Question 3

Azure Management Groups

Answer 3

7 levels of hierarchy
Comes on top of Subscriptions
Each management group and subscription can only support one parent.
Each management group can have many children.
By default, the root management group’s display name is Tenant root group
Root management group can’t be moved or deleted, unlike other management groups.
Azure AD Global Administrators can elevate the access to RMG

Question 4

Azure Hierarchy

Answer 4

• RMG
• Management Groups
• Subscriptions
• Resource Groups
• Resources

Question 5

Azure RBAC/Policies and Mgmt Groups

Answer 5

All subscription objects within a management group receives a copy of the role-based access control and policy settings applied to the management group.

Question 6

Azure Subscription

Answer 6

Logical entity that provides entitlement to deploy and consume Azure resources
Logical collection of Azure resources.
Each asset in Azure is deployed to a single subscription.
Administrative security boundary that supports Role-Based Access Control.
Each Azure Subscription has its own Administrators
Global and can contain resources from multiple regions

Question 7

Azure subscription types

Answer 7

• EA (Enterprise Agreement ) - Volume licensing
  program, 3 years , > 500 users
• Enterprise Dev/Test
• Pay as you go
• Free Trial
• Cloud Solutions Partner (CSP)

Question 8

AAD Premium P1 SKU
- Cost

Answer 8

Cost : $6 user/month

• SSO & MFA
• Advanced group access management
• Sync to on-premises AD

Question 9

AAD Premium P2 SKU
- Cost

Answer 9

Cost : $9 user/month

Azure Identity Protection

• Risky Account Detection
• Risk Investigation
• Risk based Conditional Access

Azure Identity Governance.

• PIM
• Access Reviews
• Entitlement Management

Question 10

Add custom domains

Answer 10

Initial domain name (immutable) : domainname.onmicrosoft.com.

Can add custom domain names.
Requires setting a TXT/MX record for the domain

• TXT Record with Alias (@), Destination and TTL
• MX Record with Alias (@), Destination, TTL and Priority

Verify from Azure portal

Question 11

Azure AD Roles - WHO CAN DO IT

Question 12

Azure Roles

Answer 12

Owner : Can assign users

Contributor : Cannot assign users

Reader

..

Backup Operator

Security Reader