Azure 500 Flashcards

Question

Rules about groups? ( what happens after creating a group)

Answer 1

After creating a Microsoft Entra group, you need to grant it the appropriate access. Each application, resource, and service that requires access permissions needs to be managed separately because the permissions for one may not be the same as another. Grant access using the principle of least privilege to help reduce the risk of attack or a security breach.

Answer 2

Direct assignment. The resource owner directly assigns the user to the resource. Group assignment. The resource owner assigns a Microsoft Entra group to the resource, which automatically gives all of the group members access to the resource. Group membership is managed by both the group owner and the resource owner, letting either owner add or remove members from the group. Rule-based assignment. The resource owner creates a group and uses a rule to define which users are assigned to a specific resource. The rule is based on attributes that are assigned to individual users. The resource owner manages the rule, determining which attributes and values are required to allow access the resource. External authority assignment. Access comes from an external source, such as an on-premises directory or a SaaS app. In this situation, the resource owner assigns a group to provide access to the resource and then the external source manages the group members.

Answer 3

Direct assignment. The resource owner directly assigns the user to the resource.

Answer 4

Group assignment. The resource owner assigns a Microsoft Entra group to the resource, which automatically

Answer 5

Rule-based assignment. The resource owner creates a group and uses a rule to define which users are assigned to a specific resource. The rule is based on attributes that are assigned to individual users. The resource owner manages the rule, determining which attributes and values are required to allow access the resource.

Answer 6

External authority assignment. Access comes from an external source, such as an on-premises directory or a SaaS app. In this situation, the resource owner assigns a group to provide access to the resource and then the external source manages the group members.

Answer 7

The group owner can let users find their own groups to join, instead of assigning them. The owner can also set up the group to automatically accept all users that join or to require approval. After a user requests to join a group, the request is forwarded to the group owner. If it's required, the owner can approve the request and the user is notified of the group membership. If you have multiple owners and one of them disapproves, the user is notified, but isn't added to the group.

Answer 8

B2B collaboration is a feature within Microsoft Entra External ID that lets you invite guest users to collaborate with your organization. With B2B collaboration, you can securely share your company's applications and services with external users, while maintaining control over your own corporate data. Work safely and securely with external partners, large or small, even if they don't have Microsoft Entra ID or an IT department.

Answer 9

Automate access changes based on user attributes Entitlement management for access request/approval Access reviews for recertification Support for cloud and on-prem apps (via SCIM, REST, SOAP, etc.) Enforce Conditional Access (MFA, Terms of Use)

Answer 10

Govern admin roles using Microsoft Entra PIM Enforce just-in-time access Alerts, access reviews, and role lifecycle management Strong controls for Microsoft 365, Azure, and more

Answer 11

Identity Governance helps organizations achieve a balance between productivity - How quickly can a person have access to the resources they need, such as when they join my organization? And security - How should their access change over time, such as due to changes to that person's employment status?

Answer 12

A digital identity is information on an entity used by one or more computing resources, such as operating systems or applications. These entities may represent people, organizations, applications, or devices. The identity is usually described by the attributes that are associated with it, such as the name, identifiers, and properties such as roles used for access management. These attributes help systems make determinations such who has access to what, and who is allowed to use that resource.

Answer 13

1️⃣ Identify Systems of Record Use trusted sources (e.g., Workday, SuccessFactors, Exchange Online) for user data. 2️⃣ Integrate with Microsoft Entra ID Sync users from systems of record. Remove outdated or duplicate user accounts. 3️⃣ Connect Application Directories Link Microsoft Entra ID to other app directories. Clean up old or mismatched entries (e.g., ex-employee accounts). 4️⃣ Handle Edge Cases Create processes for non-standard identities (e.g., visitors, freelancers) not in an HR database. 5️⃣ Automate Data Flow Ensure updates from source systems are replicated across all connected directories via Entra ID.

Answer 14

Definition: A process to automate and manage digital identities from creation to deletion, ensuring secure, timely access to resources throughout a user’s relationship with an organization. Goal: Balance productivity (quick access) and security (timely updates/removal).

Answer 15

Definition: A collection of attributes (name, role, department, etc.) used to represent a person, device, or app in computing systems for access control and identity verification.

Answer 16

Join: New user needs an identity and access. Move: User changes role/location → update access. Leave: User exits organization → remove access and disable identity.

Answer 17

Identify systems of record (e.g., Workday, Exchange Online). Sync with Entra ID, resolve outdated user data. Link other app directories (clean up inconsistencies). Handle exceptions (e.g., guests without HR records). Automate propagation of identity changes across systems.

Answer 18

Managed using Microsoft Entra External Identities & Entitlement Management. Guests can request access → approved → identity created → access assigned. When access expires, identity is automatically removed.

Answer 19

🔧 Inbound Provisioning: Pull data from Workday, SuccessFactors to auto-create/maintain users in AD & Entra ID. 🔁 Inter-directory Provisioning: Sync users already in Active Directory with Microsoft Entra ID. ⚙️ Lifecycle Workflows: Run tasks on key events (e.g., send welcome emails, assign roles). 🔄 Automatic Assignment Policies: Assign/remove group memberships and app roles based on attribute changes.

Answer 20

Definition: A feature that automates common identity lifecycle stages: Joiner (new user) Mover (role or department change) Leaver (exit or termination) These workflows execute tasks automatically based on user attributes and triggers.

Answer 21

Task: Action to be executed (e.g., send email, disable account) Scope: Users the workflow applies to (e.g., new employees) Trigger: When it runs (e.g., 7 days before hire date)

Answer 22

Automates onboarding/offboarding ✅ Reduces manual effort ✅ Centralizes identity workflows ✅ Improves scalability ✅ Provides history and audit logs ✅ Supports compliance & troubleshooting ✅ Integrates with Logic Apps for complex scenarios

Answer 23

Extend HR provisioning: Automate new hire tasks (e.g., welcome email, temp password) 🟢 Automate group membership: Works with static groups, no need for dynamic group rules 🟢 Automate user account management: Disable or delete accounts for departing users 🟢 Audit & troubleshoot: Keep logs of executed tasks 🟢 Custom scenarios with Logic Apps

Answer 24

Lifecycle workflows manage static groups No need for one rule per group Broader triggers (e.g., based on date offsets like employeeHireDate - 7 days) Can perform actions on groups, not just membership

Answer 25

Requires Microsoft Entra ID Governance license Up to 50 workflows Up to 100 custom task extensions Supports on-demand and scheduled execution

Answer 26

Definition: A Microsoft Entra ID Governance feature that automates access requests, assignments, reviews, and expiration for internal and external users. Purpose: To manage access to groups, apps, Teams, and SharePoint Online sites at scale with approval workflows and time-limited access.

Answer 27

Users often don’t know what access they need or how to get it. Users may retain access longer than necessary. External access is hard to manage manually. Automates and secures the process for both internal and guest users.

Answer 28

A bundle of resources (groups, apps, sites) users need for a role or task. Resources in Access Packages: Microsoft Entra security groups Microsoft 365 Groups / Teams Enterprise apps (SaaS or custom) SharePoint Online sites Also supports: Group-based licensing Azure role access Microsoft Entra role assignments

Answer 29

A policy defines: Who can request access (internal/external) How access is approved (e.g. manager approval) How long access lasts before expiration Whether access renewals or access reviews are required Each access package can have multiple policies.