Azure Services 2.4 Flashcards
identity, access, and security
Identity Service AuthN and AuthZ
Authentication (AuthN) is the process of
proving that you are who you say you are.
Authorization (AuthZ) is the act of granting an
authenticated party permission to do something.
Identity Service Entra ID
Entra is Microsoft’s cloud-based identity
and access management service
which helps your employees sign in and access resources, including:
Internal resources, such as apps on your
corporate network or custom cloud apps.
External resources, such as Microsoft 365,
the Azure portal, and many SaaS apps.
Authentication methods in azure
Single Signon (SSO
MFA
Conditional Access
Single Sign on (SSO
Single sign-on means a user doesn’t have
to sign into every application they use.
The user logs in once and that credential is
used for multiple apps.
Single sign-on based authentication systems
are often called “modern authentication”.
MFA
MFA in Entra ID works by requiring
two or more of the following
authentication methods:
Something you know (pin or password)
Something you have (trusted device)
Something you are (biometric)
MICROSOFT AUTHENTICATOR APP
The Microsoft Authenticator app can be used as a primary form
of authentication to sign into any Entra ID account.
Can also be used as an additional verification option during
self-service password reset (SSPR) or Entra ID MFA events.
To use Microsoft Authenticator
a user must download the
phone app and register their account.
Additional verification
2nd factor of authentication
What is an OATH token
OATH (Open Authentication) is an open standard that specifies how time-based, one-time password (TOTP) codes are generated.
Software OATH tokens
Are typically applications. Entra ID generates the secret key, or seed, that’s input into the app and used to generate each OTP.
EXAMPLE: Microsoft Authenticator App
Hardware OATH tokens
Small hardware devices that look like a key fob that displays a code that refreshes every 30 or 60 seconds, with secret key/seed pre-programmed.
What is FIDO2
Uses public-key (asymmetric) cryptography for user
authentication.
User has a physical device (USB or NFC).
FIDO Authentication sequence
Provide username
Cryptographic challenge
Use FIDO2 key to sign challenge
Service verifies response and grants access
Windows Hello for Business
An authentication feature built into Windows 10, replaces passwords with strong two-factor authentication on PCs and mobile devices.
Windows Hello for Business authenticates to
A Microsoft account.
An Active Directory account.
An Entra ID account.
Identity Provider Services OR .
Relying party services that support Fast ID Online (FIDO) v2.0 authentication.
Windows Hello vs Hello Business
Hello is for personal devices and uses a pin or biometric gesture.
Hello for Business leverages key-based or certificate-based authentication.
Windows hello for business
Solves the following problems
Strong passwords can be difficult to remember, and
users often reuse passwords on multiple sites.
Server breaches can expose symmetric network
credentials (passwords).
Passwords are subject to replay attacks.
Users can inadvertently expose their passwords due
to phishing attacks.
External identities
B2B collaboration
B2B direct connect
Business-to-Consumer (B2C)
Entra ID multi-tenant organization
B2B collaboration
Enable external users to use their preferred identity to sign into your Microsoft or other enterprise applications (SaaS apps, custom-developed apps, etc.).
Supports Entra ID and social identities
B2B direct connect
Establish a mutual, two-way trust with another Entra ID organization for seamless collaboration.
Useful for heavy, daily collaboration with close business partners.
Supports multiple two-way trusts
Business-to-Consumer (B2C)
Publish modern SaaS apps or custom-developed apps to consumers and customers, while using Entra ID B2C for identity and access management.
Supports Entra & social identities
Entra ID multi-tenant organization
Collaborate with multiple tenants in a single Entra ID organization via cross-tenant synchronization.
Good for conglomerates, mergers, multi-cloud, dept/test/staging tenants
Entra id conditional access
Used by Entra ID to bring signals together, to make decisions, and enforce organizational policies.
Azure RBAC
Role Based Access Control
Azure RBAC helps you manage:
who has access to Azure resources,
what they can do with those resources
which resources/areas they have access to.
Built on Azure Resource Manager and
provides fine-grained access
management of Azure resources.
three principles of Zero Trust
Verify explicitly
Use least privilege access
Assume breach
Verify explicitly
Always authenticate and authorize based on all available
data points.
Use least privilege access
Limit user access with Just-In-Time and Just-Enough-Access
(JIT/JEA), risk-based adaptive policies, and data protection.
Assume breach
Segment access to minimize blast radius
Verify end-to-end encryption and use analytics to get
visibility, drive threat detection, and improve defenses.
Zero Trust Security
Unlike the “trust but verify” approach, in Zero
Trust, no entity is trusted by default.
It is based on three principles: assume breach,
verify explicitly, and least privilege access.
Zero Trust Security
Identities
Identities should be explicitly verified with strong
authentication using all available data points.
Users should be granted least privilege access.
Zero Trust Security
Devices
Devices should be monitored for health and
compliance and updated when necessary.
Zero Trust Security
apps
Only approved apps should be allowed to access
company data, and permissions managed.
Zero Trust Security
data
Data should be classified, labeled, and encrypted
based on its attributes, at rest and in motion.
Zero Trust Security
Infrastructure
Infrastructure version, configuration, JIT access,
should be managed.
Telemetry should be used to detect anomalous
activity that may indicate attack.
Zero Trust Security
networks
Networks should be segmented to limit data access
and reduce threat exposure.
Real-time threat protection, end-to-end encryption,
monitoring, and analytics should be employed.
Defense in-Depth
A layered (defense in depth) approach that
does not rely on one method to completely
protect your environment.
Defender for Cloud
A unified infrastructure security management
system that strengthens the security posture of
your cloud and on-premises data centers.
Provides security guidance for compute, data,
network, storage, app, and other services.
Includes support for both Azure and onpremises workloads, as well as other public
clouds (AWS, GCP). Multi-cloud support
