Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Azure 104 Study Guide > Ch. 1 Managing Azure Identities and Governance > Flashcards

Ch. 1 Managing Azure Identities and Governance Flashcards

1
Q

Azure AD B2C

A

Azure Active Directory
Business - to Customer

  • allows customers to sign in to applications using their social media accounts, such as Facebook
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Azure AD B2B

A

Azure Active Directory
Business - to Business

  • extends Azure AD to business partners
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the two types of users in Azure AD?

A
  1. cloud-only users

2. users synchronized from an on-premises directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

cloud - only users

A
  • users that are created and managed exclusively in Azure AD

- their attributes can be updated directly in Azure AD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What role must you be assigned to create a cloud - only user?

A

Global Administrator or User Administrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Where can you create a cloud-only user?

A

the Azure portal, Azure PowerShell, can the Azure command-line interface (CLI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What attributes are mandatory when creating a new user?

A

the username (sign in address for Azure AD) and the user’s name (given name and surname)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

groups

A

groups of objects that make role assignments and access permissions easier to manage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What objects can a group contain?

A

groups, users, devices, or service principles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Where can a group be created?

A

Azure portal, Azure PowerShell, the Azure CLI, and Microsoft Graph

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the two types of groups?

A
  1. Security

2. Office 365

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

security group

A

a group that allows you to share Azure resources access to a group of users, devices, or service principals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Office 365 group

A

a group that allows access to a shared mailbox, calendar, SharePoint site, and so on

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the 3 types of memberships a group can be assigned?

A
  1. Assigned
  2. Dynamic User
  3. Dynamic Device
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Membership Type: Assigned

A

this value allows you to select one or more users and add them to the group. Adding and removing users is performed manually.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Membership Type: Dynamic User

A

This value allows you to use dynamic group rules to automatically add and remove members.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Membership Type: Dynamic Device

A

This value allows you to use dynamic group rules to automatically add and remove devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Dynamic group requirement

A

You can only create a dynamic group if you have a Premium AD license. Otherwise, the Membership Type option is unavailable and is set to Assigned.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How do dynamic groups work?

A

Rules are created in a dynamic group. If a user or device has an attribute that matches the rule then that user or device is added to the group.

If the attributes changes and the user or device no longer matches the criteria for group membership, the entity will removed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Dynamic group membership processing

A
  • processing is not immediate
  • if an error occurs while processing a membership rule, it appears on the Group page in the Azure portal
  • the current processing status can be viewed from the Group page
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Can you create a dynamic group for users and devices at the same time.

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Can user attributes be in a device-based ruled?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Can the membership type of a group be changed after it is created?

A

Yes

Changing a static group to a dynamic group will remove all members from the static group and apply dynamic membership rules.

This change will also affect the access to the resources if the static groups has any previously assigned access for its members.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Where can devices be managed in the Azure portal?

A
  1. Under Devices in the Azure AD tenant.

2. Through the Devices blade for an individual user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What permissions do you need to enable or disable a device?

A

You must be a Global Administrator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Disabling a device

A
  • prevents a device from accessing Azure AD resources

- prevents a user from accessing Azure AD resources through that device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Deleting a device

A
  • prevents a device from accessing your Azure AD resources and removes all details that are attached to the device ( including BitLocker keys for Windows devices)
  • a non-recoverable activity and is not recommended unless it is required for an activity such as device decommissioning
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Bulk Updates

A
  • bulk user creations can now be done in Azure portal through a .csv file
  • under Users you can select Bulk create, Bulk invite, and Bulk delete
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Guest User

A
  • anyone who is invited to collaborate with your organization
  • once created they should receive an invitation in their mailbox
  • all users and admins can invite guests by default
30
Q

External Collaboration Settings

A
  • settings which restrict the way guest users can be invited

- found under Users in Azure AD

31
Q

Content Status

A
  • a value within a guest user account which shows if they have accepted an invite
  • the guest user will appear as an “invited user” in the Azure portal until the user accepts the invitation.
32
Q

Azure AD Join

A
  • allows users to work from enterprise and BYOD devices
  • you can control these devices, the applications installed accessed from them and how those applications interact with your corporate data
33
Q

What are the 3 options to associate device with Azure AD?

A
  1. registering a device
  2. joining a device
  3. using hybrid AD joined
34
Q

Azure AD Join: registering a device

A
  • appropriate for personal devices
35
Q

Azure AD Join: joining a device

A
  • useful for corporate - owned devices
36
Q

Azure AD Join: using hybrid AD joined

A
  • devices are joined to your on-premises Active Directory and are registered with your Azure AD tenant
37
Q

What are some mobile device management solutions?

A
  • Microsoft Intune
  • Microsoft Endpoint Configuration Manager (MECM)
  • Mobile Application Management (MAM)
  • Group Policy (if it’s hybrid-Azure joined)
38
Q

Where is device registration configured?

A

in Azure AD under Device > Device Settings

39
Q

Users May Join Devices to Azure AD

A
  • a settings that allows you to select the users and groups that can join devices to Azure AD
  • only applies to Azure AD Join on Win 10 devices
40
Q

Additional Local Administrators On Azure AD Joined Devices

A
  • you can choose which users are granted Local Administrator rights to the device
  • available on Azure AD Premium or with the Enterprise Mobility Suite
  • Global Administrator and the device owner are granted Local Administrator rights by default
41
Q

User May Regster Their Devices with Azure AD

A

allows users to register their devices with Azure AD (Workplace Join). Enrollment with MS Intune or Mobile Device Management for Office 365 requires Device Registration

  • if either of these services are configured then ALL will be selected and the button associated with the setting will be disabled
42
Q

Require Multi-Factor Auth to Join Devices

A
  • recommended when adding devices to Azure AD
  • When set to Yes, users who are adding devices from the Internet must first use a second method of authentication
  • prior to enabling this setting make sure MFA is configured for all users who are able to register devices and that they have gone through MFA setup
43
Q

Maximum Number of Devices Per User

A
  • designates the maximum number of devices that an individual user can have in Azure AD
  • if the quota is reached then the user will not be able to add a device until one of their existing devices is removed
44
Q

Hybrid AD Joined Devices Exception

A
  • the MFA and max number of devices per user settings are not applicable to hybrid AD joined devices
45
Q

Manage Enterprise State Roaming Settings

A
  • allows users to sync settings and app data across devices

- can be used with Azure AD Premium or EMS and is only applicable for Win 10 devices

46
Q

Azure AD Join Windows version requirements

A

hybrid - applicable to devices that are joined to an on-premises directory

  • an IT admin must join these devices
  • can join Win 10 and Win Server 2016 as well as lower versions such as Win 7, Win 8.1, Win Server 08, Win Server 08 R2, Win Server 12 and Win Server 12 R2

non-hybrid - applicable to devices that are not joined to an on-premises Active Directory
- requires Win 10 Professional and Win 10 Enterprise

47
Q

Self-service password reset (SSPR)

A
  • allows users to reset their own passwords in Azure AD
  • optionally write the password back to an on-premises environment when properly license and configured by using password writeback and Azure AD Connect
  • users can change passwords, reset passwords, and unlock accounts without an IT Dept
  • addresses both cloud-only and hybrid users
48
Q

SSPR License Requirements

A

Scenario User Type License Requirement

Password Change Cloud - only user Included in all editions of Azure AD

Password Reset Cloud-only user Microsoft 365 Business Standard, Microsoft 365 Business Premium,
Azure AD Premium P1, Azure AD Premium P2

Password Change/ Hybrid user Microsoft 365 Business Premium, Azure AD Premium P1, Azure AD
Unlock/Reset Premium P2

49
Q

role-based access control (RBAC)

A
  • allows you to manage the entities (security principles) that have access to Azure resources and the actions that those entities can perform.
  • determines who can do what (permissions)
50
Q

What entities in Azure can access be granted to?

A

users
groups
service principles
managed identities through role assignments
- this can then be applied at a scope (subscription), resource group, or even an individual resource

51
Q

Where does Azure RBAC apply?

A

to the management of resources created in the Azure Resource Manager (ARM) deployment model

52
Q

What is a role?

A

the definition of what actions are allowed and/or denied

53
Q

role inheritance

A

where child resources inherit the role assignments of any parents

ex. if a user is granted read access to a subscription, that user will have read access to all the resource groups and resources in that subscription

54
Q

managed identity

A

an identity which supports Azure AD authentication

55
Q

How does Azure handles different roles assigned to a security principle?

A

the most privileged access right takes precedence

56
Q

principle of least privilege

A

provide the minimum privileges to an object or user to perform actions as needed

57
Q

Using Groups with Azure RBAC

A

when assigning roles to a group all users in the group will inherit the assigned role

58
Q

role definition

A
  • contains the list of permissions or declared permissions which define what actions can or cannot be performed against a type of resource, such as read, write or delete
  • they can be built in or custom
59
Q

What is the difference between Azure Roles and Azure AD Roles?

A

Azure RBAC roles are used to manage access and allow or restrict users to resources, while Azure AD administrative roles are used to allow or restrict admins to perform identity tasks, such as creating new users, resetting passwords, etc.

A user who has Global Administrator right in Azure AD does not have permissions to create resources in Azure but he or she can perform all the identity tasks for an Azure AD tenant

60
Q

scope hierarchy

A
  • There are 4 scopes at which RBAC can be applied and scopes are structured in a parent-child relationship where RBAC is inherited by any child scopes.
  1. management group (the highest scope)
  2. subscriptions
  3. resource groups
  4. resources
  • An Azure AD tenant can support 10,000 management groups
  • granting a user access to the Owner role at the management group scope will grant that user Owner rights to all the subscriptions under the management group that is inclusive of all the resource groups and resources within them
61
Q

Role assignment limits

A

2,000 role assignments in each subscription

500 role assignments per management group

62
Q

What permission do you need to create and remove role assignments?

A

Microsoft.Authorization/role Assignments/*

This permission is granted through the Owner or User Access Administrator built-in roles

63
Q

Can you revoke access rights at a child scope through the application of a more restrictive role assignment?

A

No, the role is inherited through the parent.

64
Q

deny assignment`

A

a setting that can be placed on a scope through Azure Blueprints and resource locks

deny assignments are evaluated before role assignments and can be used to exclude service principals from accessing child scopes

65
Q

custom role

A
  • a role that provides a set of permissions that is not available in any of the built in roles
  • can be assigned and created through Azure portal, Azure PowerShell, Azure CLI, and REST API
  • can be shared between subscriptions that trust the same Azure AD directory
  • limit of 5,000 custom roles per directory
66
Q

What are the 3 ways you can create a custom role in Azure Portal?

A
  1. Clone from the existing built-in roles available
  2. Start from scratch
  3. Start from a JSON file to define the custom permissions
67
Q

How to clone a built in role.

A
  • you clone the role closest to the permissions that you want and then add or remove permissions to the role.
  • you can also rename the role to whatever you want.
  • after you select the permissions you must select the Assignable Scopes
    * the scope can be defined as a subscription, resource group, or resource level
    * the custom role must have a t least one valid scope assigned
  • to create a custom role, you must have the Microsoft.Authorization/roleDefinitions/write permissions on all AssignableScopes
68
Q

How to create a custom role by starting from scratch

A
  • choose Start From Scratch from the Baseline Permissions

- can be time consuming because you will have to select all the permissions one-by-one

69
Q

Creating a custom role using a JSON file.

A
  • you can also use a JSON file by selecting Start From JSON under Baseline Permissions (JavaScript Object Notation)
  • the JSON file contains the role definitions
    • a name represented by the Name attribute.
    • an identifier represented by the Id attribute.
    • a description represented by the Description attribute
    • a flag that denotes if the role is custom or built-in represented by the IsCustomer attribute, this is set to false for
      built-in roles and true for custom roles
    • the actions that can or cannot be performed within the Azure management plan are represented by the Actions[ ]
      and NotActions [ ] atrributes
    • the scopes at which the role is available through the Assignable Scopes [ ] attribute
70
Q

Access Control (IAM)

A
  • used to manage access to resources and it is where role assignments are applied or removed in Azure portal
  • available at any scope where role assignments can be made (management group, subscription, resource group, and resource)
71
Q

What can you perform from the Access control (IAM) blade?

A
  1. Check the effective access rights for a security principal at the current scope through the Check Access tab, including being able to view inheritance
  2. Edit role assignments, both granting and revoking access rights through the Role Assignments tab
  3. View deny assignments, which are controlled by Microsoft, through the Deny Assignments tab
  4. View and manage permissions to classic resources through the Classic Administrators tab
  5. View the available roles, both built-in and custom, through the Roles tab

Azure 104 Study Guide (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions