IAM & AAD Flashcards
Azure Tenant
Identity Security Boundary
Can contain one or more subscriptions via a trust relationship
Azure AD: Subscription = 1: N
Contains IAM Resources (via AAD)
Active Directory Tenant > root account owner
AAD Groups
Security Group
Users/computer access to shared resources/groups
O365 Groups
Access to shared mailbox, calendar, SP and OneDrive
AAD Group Membership Types
Assigned - manual
Dynamic User
- Rules to auto add/remove users, dependent on member attribute
Dynamic Device
- Rules, Auto add/remove, device attributes for devices
Azure AD Specific Toles
Azure AD Specific Roles
– Tenant Level Scope
– Only applicable to AD specific resources
— user/groups/billing/passwords
- Global Administrator
- Security Administrator
- User Administrator
- Application Developer
Azure B2C
AWS Cognito
Allows 3rd party OIDC providers to connect to Azure App’s
Azure AAD Licenses
Azure AD Free
Azure AD Premium
- P1
- P2
Conditional Access - AAD Licenses
P1 and P2
Dynamic Groups - AAD Licenses
P1 & P2
Identity Protection - AAD Licenses
P1
Azure AD Groups
AAD Groups > Membership Types > Dynamic Users
> Add Dynamic Querry > Add Expressions
user.country -eq “India”
Takes times for SYNC
Azure RBAC Roles
v/s Azure AD Roles
Azure RBAC Roles
– Access Control to Azure Resources
– Multiple Levels
- Subscriptions
- Resource Groups
- Resources
Prebuilt Roles
- Owner
- Contributor (everything else, but no IAM changes)
- Reader
- User Access Administrator
Administrative Unit
Used to restrict scope of roles
Default Scope: Tenant Level
AAD > Administrative Unit > Limited Set of Roles
IAM - Different Entities
User Principal
Service Principal
Managed Identity
Azure AD Privileged Identity Management
Tool that will allow you to see who has elevated permissions within your environment.
You can examine the history of that access, and whether they use those permissions.
Also you can ask users to justify the need for those elevated permissions in a security review.
