John Saville - Claude Flashcards
What is Azure AD and what protocols does it support?
Azure AD (now called Azure Entra ID) is Microsoft’s cloud-based identity provider that supports protocols like OAuth 2.0 OpenID Connect SAML and WS-Fed for authentication and authorization over the internet.
How does Azure Entra ID interact with on-premises Active Directory?
Azure Entra ID interacts with on-premises Active Directory through Azure Entra Connect sync or Azure Entra Connect Cloud sync where user accounts are replicated from Active Directory to Azure Entra ID.
What is the purpose of having a tenant in Azure Entra ID?
A tenant in Azure Entra ID is an organization’s instance that contains its users groups devices applications and conditional access policies. Applications and services trust this tenant for authentication and authorization.
Can Azure Entra ID tenants have external users or guests?
Yes Azure Entra ID tenants can have external users or guests from other organizations identity providers (like Google or Facebook) or Microsoft accounts allowing them to collaborate without creating separate accounts.
Where does an Azure Entra ID tenant reside?
An Azure Entra ID tenant is a global instance and does not reside within an Azure subscription. It is a separate entity that Azure subscriptions can trust for authentication and authorization.
Can you customize the branding and user experience in an Azure Entra ID tenant?
Yes you can customize the branding and user experience in an Azure Entra ID tenant by configuring company branding settings background images and login messages.
How do external users or guests appear in an Azure Entra ID tenant?
External users or guests appear as stub objects that refer to their primary identity in another tenant Microsoft account Google Facebook or other identity provider.
What are the different ways to provision user accounts in Azure Entra ID?
User accounts can be provisioned through synchronization from Active Directory manual creation bulk creation via CSV upload provisioning from an HR system or API and scripting.
Why are groups recommended for managing user access and permissions?
Groups are recommended for managing user access and permissions because it’s easier to assign roles permissions and licenses to groups rather than individual users simplifying administration and avoiding orphaned permissions when users leave.
What are the two types of groups in Azure Entra ID and their purposes?
The two types of groups are security groups (for assigning roles and permissions) and Microsoft 365 groups (for collaboration tools like SharePoint and calendars).
What is the difference between registering and joining a device in Azure Entra ID?
Registering a device makes it a known entity for management but is suitable for personal devices while joining a device allows more control and direct authentication using Azure Entra ID accounts suitable for corporate-owned devices.
What are the different Azure Entra ID license levels and their key features?
The Azure Entra ID license levels are Free (basic features) P1 (adds conditional access self-service password reset HR-driven provisioning) and P2 (adds privileged identity management identity protection and access reviews). There is also a Governance add-on.
What are administrative units in Azure Entra ID and how do they work?
Administrative units allow grouping users groups and devices and assigning roles that only apply to objects within that unit enabling granular access control delegation.
When adding a group to an administrative unit do the users in that group automatically inherit the unit’s permissions?
No users in a group added to an administrative unit do not automatically inherit the unit’s permissions. The users must be explicitly added to the administrative unit as well if they need to be managed.
What are the different Azure clouds or environments and how do they relate to Azure Entra ID tenants?
The different Azure clouds or environments include Commercial US Government China and others. Each cloud has its own separate instance of Azure Entra ID and tenants cannot span across different clouds.
What are regions in Azure and how do availability zones fit into regions?
Regions are geographical locations where Azure resources can be deployed. Within a region there are typically three availability zones which are separate physical datacenter locations for redundancy and high availability.
How are Azure regions paired and why is this important?
Azure regions are paired within the same geopolitical boundary for Azure’s safe deployment practices. Changes are rolled out to one region in a pair first then the other to avoid simultaneous failures.
What are Azure subscriptions management groups and how are they organized?
Subscriptions are containers for deploying Azure resources. Management groups provide a hierarchy above subscriptions for organizing resources assigning roles and policies and tracking budgets across multiple subscriptions.
How can you get started with Azure if you’re an individual or don’t have an existing enterprise subscription?
You can sign up for a free trial account or use the free services offered in Azure.
What is the cost analysis and management feature in Azure used for?
It allows you to view your current and forecasted costs analyze costs by resource or service set budgets and get cost optimization recommendations.
What are Azure budgets and how do they work?
Azure budgets allow you to set a cost threshold and configure alerts when spending reaches a certain percentage of that budget based on actual or forecasted costs. This helps track and control spending.
What are resource groups in Azure and how should they be used?
Resource groups are containers for deploying related Azure resources together. Resources in the same group should share a lifecycle and are suitable for common access control policies and cost tracking.
What is the Azure Hybrid Benefit and how does it help reduce costs?
The Azure Hybrid Benefit allows you to use existing on-premises Windows Server and SQL Server licenses in Azure removing the license cost from your Azure bill.
What are Azure reservations and savings plans and how do they differ?
Azure reservations provide discounted rates for specific resources in specific regions with a 1-3 year commitment. Azure savings plans offer a general hourly commit for included compute services with flexible discounts.
What are Azure tags and how can they be used?
Azure tags are key-value pairs that can be applied to resources resource groups or subscriptions to categorize and filter resources track ownership apply policies or use for billing purposes.
Do Azure tags inherit from parent scopes like subscriptions or resource groups?
No tags do not inherit from parent scopes by default. They must be explicitly applied at each level (subscription resource group or resource).
How can you enforce tag inheritance policies in Azure?
You can use Azure Policy to create a policy that forces resources to inherit tags from their parent resource group or subscription.
What is Azure Policy and how does it work?
Azure Policy allows you to define and enforce rules (policies) for your Azure resources to ensure compliance with standards security requirements or other criteria. Policies have defined conditions and effects (like deny audit deploy etc.).
What is an Azure Policy initiative and how does it differ from a single policy?
An Azure Policy initiative is a group or set of related policies. It allows you to assign and manage multiple policies as a single unit simplifying compliance tracking for complex requirements.
How can you view and manage role-based access control (RBAC) in Azure?
You can view and manage RBAC assignments through the Access Control (IAM) pane for a resource resource group or subscription. This lets you see assigned roles and permissions and add custom roles following least privilege principles.
How can you create a custom Azure role with specific permissions?
You can create a custom role by cloning an existing role then adding or removing specific permissions (actions) from different resource providers. This allows you to define a least-privilege role with only the necessary permissions.
What is the difference between Azure roles and Azure Active Directory (Azure AD) roles?
Azure roles control access to Azure resources and subscriptions while Azure AD roles control access to tenant-level resources and configurations within the Azure AD service.
What types of resource locks can you apply in Azure and what do they affect?
You can apply two types of resource locks: CanNotDelete (prevents deletion but allows modifications) and ReadOnly (prevents all modifications). These locks only affect the Azure control plane operations not data plane operations within resources like databases or storage.
How are virtual networks defined and scoped in Azure?
A virtual network (VNet) is defined by one or more IPv4 address spaces (optionally IPv6) and it exists within the scope of a single Azure subscription and region. It cannot span multiple subscriptions or regions.
How are subnets sized and IP addresses allocated within Azure virtual networks?
Within a VNet you define one or more subnets that are subsets of the VNet address space. Each subnet loses 5 IP addresses for Azure’s use (network broadcast gateway DNS). Resources deployed to a subnet are allocated a dynamic private IP from the remaining subnet range by Azure’s DHCP service.
What is the purpose of assigning a public IP address to an Azure resource?
Assigning a public IP address to an Azure resource allows it to be accessed from the public internet. Without a public IP the resource is only accessible over its private IP from within the VNet or connected networks.
How can you enable communication between resources in different Azure virtual networks?
You can peer virtual networks within the same region or across regions. Peering allows resources to communicate using private IP addresses. You can enable the “Use Remote Gateway” setting to allow spokes to use the hub VNet’s gateway connectivity (VPN ExpressRoute).
What is the purpose of Azure Virtual Network Manager?
Azure Virtual Network Manager allows you to centrally define and manage connectivity between virtual networks. You can create network groups (static or dynamic) and define hub-and-spoke or mesh topologies for connectivity between the groups. It also provides security admin rules to allow/deny traffic before NSG rules.
What are Network Security Groups (NSGs) in Azure?
NSGs are sets of inbound and outbound security rules that can be applied to subnets or individual network interfaces. Rules specify priorities source/destination IP ranges or service tags ports and allow/deny actions.
What are service tags in Azure Network Security Groups?
Service tags represent groups of IP address prefixes for specific Azure services which can be used in NSG rules instead of specifying explicit IP ranges. This allows rules to dynamically cover Azure service IP ranges as they change.
What are application security groups in Azure?
Application security groups are tags that can be applied to network interfaces. These groups can then be used in NSG rules to allow or deny traffic from/to the tagged resources instead of specifying explicit IP addresses.
