Part 5: Identity/Governance Flashcards by Edwin Weber

Authentication

Authorization

Authentication is the process of establishing the identity of a person or service that wants to access a resource.

Authorization is the process of establishing what level of access an authenticated person or service has.

How well did you know this?

Not at all

Perfectly

Azure Active Directory

Azure AD is Microsoft’s cloud-based identity and access management service.

How well did you know this?

Not at all

Perfectly

Single sign-on

Single sign-on enables a user to sign in one time and use that credential to access multiple resources and applications from different providers.

How well did you know this?

Not at all

Perfectly

Azure AD Connect

How well did you know this?

Not at all

Perfectly

Azure AD services

Authentication

Single sign-on

Application management

Device management

How well did you know this?

Not at all

Perfectly

How well did you know this?

Not at all

Perfectly

Multifactor Authentication

Something the user knows

This might be an email address and password.

Something the user has

This might be a code that’s sent to the user’s mobile phone.

Something the user is

This is typically some sort of biometric property, such as a fingerprint or face scan that’s used on many mobile devices.

How well did you know this?

Not at all

Perfectly

Conditional Access (Premium P1 or P2)

Conditional Access is a tool that Azure Active Directory uses to allow (or deny) access to resources based on identity signals.

Signals

who the user is

where the user is

what device the user is requesting access from.

How well did you know this?

Not at all

Perfectly

Cloud Adoption Framework

The Cloud Adoption Framework for Azure provides you with proven guidance to help with your cloud adoption journey.

Stages (DeePRAG)

Define,Plan,Ready,Adopt,Govern

How well did you know this?

Not at all

Perfectly

Subscription Strategy

Billing

Access control

Subscription limits

How well did you know this?

Not at all

Perfectly

Role Based Access Control (RBAC)

Scope

Management group

Subscription

Resource group

Resource

How well did you know this?

Not at all

Perfectly

How is RBAC enforced?

Azure RBAC is enforced on any action that’s initiated against an Azure resource that passes through Azure Resource Manager.

How well did you know this?

Not at all

Perfectly

Who does Azure RBAC apply to?

person

group

special identity types, such as service principals and managed identities.

How well did you know this?

Not at all

Perfectly

How do I manage Azure RBAC permissions?

The Access control (IAM) pane in the Azure portal.

How well did you know this?

Not at all

Perfectly

What is a Resource Lock?

A resource lock prevents resources from being accidentally deleted or changed.

How well did you know this?

Not at all

Perfectly

How do I manage resource locks?

Azure portal

PowerShell

Azure CLI

Azure Resource Manager template.

How well did you know this?

Not at all

Perfectly

What levels of locking are available?

CanNotDelete

ReadOnly

Azure blueprints

Tags

Resource tags are another way to organize resources.

How do I manage resource tags?

PowerShell

Azure CLI,

Azure Resource Manager templates

REST API

Azure portal.

Tag examples

AppName

CostCenter.

Owner

Environment

Impact

Azure Policy

Azure Policy is a service in Azure that enables you to create, assign, and manage policies that control or audit your resource

Policy Initiatives

An Azure Policy initiative is a way of grouping related policies into one set.

The initiative definition contains all of the policy definitions to help track your compliance state for a larger goal.

Builtin Initiative example

Initiative: Enable Monitoring in Azure Security Center

Policies:

Monitor unencrypted SQL Database in Security Center

Monitor OS vulnerabilities in Security Center

Monitor missing Endpoint Protection in Security Center

Compliance standrads

HIPAA ISO 27001

Scope of initiaves

management group subscription resource group

Azure blueprints

Azure Blueprints can define a repeatable set of governance tools and standard Azure resources that your organization requires. ## Footnote **Can handle multiple subscriptions!**

What are blueprint artifacts?

Each component in the blueprint definition is known as an artifact.

Blueprint artifacts examples

Deploy threat detection on SQL servers (no parameters) Allowed locations (parameter for allowed locations)

Blueprint builtin example

ISO 27001: Shared Services Blueprint

What is a control?

A known good standard that you can compare your solution against to ensure security.

Compliance categories (image)

Compliance categories

Criminal Justice Information Service Cloud Security Alliance STAR Certification European Union Model Clauses Health Insurance Portability and Accountability Act International Organization of Standards/International Electrotechnical Commission 27018 Multi-Tier Cloud Security Singapore Service Organization Controls 1, 2, and 3 National Institute of Standards and Technology Cybersecurity Framework United Kingdom Government G-Cloud

Microsoft Privacy Statement

Explains what personal data Microsoft collects, how Microsoft uses it, and for what purposes.

Online Services Terms (OST)

Legal agreement between Microsoft and the customer applies specifically to Microsoft's online services that you license through a **subscription**

Data Protection Addendum (DPA)

further defines the data processing and security terms for online services Compliance with laws Disclosure of processed data Data Security Data transfer, retention, and deletion

Trust Center

part of the Microsoft Trusted Cloud Initiative provides support and resources for the legal and compliance community **Access to the Trust Center doesn't require an Azure subscription or a Microsoft account.**

Azure compliance documentation

detailed documentation about legal and regulatory standards and compliance on Azure

Compliance blueprints

reference blueprints, or policy definitions, for common standards that you can apply to your Azure subscription Example: PCI DSS **P**ayment **C**ard **I**ndustry (PCI) **D**ata **S**ecurity **S**tandard (DSS)

Azure Government

a separate instance of the Microsoft Azure service. It addresses the security and compliance needs of US federal agencies, state and local governments

Azure China 21Vianet

Operated by 21Vianet. It's a physically separated instance of cloud services located in China.