Designing authentication and application identity
Identity is the main security boundary in Azure. The exam asks you to match a scenario to the lightest feature that meets it.
Workload identities
| Situation | Choose |
|---|---|
| Azure resource calls another Azure service | Managed identity |
| One identity shared by several resources | User-assigned managed identity |
| Identity tied to one resource lifecycle | System-assigned managed identity |
| App outside Azure, or CI/CD, needs access | App registration (service principal), preferably with a certificate or workload identity federation |
Managed identities remove secret management entirely. Store the secrets you cannot avoid in Azure Key Vault, and use the Premium tier (HSM-backed keys) only when HSM protection is required.
Single sign-on for apps
- OpenID Connect / OAuth 2.0: modern apps and APIs.
- SAML: enterprise SaaS and older apps that support federation.
- Password-based: apps with only a login form.
- Header-based and Kerberos: on-premises apps published through Microsoft Entra application proxy, which gives secure remote access without a VPN or inbound firewall openings.
Register the app in Entra ID, then control who can use it with assignments and Conditional Access.
External users
| Scenario | Service |
|---|---|
| Partners or vendors use your apps with their own accounts | Entra B2B collaboration |
| Customer-facing app with sign-up and social logins | Microsoft Entra External ID (successor to Azure AD B2C) |
Protecting sign-ins
- Conditional Access (P1): require MFA, compliant devices, or block by location and risk.
- Identity Protection with risk-based policies (P2).
- PIM (P2): just-in-time privileged roles.
- Access reviews (P2 or ID Governance): recertify group and app access.
- Security defaults are a free baseline for small tenants with no custom policies.
Hybrid identity
Microsoft Entra Connect syncs on-premises AD to Entra ID. Choose password hash sync for simplicity and leaked-credential detection, pass-through authentication when passwords must be validated on-premises, and federation (AD FS) only when required. Entra Domain Services gives managed domain join and LDAP/Kerberos for lift-and-shift apps.
Exam traps
- SAML and OIDC are chosen by what the app supports, not by preference.
- Conditional Access needs P1. PIM and Identity Protection need P2.
- B2B is for partner and guest users. External ID (or B2C) is for customers.
- A Key Vault backup can be restored only within the same geography.
- Managed identities work only for Azure resources (and Arc-enabled servers). Apps elsewhere use an app registration.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. An Azure web app must read secrets from Key Vault without any credential stored in code or configuration. What should you use?
Show answer
Answer: B.A managed identity is created and rotated by Azure, so the app holds no secret. You grant it a role such as Key Vault Secrets User.
2. A legacy web app only understands a login form with a username and password, and cannot use SAML or OpenID Connect. Which SSO method in Entra ID fits?
Show answer
Answer: A.Password-based SSO stores credentials and fills the sign-in form. Use SAML or OIDC whenever the app supports them.
3. Partner employees need access to one internal app using their own corporate identities. What is the simplest design?
Show answer
Answer: B.B2B collaboration invites external users as guests who sign in with their own identity provider.
4. Users must be forced to use MFA only when signing in from outside the corporate network. What do you configure?
Show answer
Answer: B.Conditional Access (Entra ID P1) evaluates signals such as location, device and risk, then requires MFA.