Before anyone may do anything in Azure, it must be settled who they are and what they may do. These are two separate questions. Authentication answers "Who are you?", authorization answers "What may you do?". In this lesson you see which services in Azure answer the first question and which answers the second.

The example is the made-up company Nordlicht Reisen GmbH: employees in the office, a partner agency that is to access individual documents, and an old booking application that depends on a Windows server with a domain.

Directory services: Entra ID and Entra Domain Services

Microsoft Entra ID (formerly Azure Active Directory) is the cloud-based service for identity and access management. It holds the accounts of users, groups and devices and checks their sign-in to Microsoft 365, Azure and many other applications. Whoever uses Microsoft 365 or Azure already has an Entra tenant, that is, the organization's own directory.

Microsoft Entra Domain Services is something different. The service provides a managed domain like the ones you know from classic Windows networks: with domain join, Group Policy, LDAP and sign-in by Kerberos and NTLM. Microsoft runs the domain controllers, so you don't have to set them up and patch them. The users and groups come from Entra ID through one-way synchronization. The service is intended for older applications that need these old protocols and can't be changed easily.

Microsoft Entra ID Microsoft Entra Domain Services
What for Sign-in to cloud and modern applications Managed domain for older applications
Protocols modern, internet-suited Kerberos, NTLM, LDAP
Operation Microsoft runs the service Microsoft runs the domain controllers
Example at Nordlicht Sign-in to the booking portal Old booking application that keeps running in Azure

How sign-in works

Three terms belong to signing in to Azure:

Single sign-on (SSO) means: sign in once, use many applications. The application sends the user to Entra ID, where the user is verified, and the application receives the confirmation. There are fewer passwords, fewer support inquiries, and access management sits in one place.

Multifactor authentication (MFA) demands more than a password. Microsoft names three kinds of proof: something you know (a password), something you have (a phone or a hardware key) and something you are (a fingerprint or face scan). MFA demands two or more of them. A stolen password alone is then not enough.

Passwordless sign-in leaves out the password entirely. Microsoft supports, among others, Windows Hello for Business (biometrics or a PIN on your own PC), the Microsoft Authenticator app (confirmation on the phone) and FIDO2 security keys (an external key). That is more convenient and harder to phish, because there is no password to steal.

External identities

Nordlicht wants the partner agency to be able to view documents without IT creating an account with a password for every person. For that there is Microsoft Entra External ID. Two cases are important:

  • B2B collaboration (business-to-business): You invite guests. They sign in with their own credentials, such as the account of their company or a social account. A user object is created in the directory, typically of the type guest. You don't have to manage foreign accounts and passwords.
  • Applications for end customers: Whoever builds an application for consumers or business customers manages their accounts in an external tenant of its own, separate from the directory of the employees.

Conditional Access: access under conditions

Conditional Access from Microsoft Entra is the rules engine for access. In the simplest case a policy is an if-then statement: If someone wants to access an application, then they must do something. For example: If someone accesses Microsoft 365 from outside the company network, then they must perform multifactor authentication.

Signals include membership in a user group, the network location, the state of the device, the target application and detected risks. The decision can be to allow access, to tie it to conditions or to block it. The policies take effect only after the first factor, usually the password, has been verified. Conditional Access is therefore not a first line of defense against denial-of-service attacks.

Azure RBAC: Who may do what?

Signing in establishes who someone is. Which Azure resources they may manage is regulated by Azure RBAC (role-based access control). A role assignment consists of three parts:

  1. The security principal is who gets the access: a user, a group, a service principal (the identity of an application) or a managed identity.
  2. The role definition is a collection of permissions, the role for short. You know three basic roles: Owner may manage everything, including access, Contributor may manage everything except access, Reader may view everything but change nothing. In addition there are many special built-in roles and custom roles.
  3. The scope says where the role applies: management group, subscription, resource group or single resource.

The scopes stand in a hierarchy, and permissions are inherited downward. Whoever has the Reader role on a subscription can read all resource groups in it. Several assignments add up. Whoever is Contributor for a subscription and Reader for a group in it has Contributor rights overall. As a rule of thumb, the principle of least privilege applies: only what someone needs for their work, and in the smallest possible scope.

Exercise 1

The Nordlicht Reisen GmbH has a subscription with the resource groups booking and marketing. Distribute these accesses and name the fitting service or role, including the scope:

  1. The marketing team is to be allowed to create and change everything in the marketing group, but not assign rights.
  2. The audit department is to view everything in the subscription but change nothing.
  3. The partner agency is to view a document without accounts being created for them.
  4. Signing in to the booking management from outside the office is to demand a second confirmation.

Solution 1
  1. Contributor for the Marketing group, assigned at the scope of the resource group marketing. Contributor may manage everything except access.
  2. Reader at the scope of the subscription. The role is inherited downward and applies to all resource groups in it.
  3. Entra External ID with B2B collaboration. The agency staff are invited as guests and sign in with their own credentials. Afterward they get, for example, the Reader role on the one resource.
  4. Conditional Access: If the access comes from outside the company network, then MFA is required.