• https://learn.microsoft.com/en-us/entra/identity/conditional-access/

• As a rule of thumb consider all Entra roles that are more than read-only as privileged roles.

There are a few different types of groups.

• Security Group
• Mail-enabled Security Group
• Microsoft 365 Group
• Security-enabled Microsoft 365 Group

A Security Group is used to grant permissions to resources and control access to applications, files, SharePoint sites, Azure resources, Conditional Access policies, DLP scopes, Lifecycle Workflows, PIM assignments, and more.

“Entra Workplace Join” (often shortened to Workplace Join) is Microsoft’s BYOD / light‑trust device registration model. In today’s terminology it is called a Microsoft Entra registered device (formerly Azure AD registered).

• https://idpowerapp.com/, Condition Access policy visualizer

• https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-package-eligible