• AZ-500 Certification

Identity management is the new control plane.

Identity is the new perimeter.

• Identity Protection provides policies for a few common scenarios.
• These policies require an AAD P2 license
• https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policies
• These are under Azure AD/Manage/Security/Identity Protection/Protect and include these:
  • Azure AD MFA registration policy - requires users to register for MFA
  • Sign-in risk policy - a risk score is calculated to indicate the likelihood that a sign-in was not performed by the user. Based on this score administrators can choose to block access, allow access or allow access but require multi-factor authentication.
  • User risk policy - a risk score is calculate to indicate the likelihood that a user account has been compromised. Based on this score administrators can choose to block access, allow access or allow access but require a password change.

• Manage Azure Active Directory (Azure AD) identities
• Manage secure access by using Azure AD
• Manage application access
• Manage access control

• Hybrid Identity
• Enterprise Governance

• AAD Roles vs. ARM Roles
• https://techcommunity.microsoft.com/t5/itops-talk-blog/what-s-the-difference-between-azure-roles-and-azure-ad-roles/ba-p/2363647

Azure AD and Azure resources are secured independently from one another. That is, Azure AD role assignments do not grant access to Azure resources, and Azure role assignments do not grant access to Azure AD. However, if you are a Global Administrator in Azure AD, you can assign yourself access to all Azure subscriptions and management groups in your directory.

• https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin
• RBAC is generally thought of as being used to apply to the control plane, but it can also be used to apply to data plane operations.

The following are the four fundamental Azure AD administrator roles.

• Global Administrator
• User Administrator
• Helpdesk Administrator
• Billing Administrator

As the name suggests Azure Resource Manager roles are roles that apply to resources within an Azure tenant. Whereas Azure AD roles apply to the tenant itself.

The following are the four fundamental ARM roles.

• Owner
• Contributor
• Reader
• User Access Administrator