• AZ-500 Certification
• Identity & Access Management

• Configure Azure AD Privileged Identity Management (PIM)
• Implement Conditional Access policies, including multifactor authentication
• Implement Azure AD Identity Protection
• Implement passwordless authentication
• Configure access reviews

• Azure Privileged Identity Management

Identity Protection is a tool that allows organizations to accomplish three key tasks:

• Automate the detection and remediation of identity-based risks.
• Investigate risks using data in the portal.
• Export risk detection data to third-party utilities for further analysis.
• Requires an AAD P2 license

AAD has three Identity Protection policies by default:

• MFA authentication registration policy
• User risk remediation policy
• Sign-in risk policy

The signals generated by and fed to Identity Protection, can be further fed into tools like Conditional Access to make access decisions, or fed back to a security information and event management (SIEM) tool for further investigation based on your organization's enforced policies.

The risk signals can trigger remediation efforts such as requiring users to: perform Azure AD Multi-Factor Authentication, reset their password using self-service password reset, or blocking until an administrator takes action.

• User risk is a calculation of probability that an identity has been compromised.
• Administrators can choose to block access, allow access, or allow access but require a password change using Azure AD self-service password reset
• https://docs.microsoft.com/en-us/learn/modules/azure-ad-identity-protection/4-user-risk-policy

• As a best practice it is recommended to require MFA and this policy does that.

• Sign-in risk represents the probability that a given authentication request isn't authorized by the identity owner.
• Identity Protection analyzes signals from each sign-in, both real-time and offline, and calculates a risk score based on the probability that the sign-in wasn't performed by the user. Administrators can decide based on this risk score signal to enforce organizational requirements. Administrators can choose to block access, allow access, or allow access but require multi-factor authentication.

AAD detects the following types of risks. The P2 license gives the most detail info, while the P1 license doesn't include all the details.

• Users with leaked credentials
• Sign-ins from anonymous IP addresses
• Impossible travel to atypical locations
• Sign-ins from infected devices
• Sign-in from unfamiliar locations
• Sign-ins from IP addresses with suspicious activity

• https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview
• Conditional Access is a capability that takes in various signals and determines whether a given user should be granted access to resources.
• Conditional Access requires a AAD P1 license, but the risk-based policy capabilties requires a P2 license

• When organizations both include and exclude a user or group the user or group is excluded from the policy, as an exclude action overrides an include in policy.

• Requires an Azure AD P2 license