Azure Solutions Architecture — Authentication & Authorization: Entra ID, RBAC & Conditional Access

Azure Solutions Architecture · AZ-305 · Security & Identity · by Raushan Ranjan, MCT

Authentication and authorization are the cornerstones of a secure application. Authentication confirms a user's identity ("Who are you?"), while authorization determines what that user is allowed to do ("What are you allowed to do?"). These concepts are managed through a central identity and access management (IAM) platform.

1. Identity and Access Management

Recommended Identity Management Solution: Microsoft Entra ID

• What it is: Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based IAM service. It's a comprehensive solution for managing user identities, groups, and application access.
• Why it's the right choice: Entra ID is a multi-tenant service, meaning it can securely manage identities for your employees, external partners, and customers within a single platform. It provides a single sign-on (SSO) experience for users to access various applications and services, both within Azure and for third-party SaaS apps. This centralized management model is efficient and secure.

Specific Identity Solutions for Different Users

• Employees and Internal Users: Use the core features of Microsoft Entra ID to manage employee identities. For hybrid environments, sync on-premises identities with the cloud using Microsoft Entra Connect. This is the standard for managing your workforce's access.
• External Partners (Business-to-Business, B2B): Use Microsoft Entra B2B. This is designed for secure collaboration with external partners, vendors, or suppliers. Instead of creating new accounts for them in your directory, you simply invite them as "guest users." They can then use their own company's credentials to access your resources, and you retain full control over their permissions. This streamlines collaboration and reduces identity management overhead.
• Customers (Business-to-Consumer, B2C): Use Microsoft Entra ID B2C. This is a customer identity and access management (CIAM) solution for public-facing applications. It allows customers to sign up and log in using various methods, including social accounts (like Google or Facebook) or a local email/password account. B2C is built to handle millions of users and is perfect for e-commerce or mobile applications.

2. Authorization Solutions

Once a user is authenticated, you need to decide what resources they can access.

Solution for Authorizing Access to Azure Resources

• The Problem: Manually granting permissions to every user for every resource is time-consuming and prone to error. It often leads to "privilege creep," where users accumulate more permissions than they need.
• The Solution: Role-Based Access Control (RBAC). RBAC is a system that allows you to manage permissions based on a user's role. You grant permissions to a role (e.g., "Contributor" or "Reader") and then assign that role to a user or group. This ensures users have the Principle of Least Privilege, only having the access they need to perform their jobs.

Service Principals for Applications

• What they are: A service principal is a non-human identity for an application or automated process to authenticate and access Azure resources.
• The Problem: An application needs to perform actions on your behalf (e.g., write data to a database or deploy a virtual machine), but it can't use a user's credentials.
• The Solution: You create a service principal in Entra ID and grant it the necessary RBAC permissions. It's like giving your application a secure, digital ID card with specific permissions to access certain parts of your Azure environment. The credentials for the service principal are managed securely. The recommended approach is to use Managed Identities, which is a special type of service principal where Azure automatically manages the credentials, removing the need for a developer to handle secrets.

3. Security and Governance

Conditional Access

• What it is: Conditional Access is a powerful security feature that enforces policies based on context. It's the "if-then" statement for authentication.
• The Problem: You want to ensure that a user isn't logging in from a risky location, or that a privileged user always uses multi-factor authentication (MFA).
• The Solution: Conditional Access policies evaluate a user's login attempt in real-time. You can create rules like: "IF a user is in the 'Administrators' group AND they are logging in from a public IP address, THEN require MFA." This provides dynamic security controls that adapt to the context of the login attempt.

Identity Protection

• What it is: Identity Protection is a feature that uses machine learning to detect potential identity-based risks.
• The Problem: How do you know if a user's credentials have been compromised?
• The Solution: Identity Protection analyzes billions of signals to detect suspicious activities, such as logins from infected devices, anonymous IP addresses, or impossible travel (e.g., a user logs in from New York and then from Tokyo five minutes later). It can then automatically take action, like blocking the login or forcing a password reset.

Access Reviews

• What it is: Access Reviews are a systematic way to audit user permissions.
• The Problem: How do you ensure that users still need the permissions they were granted months or years ago?
• The Solution: Access Reviews automate the process of periodically verifying user access. You can schedule a review of all users in a specific group (e.g., the "Finance" group), and the group owner will be notified to review and approve or revoke each user's access. This helps prevent privilege creep and ensures compliance.

4. Managing Secrets, Certificates, and Keys

Solution for Managing Secrets: Azure Key Vault

• What it is: Azure Key Vault is a secure, centralized store for secrets, certificates, and cryptographic keys.
• The Problem: Developers often hard-code secrets (like database passwords or API keys) directly into their application code, which is a major security risk.
• The Solution: Instead of hard-coding, developers store secrets in Key Vault. Applications can then securely retrieve the secret at runtime using a Managed Identity. This ensures secrets are never exposed in the code, and a central security team can manage their lifecycles, like automatic rotation. Key Vault is the industry standard for this practice.