Why Identity Security Matters

In cloud environments, identity is the new security perimeter. Most breaches start with compromised credentials, so protecting accounts with more than just usernames and passwords is critical. Azure provides advanced identity security tools in Entra ID (formerly Azure AD) to enforce conditional access, detect risky sign-ins, and secure privileged accounts.

1. Conditional Access (CA)

Definition:
A policy engine that decides whether to allow, block, or challenge access based on conditions.

Conditions Supported:

• User or group membership.

• Device state (compliant, hybrid joined).

• Location (IP ranges, countries).

• Application (specific app targeted).

• Risk level (from Identity Protection).

Access Controls:

• Require MFA.

• Require compliant device.

• Require password change.

• Block access outright.

Use Cases:

• Require MFA when logging in from outside corporate network.

• Block legacy authentication protocols.

• Allow access only from compliant devices.

2. Azure AD Identity Protection

Definition:
Detects and responds to suspicious sign-ins and risky user behavior.

Risk Types:

• Sign-in risk → unusual sign-in patterns (impossible travel, unfamiliar IPs).

• User risk → account may be compromised.

Automated Responses:

• Force password reset.

• Block sign-in until admin reviews.

• Trigger MFA challenge.

Example:
If a user logs in from New York and 5 minutes later from Tokyo, Identity Protection flags “impossible travel.”

3. Privileged Identity Management (PIM)

Definition:
A just-in-time (JIT) solution for managing privileged role assignments in Entra ID and Azure resources.

Key Features:

• Time-bound access → roles expire after duration.

• Approval workflows for role activation.

• MFA required for elevation.

• Audit logs of who elevated when.

Use Cases:

• Protect Global Admin accounts.

• Grant temporary Contributor access for a project.

• Enforce “least privilege” model.

4. Example Enterprise Scenario

A healthcare provider requires:

• Doctors accessing EMR apps must use MFA outside hospital network.

• Risky sign-ins (impossible travel) must be blocked automatically.

• IT staff should not have permanent Global Admin — only temporary elevation when needed.

Correct design:

• Conditional Access → Require MFA for offsite access.

• Identity Protection → Block risky sign-ins, force password reset.

• PIM → JIT Global Admin access with approval workflow.

5. Confusion Buster

• Conditional Access vs Identity Protection

  • CA = enforces rules based on policies (preventive).

  • Identity Protection = detects suspicious sign-ins (reactive + preventive).

• PIM vs RBAC

  • RBAC = defines static roles.

  • PIM = manages temporary elevation for RBAC roles.

• Legacy Authentication

  • Often exam trap → must be blocked with Conditional Access, since it bypasses MFA.

6. Exam Tips

• “Which service enforces rules like MFA by location?” → Conditional Access.

• “Which service detects risky logins such as impossible travel?” → Identity Protection.

• “Which service provides JIT admin access with approval workflows?” → Privileged Identity Management.

• “Which feature should be used to block legacy protocols that bypass MFA?” → Conditional Access.

7. What to Expect in the Exam

• Direct Q: “Which feature enforces MFA for users accessing from unmanaged devices?” → Conditional Access.

• Scenario Q: “Company wants JIT admin access to prevent standing privileges.” → PIM.

• Scenario Q: “System must detect impossible travel and block login.” → Identity Protection.

• Trick Q: “RBAC automatically provides time-bound access.” → False (that’s PIM).