Why Identity Protection?

In Azure, identity is the first line of defense. Attackers often target accounts rather than infrastructure because once inside, they can move laterally and escalate privileges.

Microsoft Entra ID (formerly Azure AD) provides identity protection mechanisms such as Conditional Access, Multi-Factor Authentication (MFA), and Privileged Identity Management (PIM) to reduce risks from compromised accounts and excessive privileges.

1. Conditional Access

Definition:
Policy-based engine that grants or blocks access based on conditions like user, device, location, and risk level.

Key Features:

• Require MFA for high-risk logins.

• Block legacy authentication protocols.

• Restrict access to compliant devices only.

• Enforce location-based restrictions (e.g., allow only EU IP ranges).

Example Policy:

• Require MFA if user signs in from outside corporate network.

• Block access from countries not used by the business.

2. Multi-Factor Authentication (MFA)

Definition:
Requires more than one factor to verify identity (something you know, have, or are).

Options in Azure:

• SMS/Phone call.

• Authenticator app push notification.

• FIDO2 security keys or biometric devices.

Best Practices:

• Enforce MFA for all admin roles.

• Require MFA for external users (B2B guests).

• Combine with Conditional Access for risk-based enforcement.

3. Privileged Identity Management (PIM)

Definition:
Manages, monitors, and controls access to privileged roles in Azure AD, RBAC, and resources.

Key Features:

• Just-in-Time (JIT) access → Admins get temporary elevation.

• Approval workflow → Access must be approved before activation.

• Time-bound access → Prevents standing privileges.

• Audit logs & alerts → Tracks privileged actions.

Use Cases:

• Global Admin role → only activated when needed.

• DB Admin → enabled for 2 hours during patching, then revoked automatically.

Example Enterprise Scenario

A healthcare organization requires:

• All admins must use MFA.

• Contractors must only access resources during working hours.

• Global Admin accounts should not have permanent privileges.

Correct design:

• Enforce MFA via Conditional Access for admins and contractors.

• Use Conditional Access to restrict access to business hours.

• Apply PIM for Global Admin with JIT activation.

Confusion Buster

• Conditional Access vs RBAC

  • Conditional Access = when/how users log in.

  • RBAC = what resources they can access once logged in.

• MFA vs Conditional Access

  • MFA = an authentication method.

  • Conditional Access = engine that enforces MFA dynamically.

• PIM vs RBAC

  • RBAC = static role assignment.

  • PIM = time-based, approval-based role activation.

Exam Tips

• “Which feature enforces MFA only when risk is high?” → Conditional Access.

• “Which Azure feature provides just-in-time admin role activation?” → PIM.

• “Which feature blocks legacy authentication protocols?” → Conditional Access.

• “Which method ensures admins don’t have standing privileges?” → PIM.

What to Expect in the Exam

• Direct Q: “Which feature enforces location-based access restrictions?” → Conditional Access.

• Scenario Q: “Admins must use MFA but regular users should not be impacted.” → Conditional Access policy.

• Scenario Q: “Contractor access must expire after 2 hours.” → PIM with time-limited assignment.

• Trick Q: “MFA is a Conditional Access policy.” → False (MFA is enforced by CA but is separate).