AZ-900 Identity and Security — Azure Entra ID and Zero Trust Guide 2026
Microsoft Entra ID (formerly Azure Active Directory)
Microsoft Entra ID is Microsoft's cloud-based identity and access management (IAM) service. Previously known as Azure Active Directory (Azure AD), it was rebranded to Microsoft Entra ID in 2026. For the AZ-900 exam, you may see both names — they refer to the same service.
Entra ID is the backbone of identity in Azure. It provides a central directory for managing users, groups, and applications. Unlike traditional on-premises Active Directory (which manages domain-joined machines on a local network), Entra ID is designed for cloud and hybrid environments, controlling access to cloud resources like Microsoft 365, Azure portal, and thousands of third-party SaaS applications.
Authentication vs Authorization
These two concepts appear repeatedly on the AZ-900 exam — understand the distinction clearly:
- Authentication (AuthN) — Verifying who you are. This is the process of proving your identity, typically with a username and password, biometrics, or a certificate. Example: logging in to the Azure portal with your credentials.
- Authorization (AuthZ) — Determining what you can do. After your identity is confirmed, authorization defines which resources you can access and what actions you can perform. Example: a user authenticated as a Contributor can deploy VMs but cannot delete subscriptions.
Entra ID handles both: it authenticates users with protocols like OAuth 2.0 and OpenID Connect, then uses RBAC to authorize resource access. Single Sign-On (SSO) is a key Entra ID feature — authenticate once and access multiple applications without re-entering credentials.
Role-Based Access Control (RBAC)
RBAC is the authorization system used across Azure to manage who has access to Azure resources, what they can do with those resources, and what areas they have access to. RBAC is built on three key concepts:
- Security principal — The entity requesting access: a user, group, service principal, or managed identity
- Role definition — A collection of permissions (e.g., read, write, delete). Azure has 70+ built-in roles, plus support for custom roles
- Scope — The boundary where the role applies: management group, subscription, resource group, or individual resource
Common built-in roles to know for AZ-900: Owner (full access, can assign roles), Contributor (can create/manage resources, cannot assign roles), Reader (view-only access), User Access Administrator (manages user access to Azure resources).
RBAC uses an additive permissions model — if a user has Reader on a subscription but Contributor on a specific resource group, they get the higher permission at that scope. Deny assignments override allows. See the Azure governance guide for how RBAC fits into the broader policy and management hierarchy.
Conditional Access and Multi-Factor Authentication (MFA)
Conditional Access is an Entra ID feature that enforces policies based on conditions — it's Azure's "if-then" engine for identity security. For example: if a user signs in from an unrecognized device in a foreign country, then require MFA or block access.
Common Conditional Access signals include: user or group membership, IP location, device compliance state, application being accessed, and real-time risk detection. Conditional Access is available in Entra ID P1 and P2 licenses.
Multi-Factor Authentication (MFA) adds a second verification factor beyond username and password. The three MFA factor categories are: something you know (password, PIN), something you have (authenticator app, SMS code, hardware token), and something you are (fingerprint, face recognition). Requiring MFA dramatically reduces account compromise risk — Microsoft reports MFA blocks over 99.9% of automated attacks.
Many readers pair this guide with the az 900 practice test to check their readiness before exam day.
Many readers pair this guide with the microsoft az 900 practice test to check their readiness before exam day.
How Identity and Security Appear on the AZ-900 Exam
Identity, security, and compliance make up 35–40% of the AZ-900 exam — the largest single domain. Questions in this domain test conceptual understanding, not hands-on configuration. Expect scenario-based questions where you must pick the right tool or explain the right concept.
Common question patterns:
- "Which Azure service provides centralized identity management?" → Microsoft Entra ID
- "A user needs to access Azure resources from multiple apps without logging in multiple times. What feature enables this?" → Single Sign-On (SSO)
- "Your security team wants to be alerted when a user logs in from an unusual location. Which service would you use?" → Microsoft Defender for Cloud or Conditional Access
- "Which role allows a user to create and manage Azure resources but not assign roles?" → Contributor
- "What Zero Trust principle states that you should not assume the internal network is safe?" → Assume Breach
Study tip: Learn the purpose of each tool, not just its name. The exam frequently asks you to select the right service for a given scenario. Practice with the AZ-900 practice tests to build pattern recognition for these question types. Also review the AZ-900 complete guide for the full exam breakdown and the exam tips for time management strategies.
Identity and security questions often pair with governance topics. Review the Azure governance guide to understand how Azure Policy, Blueprints, and management groups layer on top of RBAC. For service-level understanding, the Azure services guide covers how Entra ID integrates across compute, storage, and networking resources.
Microsoft Defender for Cloud
Microsoft Defender for Cloud (formerly Azure Security Center + Azure Defender) is a unified security management and threat protection platform. It provides two main capabilities: Cloud Security Posture Management (CSPM) — continuously assesses your Azure environment and provides a Secure Score with prioritized recommendations — and Cloud Workload Protection Platform (CWPP) — detects and responds to threats across VMs, containers, databases, and storage accounts.
Defender for Cloud works across Azure, on-premises, and other cloud providers (AWS, GCP). Key metric to know: the Secure Score, a percentage that represents your security posture. Higher score = better security.
Microsoft Sentinel
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It collects security data at cloud scale across users, devices, applications, and infrastructure — both on-premises and in multiple clouds. Sentinel uses AI and machine learning to detect threats, investigate them with built-in hunting tools, and respond with automated playbooks (using Azure Logic Apps).
Azure Key Vault
Azure Key Vault is a cloud service for securely storing and accessing secrets — API keys, passwords, certificates, cryptographic keys, and other sensitive configuration values. Applications retrieve secrets from Key Vault at runtime rather than storing them in code or config files. This centralizes secret management, enables rotation, and provides an audit log of all access. Key Vault integrates with Azure RBAC and Entra ID for fine-grained access control.
Azure DDoS Protection and Defense in Depth
Azure DDoS (Distributed Denial of Service) Protection defends Azure resources against volumetric network attacks. The Basic tier is enabled automatically for all Azure customers at no extra cost. The Standard tier (now called DDoS Network Protection) adds adaptive tuning, attack analytics, rapid response support, and SLA guarantees.
The Defense in Depth model describes a layered security approach where multiple independent security controls protect resources:
- Physical — Microsoft datacenter physical security (guards, badge access, cameras)
- Identity & Access — Entra ID, MFA, Conditional Access, RBAC
- Perimeter — DDoS protection, Azure Firewall, perimeter firewalls
- Network — Network segmentation, NSGs, VPN, ExpressRoute encryption
- Compute — VM endpoint protection, patch management, Defender for Servers
- Application — Secure application development, WAF, no stored secrets in code
- Data — Data encryption at rest and in transit, Key Vault, database access controls
On the exam, you may be asked to identify which layer a specific control belongs to, or to explain why defense in depth is better than relying on a single security measure.
AZ Checklist
Explain what Microsoft Entra ID is and how it differs from on-premises Active Directory Define authentication (AuthN) vs authorization (AuthZ) with examples Describe the three components of RBAC: security principal, role definition, and scope Name the four common built-in Azure roles and their permission levels Explain Conditional Access and give two examples of conditions that can trigger a policy List the three factors of MFA and give an example of each State the three Zero Trust principles and explain what each means in practice Describe what Microsoft Defender for Cloud does and what the Secure Score measures Explain the difference between Microsoft Sentinel and Defender for Cloud Describe what Azure Key Vault stores and why applications should use it List all 7 layers of the Defense in Depth model in order Explain the difference between DDoS Basic and DDoS Standard (Network Protection) Practice at least 2 full AZ-900 practice tests focused on security questions AZ Pros and Cons
Pros
- AZ-900 has a defined, publicly available content blueprint — candidates know exactly what to prepare for
- Multiple preparation pathways (self-study, courses, coaching) accommodate different learning styles and schedules
- A growing ecosystem of study resources means candidates at any budget level can access quality preparation materials
- Clear score reporting allows candidates to identify specific strengths and weaknesses for targeted remediation
- Professional recognition associated with strong performance provides tangible career and academic benefits
Cons
- The scope of tested content requires substantial preparation time that competes with existing professional or academic commitments
- No single resource covers the full content scope — candidates typically need multiple study tools for comprehensive preparation
- Test anxiety and exam-day performance variability mean preparation effort does not always translate linearly to scores
- Registration, preparation, and potential retake costs accumulate into a significant financial investment
- Content and format can change between exam versions, making older preparation materials less reliable
Pros and Cons at a Glance
| Pros | Cons |
|---|
| Multiple preparation pathways (self-study, courses, coaching) accommodate different learning styles and schedules | The scope of tested content requires substantial preparation time that competes with existing professional or academic commitments |
| A growing ecosystem of study resources means candidates at any budget level can access quality preparation materials | No single resource covers the full content scope — candidates typically need multiple study tools for comprehensive preparation |
| Clear score reporting allows candidates to identify specific strengths and weaknesses for targeted remediation | Test anxiety and exam-day performance variability mean preparation effort does not always translate linearly to scores |
| Professional recognition associated with strong performance provides tangible career and academic benefits | Registration, preparation, and potential retake costs accumulate into a significant financial investment |
Sample AZ-900 Practice Questions
Try these questions from our free AZ-900 practice tests. The correct answer and an explanation follow each question.
What is the core principle of the Zero Trust security model?
- A. Never trust, always verify
- B. Trust everything inside the network
- C. Encrypt only external traffic
- D. Allow all internal connections
Answer: A. Never trust, always verify
Zero Trust assumes breach and verifies every request as though it originates from an untrusted network.
What Azure service allows for the management of virtual networks, subnets, and network security groups?
- A. Azure Virtual Network
- B. Azure Load Balancer
- C. Azure Firewall
- D. Azure Traffic Manager
Answer: A. Azure Virtual Network
Azure Virtual Network (VNet) is the fundamental building block for your private network in Azure. It enables Azure resources, like VMs, to securely communicate with each other, the internet, and on-premises networks. VNet allows for the creation and management of virtual networks, subnets, IP addressing, and network security groups (NSGs) to control traffic flow and enhance security.
What is the term for Microsoft's identity and access management cloud service formerly called Azure Active Directory?
- A. Microsoft Entra ID
- B. Microsoft Defender
- C. Azure Sentinel
- D. Microsoft Intune
Answer: A. Microsoft Entra ID
Azure Active Directory was renamed Microsoft Entra ID and provides cloud identity and access management.
An organization wants a unified security management system that provides security posture recommendations and threat protection for their workloads running in Azure, on-premises, and in other clouds. Which Azure service provides these capabilities?
- A. Azure Monitor
- B. Microsoft Sentinel
- C. Microsoft Defender for Cloud
- D. Azure Firewall
Answer: C. Microsoft Defender for Cloud
Microsoft Defender for Cloud is a solution for cloud security posture management (CSPM) and cloud workload protection (CWPP). It identifies weaknesses across cloud configurations, helps strengthen the security posture, and protects workloads in multi-cloud and hybrid environments from threats.
Take the full AZ-900 practice test
AZ-900 Identity and Security Questions and Answers
What is Microsoft Entra ID and why was it renamed from Azure Active Directory?
Microsoft Entra ID is Microsoft's cloud-based identity and access management (IAM) service. It was renamed from Azure Active Directory (Azure AD) to Microsoft Entra ID in 2026 as part of Microsoft's broader Entra product family for identity and access. The name change reflects the expansion beyond just Azure — Entra ID manages identity across Microsoft 365, third-party SaaS apps, and custom applications, not only Azure resources. For the AZ-900 exam, both names are used and refer to the same service.
What is the difference between authentication and authorization in Azure?
Authentication (AuthN) is the process of verifying identity — proving you are who you claim to be, typically via username/password, MFA, or certificate. Authorization (AuthZ) is what happens after authentication — determining what resources and actions you are permitted to access. In Azure, Entra ID handles authentication (confirming your identity), while Azure RBAC handles authorization (defining what you can do once authenticated). A user can be authenticated but still unauthorized to access a specific resource.
What are the three principles of Zero Trust?
The three Zero Trust principles are: (1) Verify Explicitly — always authenticate and authorize using all available signals including identity, location, device health, and risk. (2) Use Least Privilege Access — grant only the minimum permissions needed, using just-in-time and just-enough-access approaches. (3) Assume Breach — operate as if a breach has already occurred; segment networks, minimize blast radius, and use encryption and analytics to detect threats. Zero Trust replaces the old perimeter-based "trust but verify" model.
What is the difference between Microsoft Defender for Cloud and Microsoft Sentinel?
Microsoft Defender for Cloud focuses on security posture management and workload protection — it assesses your Azure environment, provides a Secure Score, and detects threats on specific workloads like VMs and databases. Microsoft Sentinel is a SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) platform — it aggregates security signals from across your entire environment (including non-Azure sources), performs AI-driven threat detection, and automates responses with playbooks. Think of Defender for Cloud as the protector of individual Azure resources, and Sentinel as the central security operations center.
What does Azure Key Vault do and why should applications use it?
Azure Key Vault is a cloud service for securely storing secrets (passwords, API keys), encryption keys, and certificates. Applications should use Key Vault instead of storing sensitive values in code or configuration files because: (1) it centralizes secret management in one audited location, (2) secrets can be rotated without changing application code, (3) access is controlled via Entra ID and RBAC so only authorized apps and users can retrieve secrets, and (4) an audit log records every access attempt. This eliminates the common security risk of hardcoded credentials in source code.
What are the 7 layers of Defense in Depth?
From outermost to innermost: (1) Physical — datacenter physical security controls; (2) Identity & Access — Entra ID, MFA, RBAC, Conditional Access; (3) Perimeter — DDoS protection, Azure Firewall, perimeter firewalls; (4) Network — network segmentation, NSGs, VNet isolation; (5) Compute — VM patching, endpoint protection, Defender for Servers; (6) Application — secure development practices, WAF, no secrets in code; (7) Data — encryption at rest and in transit, Key Vault, database access controls. Each layer provides independent protection — an attacker who bypasses one layer still faces the remaining controls.