Azure Identity and Access Management Design Flashcards

A hybrid organization wants to sync on-premises Active Directory users to Azure AD. Which tool should you deploy?

Answer: Azure AD Connect

Azure AD Connect is the primary tool for synchronizing on-premises AD identities, groups, and attributes to Azure AD in a hybrid identity scenario.

Which Azure AD feature enables you to define and enforce organizational policies for application access based on conditions like device compliance?

Answer: Conditional Access

Conditional Access policies evaluate signals like user location, device compliance, and application sensitivity to grant, block, or require additional verification for access.

Your organization needs to allow customers to sign in using their social identities (Google, Facebook) to access a consumer app. Which Azure AD service should you use?

Answer: Azure AD B2C

Azure AD B2C is a customer identity and access management (CIAM) service that supports social identity providers like Google and Facebook for consumer-facing applications.

What is the recommended approach to assign Azure built-in roles to groups rather than individual users at scale?

Answer: Dynamic group membership with RBAC assignment

Using dynamic groups based on user attributes combined with RBAC role assignments to those groups enables scalable, automated access management without manual per-user assignments.

An application needs read access to a specific Azure Storage container. Which principle should guide the scope of the role assignment?

Answer: Principle of least privilege — assign at the container level

The principle of least privilege requires granting only the minimum permissions needed at the narrowest scope, so the role should be assigned at the specific container level.

Which Azure AD Access Review feature helps organizations ensure that users still need their current group memberships or application access over time?

Answer: Access Reviews

Access Reviews periodically prompt reviewers or users themselves to confirm whether access is still needed, helping remediate stale permissions and maintain compliance.