Short, honest write-ups of the ideas that come up in interviews and on the job. Each one teaches the concept properly, cites the Microsoft documentation, and points back to the class that drills it until it sticks.
Break-glass accounts first, then the canonical require-MFA policy, report-only mode before enforcement, and blocking legacy authentication. The rollout order that gets you to enforced MFA without the lockout story.
Azure splits identity from authorization; AWS IAM fuses both and hands you JSON policy; GCP binds roles to members on a resource. Same three letters, three genuinely different architectures — the biggest place the analogy leaks.
Standing admin access is the risk. PIM makes privilege eligible, time-bound, and approved. Eligibility, activation controls, access reviews, and why to keep very few Global Admins.
Legacy auth bypasses MFA entirely. Find it in the sign-in logs, block it with a Conditional Access policy, migrate the printers and service accounts that break. The other half of MFA.
Turning MFA on is step one. Enforce with Conditional Access, require phishing-resistant methods over SMS, block legacy auth, number matching, monitored break-glass. The handful that matter.
A client secret is a password that leaks and expires. Replace it: managed identity inside Azure, workload identity federation for external callers, a certificate only as a last resort.
Pass-through Authentication (PTA) validates a user's password against your on-prem Active Directory via a lightweight agent — the password never lands in the cloud. Here's PTA vs Password Hash Sync vs federation, the agent, the tradeoffs, and how to actually choose.
Entra ID now lets eligible password-only users enrol straight into a phishing-resistant passkey — skipping the weak SMS/voice step. The new flow, the supported credentials, the retirement timeline, and a 4-step checklist.
The portal where tenant identity lives — users, groups, roles, enterprise-app SSO, Conditional Access. Step-by-step least-privilege access and SSO setup.
P1 for everyone, P2 for admins — and what is already free. The Free/P1/P2 feature ladder, and how not to overbuy.
MFA is the what; Conditional Access is the when. Why you use both, Security Defaults versus CA, and the P1 licensing line.
One blueprint, one instance per tenant, one portal view. The mental model that finally makes Entra app identities click.
Same product, new name (July 2023) — nothing breaks. Why the rename, what stayed identical, and the old-to-new cheat sheet.
Active Directory works in Azure in three distinct, commonly confused ways. Untangle on-prem AD, Entra ID (formerly Azure AD), and Entra Domain Services in one sitting, plus where a cloud engineer meets each daily.
A correct password used to mean "you're in" — which is how accounts get breached. Conditional Access replaces that with a question: given who you are, where you are, and what you're on, should you get in, and on what terms?
They are the same identity underneath — but one hands you a password to guard and the other never does. Here is the difference, when to reach for each, and why the interview answer is almost always "managed identity."
One short, honest Azure note at a time — plus the occasional hiring signal. No spam, no card, unsubscribe in one click.