Almost everything else you'll do in Azure eventually runs into a permissions question — can this user see that resource, can this app talk to that database, does this pipeline need a password at all. This module builds the identity foundation those questions get answered against.
It starts with Microsoft Entra ID (formerly Azure Active Directory), the directory that every user, group, and application identity in your tenant lives in. From there it covers role-based access control (RBAC) — how Azure decides what a given identity is actually allowed to do, using security principals, role definitions, and scope — and service principals and managed identities, the two ways non-human identities like apps and automation authenticate to Azure without a developer having to manage a password. It closes with multi-factor authentication and Conditional Access, the policy engine that decides when a sign-in needs extra verification.
Watch the lessons in order, then continue on to Compute Services.
Microsoft Mechanics walks through the fundamentals of Microsoft Entra ID: authentication vs. authorization, users, groups and roles, Conditional Access, dynamic groups, and single sign-on to non-Microsoft clouds.
Episode 6 of Microsoft's official AZ-104 series covers Azure role-based access control: security principals, role definitions, scope, and how the three combine into a role assignment.
A real-demo comparison of the two ways applications and automation authenticate to Azure resources — when to reach for a service principal versus a system- or user-assigned managed identity.
A full walkthrough of identity administration in Microsoft Entra: managing users and groups, authentication and access management, app access, and identity governance — a comprehensive tour that ties this module's concepts together and doubles as certification prep.