Path 2 · Module 2
Design authentication and authorization solutions
Read the module on Microsoft Learn, then come back here: test yourself with the quiz and apply it in the design exercise. Write down what you want to remember with the ✎ Note buttons.
Step 1 · Read the module
Open Design authentication and authorization solutions on Microsoft Learn. The units:
- Introduction
- Design for identity and access management (IAM)
- Design for Microsoft Entra ID
- Design for Microsoft Entra business-to-business (B2B)
- Design for Azure Active Directory B2C (business-to-customer)
- Design for conditional access
- Design for identity protection
- Design for access reviews
- Design service principals for applications
- Design managed identities
- Design for Azure Key Vault
- Module assessment
- Summary and resources
Close the Learn tab. Answering from memory is what makes it stick; looking it up just measures how fast you can scroll.
Quiz
21 exam-style questions, roughly in the order of the units. Click an answer to see the explanation. Your best score is saved and shown on the path page; use Retry at the end to go again.
1. Which statement describes the Zero Trust approach to identity?
A. Zero Trust treats identity as the primary security perimeter and checks every request.
2. Users must sign in once and get access to Microsoft 365, Azure and 200 SaaS apps. What provides this?
C. Entra ID is the identity provider; apps integrated with it give users SSO.
3. On-premises AD users must sign in to Entra ID with the same password, and authentication must keep working if on-premises is down. Which option?
C. PHS validates in the cloud, so sign-in works without on-premises. PTA and federation depend on on-premises servers.
4. A partner company's employees need access to one internal app with their own work accounts. What do you design?
A. B2B invites external users as guests who authenticate with their own identity provider.
5. A consumer web shop needs sign-up with email, Google or Facebook accounts, and a branded sign-in page. Which service fits?
B. Customer-facing identity with social providers and custom branding is the B2C scenario.
6. Who controls the guest user's credentials in B2B collaboration?
C. Guests authenticate at home; you control only their access in your tenant.
7. Users must do MFA only when they sign in from outside the corporate network. What do you use?
D. Conditional Access evaluates signals like location and applies grant controls such as MFA.
8. Which is a signal (condition) in Conditional Access rather than a control?
B. Conditions are signals (user, location, device, app, risk). Grant controls are what happens (MFA, block, compliant device).
9. What should you always do before enforcing a new Conditional Access policy for all users?
D. Report-only shows the impact without blocking; break-glass accounts prevent locking everyone out.
10. Which Entra ID license is needed for Conditional Access?
D. Conditional Access needs P1. Risk-based conditions come from Identity Protection, which needs P2.
11. A user's credentials were found in a public leak. Which service detects this and can force a password change?
B. Leaked credentials raise user risk; a user risk policy can require a secure password change.
12. What's the difference between sign-in risk and user risk?
A. Sign-in risk: is this sign-in really the user (e.g. unfamiliar location)? User risk: is the account compromised (e.g. leaked credentials)?
13. Guest access to a project must be confirmed every quarter, and removed automatically if nobody confirms. What do you design?
D. Access reviews let owners or users attest to access; results can remove access automatically.
14. An app running on an Azure VM must read secrets from Key Vault without storing any credentials. What do you use?
A. Managed identities get tokens from Entra ID automatically; there's no secret to store or rotate.
15. Ten web apps need the same identity and permissions, and the identity must outlive any single app. Which type?
B. User-assigned identities are standalone resources you can share. System-assigned ones are tied to one resource's lifecycle.
16. An application running outside Azure (on-premises) needs to call Azure APIs. What identity does it use?
D. Managed identities only exist for Azure resources (and Arc). Apps elsewhere use a service principal, preferably with a certificate or federation.
17. What's the relationship between an app registration and a service principal?
A. One app object (in the home tenant), one service principal per tenant where the app is used.
18. Which Key Vault feature protects against accidental or malicious deletion of a vault and its secrets?
B. Soft delete keeps deleted items recoverable; purge protection prevents permanent deletion during the retention period.
19. Which is the recommended way to authorize access to Key Vault data?
D. Azure RBAC is the recommended permission model; access policies are the legacy model.
20. An application handles keys that must be protected by FIPS 140-3 Level 3 validated HSMs, single-tenant. Which option?
A. Managed HSM is a single-tenant, fully managed HSM pool. Key Vault Premium uses multi-tenant HSMs.
21. How do you design Key Vaults for multiple apps and environments?
A. Separate vaults per app and environment limit the blast radius and keep access simple.
Design exercise
On paper · about 25 minutes
Brightwater Insurance moves its claims platform to Azure.
- 3,000 employees in on-premises AD. Sign-in must keep working if the datacenter is unreachable.
- 200 external claims adjusters from partner firms need the claims portal with their own work accounts.
- Customers file claims on a public website and want to sign in with Google or email.
- The claims API runs on App Service and reads a database connection string and a signing certificate.
- Admins must use MFA always; employees only from outside the office or when the sign-in looks risky.
- Partner access must be checked every quarter.
-
Task
Design the identities
For employees, partners and customers: which identity solution and which sign-in method?
Done when- Each of the three user groups has a named service.
- Employee sign-in doesn't depend on on-premises.
Model answer
- Employees: Entra ID with Entra Connect (cloud sync) and password hash sync.
- Partners: Entra B2B guests, ideally via a cross-tenant access setting with each partner.
- Customers: Azure AD B2C / Entra External ID with Google and email local accounts.
-
Task
Write the Conditional Access and governance rules
List the Conditional Access policies (assignments, conditions, controls) and the access review.
Done when- Admins, employees and guests are covered.
- Break-glass accounts are excluded.
- The quarterly check is automated.
Model answer
- CA1: directory roles → all apps → require MFA (exclude break-glass).
- CA2: all users → not trusted location → require MFA.
- CA3: all users → sign-in risk medium+ → require MFA; user risk high → password change (Identity Protection, P2).
- CA4: guests → claims portal → require MFA, terms of use.
- Quarterly access review of the partner group, reviewers = sponsors, auto-apply removals. Start policies in report-only.
-
Task
Secure the API's secrets
How does the API get its connection string and certificate without storing credentials?
Done when- No secret in code or app settings.
- Access is least-privilege.
- Deletion is recoverable.
Model answer
Key Vault per environment, RBAC model, soft delete + purge protection, private endpoint. App Service uses a managed identity with Key Vault Secrets User (and Certificate User) on that vault; app settings use Key Vault references. Better still: connect to the database with the managed identity and drop the connection-string secret.