☁️
CTHFM: Azure
  • Welcome
  • Getting Started
    • Account Setup
      • Account Creation Instructions
  • Azure Fundamentals
    • Azure Fundamentals Overview
      • Azure Documentation
      • Azure Entra
      • Azure Hierarchy
      • Identities
      • Azure Entra Roles
      • Azure RBAC
      • Azure Licensing Overview
        • Azure Entra ID Premium Licenses Comparison
      • Azure Shared Responsibility Model
      • Azure Frameworks
      • Azure Security Services
      • Conditional Access Policies
        • How Conditional Access Policies Work
        • Benefits of Conditional Access
        • Best Practices for Conditional Access
        • Conditions for Conditional Access
        • Conditional Access Controls
        • Sign-In Risk and Identity Protection
        • Conditional Access Session Control
        • Name Locations IP Location
      • Azure Quotas
      • Azure Tokens
        • Access Tokens
        • ID Tokens
        • Refresh Tokens
          • Invalidate Refresh Tokens
        • Primary Refresh Tokens
        • Continuous Access Evaluation (CAE)
        • Token Protection: Conditional Access (Public Preview)
  • Azure CLI
    • Introduction to Azure CLI
    • Installing Azure CLI
    • CLI Commands
    • Resource Group Management
    • Creating and Managing Resources with Azure CLI
    • Managing IAM
    • Azure CLI Automation
    • Monitoring and Troubleshooting in Azure CLI
    • Azure CLI Overview
      • Azure CLI: Linux
      • Azure CLI: Windows
      • Azure CLI: MacOS
  • KQL
    • KQL Overview
      • KQL Introduction
      • Data Types
      • Quick Reference
      • Render
      • Basic Queries
  • Powershell
    • PowerShell for Azure
      • Powershell Documentation
      • Powershell Basics
      • Understanding Powershell Variables
      • Understanding Cmdlets
      • Powershell Console & ISE
      • Powershell: Entra Module
        • Module Reference & Getting Started
      • Powershell: Azure Module
        • Installation Instructions
        • Powershell Azure CLI: Windows
        • Powershell Azure CLI: Linux
        • Powershell Azure CLI: MacOS
        • Example Azure Cmdlets
  • Bicep
    • Bicep File Structure
    • Variable Types
  • Azure Logging References
    • Logging
      • Log Retention Strategies
      • Azure Log Types
      • Azure Activity Logs
        • Administrative Event Schema
        • Service Health Notification Schema
        • Resource Health
        • Alert Category
        • Autoscale
        • Security
        • Recommendation
        • Policy
      • Entra ID Logging
        • Identity Based Logs
          • Audit Logs
          • Sign-In Logs
            • AADNonInteractiveUserSignInLogs
            • AADManagedIdentitySignInLogs
            • AADServicePrincipalSignInLogs
            • First Party Sign-In Activity
          • Provisioning Logs (AADProvisioningLogs)
          • Microsoft Graph Activity
          • Identity Protection
            • Risk Detections
            • AADRiskyServicePrincipals
            • AADRiskyUsers
            • AADUserRiskEvents
            • AADServicePrincipalRiskEvents
        • Additional Entra ID Logs
      • Azure Key Vault
        • Azure Key Vault Logging Overview
      • Network Watcher
        • RBAC Permissions
        • Flow Log Types
          • NSG Flow Log Schema
          • VNET Flow Log Schema
        • Enabling Logs
          • NSG Flow Logs
          • VNET Flow Logs
        • Packet Capture
          • Packet Capture: VM
          • Packet Capture: Scale Sets
      • Compute Resources
        • Azure Monitor Agent
        • VM Insights
          • VM Insights Tables
      • Storage Accounts
        • Storage Account Logging
          • File
            • Enable StorageFileLogs
            • StorageFileLogs
          • Blob
            • Enable Blob Logging
            • StorageBlobLogs
          • Queue
            • Enable Queue Logging
            • StorageQueueLogs Table
          • Table
            • Enable Table Logging
            • StorageTableLogs Table
      • Azure App Service
        • Log Types
        • Enabling Logging
      • Azure Monitor
        • Resource Logs
          • Resource Log Top Level Documentation
        • Log Analytics Workspace
          • Setup
        • Workbooks
        • Dashboards
        • Alerts
        • Azure Monitor Documentation
      • Defender for Cloud
      • Intune
      • Sysmon
      • Purview Audit Log Schema
      • Kubernetes Audit Log (AKS)
  • Threat Hunting
    • Threat Hunting in Azure
      • Threat Hunting Introduction
      • Threat Hunting Process
        • Hypothesis Generation
        • Investigation
        • Identification
        • Resolution & Follow Up
      • Pyramid of Pain
      • Azure Threat Hunting Ideas
      • Hands On Threat Hunting Examples
      • OSINT Feeds
  • Sigma
    • Sigma Rule Structure
  • Microsoft Defender TI
    • Microsoft Defender Threat Intelligence
      • Data Sets
      • Reputational Scoring
      • Analyst Insights
      • Microsoft Defender TI: Copilot Integration
  • MITRE Att&ck
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Data Sources
      • MITRE Att&ck Mitigations
      • MITRE Att&ck: Azure
        • MITRE Att&CK: Azure Security Control Mapping
  • Microsoft Resources
    • Microsoft Incident Response Ninja Hub
    • Microsoft Defender XDR Ninja Hub
  • Azure Threat Research Matrix (ATRM)
  • Security Research & Resources
    • Azure Goat
    • Azure Security Research
      • Azure Related CVEs
  • Defender XDR
    • Defender XDR Overview
    • Defender XDR Licensing
    • Defender XDR Default Retention
    • Defender XDR Advanced Hunting Table Schemas
    • Automated Response Requirements
    • Supported Response Actions
  • Azure Sentinel
    • Sentinel Overview
    • Azure Sentinel Deployments
    • Supported Data
    • Workbook, Playbook, Notebook Comparison
    • Sentinel Workbooks
    • Entities
    • User and Entity Behavior Analytics
    • Anomaly Detection
    • Mult-Stage Attack Detection
    • Sentinel: Az CLI
  • Microsoft Defender
    • Microsoft Defender for Cloud References
    • Defender for Cloud: Az CLI
  • Azure Policy
    • Azure Policy
    • Azure Policy Components
    • Azure Policy Rules
    • Scope Azure Policy
    • Policy Assignments
    • Policy Effect
    • Initiative Definition
    • Policy Parameters
    • Remediation Task Structure
    • Use Cases for Azure Policy
    • Azure Policy: Az CLI
  • Intune
    • Intune Overview
    • Intune Licensing
    • Intune API Permission Scopes
    • Intune Sample Script Resources
  • Intune Logging
    • Configure Logging
    • Logging Schema References
    • Intune Queries and Resources
  • Windows Host Security
    • Windows System Architecture and OS Fundamentals
    • SysInternals
    • Basic vs Advanced Security Auditing
    • Sysmon
  • Adversary Emulation
    • AzureHound
    • AADInternals
      • Install
    • RoadTools
      • Install
    • Oh365UserFinder
    • GraphRunner
  • Incident Response
    • Incident Response
      • Azure IR Program Development Cheat Sheet
      • Azure IR Playbooks (MS Guidance)
      • Ransomware (MS Guidance)
  • Automation
    • Automation Overview
    • Logic Apps
      • How Logic Apps Work
      • Logic App Types
      • Triggers
      • Connectors
      • Conditional Logic and Control Flow
      • APIs in Logic Apps
      • Handling Large Workflows with Stateful Logic Apps
      • External Service Integration
      • Securing, Managing, and Scaling Azure Logic Apps
      • Logic Apps: Az CLI
  • Packet Analysis
    • Wireshark Cheatsheet
    • TShark Cheatsheet
    • TCPDUMP Cheatsheet
    • Protocol Analysis Basics
    • HTTP Response Code Cheatsheet
    • RFC Protocol Mappings
    • PCAP Acquisition
  • Detection Lab
    • Detection Lab Introduction
    • Account Creation Instructions
    • Enable MFA Within Azure Tenant
    • Create an Azure Admin With Cloud Shell
    • Setup and Install Instructions
  • VSCode and Code Setup
  • Deploying Code
  • Enabling Logs for Log Analytics Workspace
  • Logging Into Windows VM
  • Verifying Logs in Log Analytics Workspace
  • Creating Detections: Azure Monitor
  • Cost Management: Billing Alarms
Powered by GitBook
On this page
  • Overview
  • 1. Identity Management:
  • 2. Authentication:
  • 3. Conditional Access:
  • 4. Access Control:
  • 5. Security and Monitoring:
  • 6. Business-to-Business (B2B) and Business-to-Consumer (B2C):
  • 7. Integration with Microsoft 365 and Other Services:
  • 8. Zero Trust Security Model:
  • 9. Compliance and Governance:
  • Microsoft Entra Documentation
  1. Azure Fundamentals
  2. Azure Fundamentals Overview

Azure Entra

Overview

Microsoft Entra ID, formerly known as Azure Active Directory (Azure AD), is a cloud-based identity and access management solution from Microsoft. It plays a critical role in managing the identities of users, applications, and resources across both cloud and hybrid environments. Below is a more detailed explanation of its key components and features:

1. Identity Management:

Entra ID provides centralized identity management for users, groups, devices, and applications. This ensures that identities are managed consistently across Microsoft services like Microsoft 365, Azure, and third-party SaaS apps. The goal is to provide secure, seamless access to the right resources, whether hosted on-premises or in the cloud.

  • User Identities: Entra ID helps manage user accounts, providing a single identity across various Microsoft services and integrated applications. This single identity simplifies both user experience and IT management.

  • Group Management: Admins can manage groups, set up group-based access to resources, and automate memberships through dynamic groups based on user attributes.

  • Device Management: Devices can be registered and joined to Entra ID, helping organizations secure corporate data by enforcing policies on the registered devices.

2. Authentication:

Entra ID provides multiple authentication mechanisms to ensure secure access.

  • Multi-Factor Authentication (MFA): Adds an additional layer of security by requiring more than just a password, such as a verification code or biometric data.

  • Passwordless Authentication: Offers options like Windows Hello, the Microsoft Authenticator app, and FIDO2 security keys, reducing reliance on passwords, which are often a security risk.

  • Single Sign-On (SSO): Users can sign in once and gain access to multiple applications without having to repeatedly enter their credentials. This not only improves user experience but also strengthens security.

3. Conditional Access:

Conditional Access is a powerful tool in Entra ID that allows administrators to enforce access policies based on various conditions such as user identity, location, device state, and risk levels.

  • Conditional Access Policies: Admins can create policies that define when users can access specific resources. For example, policies can block access from certain geographic regions or require MFA when accessing sensitive applications.

  • Risk-Based Access Control: Entra ID uses risk detection to automatically assess the security of sign-in attempts. For instance, if an attempt looks suspicious (e.g., based on impossible travel or risky IP addresses), the system can enforce additional controls like MFA or deny access altogether.

4. Access Control:

Entra ID offers extensive access control features, allowing organizations to enforce security at different levels.

  • Role-Based Access Control (RBAC): Admins can assign roles that define what level of access a user has to specific resources. This helps ensure users only have the permissions they need for their roles.

  • Privileged Identity Management (PIM): PIM allows admins to manage, control, and monitor privileged access to ensure that high-level permissions are only granted when necessary and for a limited time.

5. Security and Monitoring:

Entra ID integrates multiple security features and monitoring tools to help organizations protect their environment.

  • Identity Protection: This feature leverages machine learning to detect and respond to identity-related threats, such as compromised credentials or risky sign-ins.

  • Access Reviews: Organizations can regularly review access rights for users, ensuring that only the necessary people have access to sensitive resources.

  • Audit Logs and Reports: Detailed logs of sign-ins, user actions, and system activity are available for monitoring and auditing, which helps with compliance and security oversight.

6. Business-to-Business (B2B) and Business-to-Consumer (B2C):

Entra ID offers capabilities for managing external identities.

  • B2B Collaboration: Allows organizations to securely share applications and services with external partners. External users can use their own credentials to sign in, and Entra ID will manage access.

  • B2C Identity Management: This is a customer-facing identity service, enabling organizations to manage the authentication and sign-in experience for consumers across applications. Businesses can customize sign-in pages and policies to tailor the experience to their customers’ needs.

7. Integration with Microsoft 365 and Other Services:

Entra ID tightly integrates with Microsoft 365 (formerly Office 365), Dynamics 365, and other Microsoft cloud services. It is also widely supported by thousands of third-party applications and on-premises systems, making it a comprehensive identity solution for hybrid environments.

8. Zero Trust Security Model:

As part of Microsoft's Zero Trust architecture, Entra ID is designed to assume that no user or device is inherently trusted, even if they are inside the network. Identity is treated as the new security perimeter, and robust authentication, least-privilege access, and continuous monitoring are key principles of this model. Entra ID enforces these principles by ensuring that every request for access is authenticated, authorized, and validated based on security context.

9. Compliance and Governance:

Entra ID helps organizations comply with various regulatory requirements by offering built-in tools for governance and access reviews. Features like PIM, conditional access, and detailed logging help organizations meet industry-specific standards such as GDPR, HIPAA, and ISO 27001.

Microsoft Entra Documentation

Last updated 8 months ago

Microsoft Entra documentationMicrosoftLearn
Logo