☁️
CTHFM: Azure
  • Welcome
  • Getting Started
    • Account Setup
      • Account Creation Instructions
  • Azure Fundamentals
    • Azure Fundamentals Overview
      • Azure Documentation
      • Azure Entra
      • Azure Hierarchy
      • Identities
      • Azure Entra Roles
      • Azure RBAC
      • Azure Licensing Overview
        • Azure Entra ID Premium Licenses Comparison
      • Azure Shared Responsibility Model
      • Azure Frameworks
      • Azure Security Services
      • Conditional Access Policies
        • How Conditional Access Policies Work
        • Benefits of Conditional Access
        • Best Practices for Conditional Access
        • Conditions for Conditional Access
        • Conditional Access Controls
        • Sign-In Risk and Identity Protection
        • Conditional Access Session Control
        • Name Locations IP Location
      • Azure Quotas
      • Azure Tokens
        • Access Tokens
        • ID Tokens
        • Refresh Tokens
          • Invalidate Refresh Tokens
        • Primary Refresh Tokens
        • Continuous Access Evaluation (CAE)
        • Token Protection: Conditional Access (Public Preview)
  • Azure CLI
    • Introduction to Azure CLI
    • Installing Azure CLI
    • CLI Commands
    • Resource Group Management
    • Creating and Managing Resources with Azure CLI
    • Managing IAM
    • Azure CLI Automation
    • Monitoring and Troubleshooting in Azure CLI
    • Azure CLI Overview
      • Azure CLI: Linux
      • Azure CLI: Windows
      • Azure CLI: MacOS
  • KQL
    • KQL Overview
      • KQL Introduction
      • Data Types
      • Quick Reference
      • Render
      • Basic Queries
  • Powershell
    • PowerShell for Azure
      • Powershell Documentation
      • Powershell Basics
      • Understanding Powershell Variables
      • Understanding Cmdlets
      • Powershell Console & ISE
      • Powershell: Entra Module
        • Module Reference & Getting Started
      • Powershell: Azure Module
        • Installation Instructions
        • Powershell Azure CLI: Windows
        • Powershell Azure CLI: Linux
        • Powershell Azure CLI: MacOS
        • Example Azure Cmdlets
  • Bicep
    • Bicep File Structure
    • Variable Types
  • Azure Logging References
    • Logging
      • Log Retention Strategies
      • Azure Log Types
      • Azure Activity Logs
        • Administrative Event Schema
        • Service Health Notification Schema
        • Resource Health
        • Alert Category
        • Autoscale
        • Security
        • Recommendation
        • Policy
      • Entra ID Logging
        • Identity Based Logs
          • Audit Logs
          • Sign-In Logs
            • AADNonInteractiveUserSignInLogs
            • AADManagedIdentitySignInLogs
            • AADServicePrincipalSignInLogs
            • First Party Sign-In Activity
          • Provisioning Logs (AADProvisioningLogs)
          • Microsoft Graph Activity
          • Identity Protection
            • Risk Detections
            • AADRiskyServicePrincipals
            • AADRiskyUsers
            • AADUserRiskEvents
            • AADServicePrincipalRiskEvents
        • Additional Entra ID Logs
      • Azure Key Vault
        • Azure Key Vault Logging Overview
      • Network Watcher
        • RBAC Permissions
        • Flow Log Types
          • NSG Flow Log Schema
          • VNET Flow Log Schema
        • Enabling Logs
          • NSG Flow Logs
          • VNET Flow Logs
        • Packet Capture
          • Packet Capture: VM
          • Packet Capture: Scale Sets
      • Compute Resources
        • Azure Monitor Agent
        • VM Insights
          • VM Insights Tables
      • Storage Accounts
        • Storage Account Logging
          • File
            • Enable StorageFileLogs
            • StorageFileLogs
          • Blob
            • Enable Blob Logging
            • StorageBlobLogs
          • Queue
            • Enable Queue Logging
            • StorageQueueLogs Table
          • Table
            • Enable Table Logging
            • StorageTableLogs Table
      • Azure App Service
        • Log Types
        • Enabling Logging
      • Azure Monitor
        • Resource Logs
          • Resource Log Top Level Documentation
        • Log Analytics Workspace
          • Setup
        • Workbooks
        • Dashboards
        • Alerts
        • Azure Monitor Documentation
      • Defender for Cloud
      • Intune
      • Sysmon
      • Purview Audit Log Schema
      • Kubernetes Audit Log (AKS)
  • Threat Hunting
    • Threat Hunting in Azure
      • Threat Hunting Introduction
      • Threat Hunting Process
        • Hypothesis Generation
        • Investigation
        • Identification
        • Resolution & Follow Up
      • Pyramid of Pain
      • Azure Threat Hunting Ideas
      • Hands On Threat Hunting Examples
      • OSINT Feeds
  • Sigma
    • Sigma Rule Structure
  • Microsoft Defender TI
    • Microsoft Defender Threat Intelligence
      • Data Sets
      • Reputational Scoring
      • Analyst Insights
      • Microsoft Defender TI: Copilot Integration
  • MITRE Att&ck
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Data Sources
      • MITRE Att&ck Mitigations
      • MITRE Att&ck: Azure
        • MITRE Att&CK: Azure Security Control Mapping
  • Microsoft Resources
    • Microsoft Incident Response Ninja Hub
    • Microsoft Defender XDR Ninja Hub
  • Azure Threat Research Matrix (ATRM)
  • Security Research & Resources
    • Azure Goat
    • Azure Security Research
      • Azure Related CVEs
  • Defender XDR
    • Defender XDR Overview
    • Defender XDR Licensing
    • Defender XDR Default Retention
    • Defender XDR Advanced Hunting Table Schemas
    • Automated Response Requirements
    • Supported Response Actions
  • Azure Sentinel
    • Sentinel Overview
    • Azure Sentinel Deployments
    • Supported Data
    • Workbook, Playbook, Notebook Comparison
    • Sentinel Workbooks
    • Entities
    • User and Entity Behavior Analytics
    • Anomaly Detection
    • Mult-Stage Attack Detection
    • Sentinel: Az CLI
  • Microsoft Defender
    • Microsoft Defender for Cloud References
    • Defender for Cloud: Az CLI
  • Azure Policy
    • Azure Policy
    • Azure Policy Components
    • Azure Policy Rules
    • Scope Azure Policy
    • Policy Assignments
    • Policy Effect
    • Initiative Definition
    • Policy Parameters
    • Remediation Task Structure
    • Use Cases for Azure Policy
    • Azure Policy: Az CLI
  • Intune
    • Intune Overview
    • Intune Licensing
    • Intune API Permission Scopes
    • Intune Sample Script Resources
  • Intune Logging
    • Configure Logging
    • Logging Schema References
    • Intune Queries and Resources
  • Windows Host Security
    • Windows System Architecture and OS Fundamentals
    • SysInternals
    • Basic vs Advanced Security Auditing
    • Sysmon
  • Adversary Emulation
    • AzureHound
    • AADInternals
      • Install
    • RoadTools
      • Install
    • Oh365UserFinder
    • GraphRunner
  • Incident Response
    • Incident Response
      • Azure IR Program Development Cheat Sheet
      • Azure IR Playbooks (MS Guidance)
      • Ransomware (MS Guidance)
  • Automation
    • Automation Overview
    • Logic Apps
      • How Logic Apps Work
      • Logic App Types
      • Triggers
      • Connectors
      • Conditional Logic and Control Flow
      • APIs in Logic Apps
      • Handling Large Workflows with Stateful Logic Apps
      • External Service Integration
      • Securing, Managing, and Scaling Azure Logic Apps
      • Logic Apps: Az CLI
  • Packet Analysis
    • Wireshark Cheatsheet
    • TShark Cheatsheet
    • TCPDUMP Cheatsheet
    • Protocol Analysis Basics
    • HTTP Response Code Cheatsheet
    • RFC Protocol Mappings
    • PCAP Acquisition
  • Detection Lab
    • Detection Lab Introduction
    • Account Creation Instructions
    • Enable MFA Within Azure Tenant
    • Create an Azure Admin With Cloud Shell
    • Setup and Install Instructions
  • VSCode and Code Setup
  • Deploying Code
  • Enabling Logs for Log Analytics Workspace
  • Logging Into Windows VM
  • Verifying Logs in Log Analytics Workspace
  • Creating Detections: Azure Monitor
  • Cost Management: Billing Alarms
Powered by GitBook
On this page
  • Overview
  • 1. User Identity
  • 2. Service Principal
  • 3. Managed Identity
  • 4. Workload Identity
  • 5. Application Identity
  • 6. Device Identity
  • 7. Guest Identity
  • 8. Group Identity
  • Key Use Cases for Each Identity Type:
  1. Azure Fundamentals
  2. Azure Fundamentals Overview

Identities

Overview

Azure supports various identity types, each designed to manage access and permissions for different resources and scenarios.

Here's an overview of the primary identity types in Azure:

1. User Identity

  • Description: This identity represents an individual user with an account in Azure Active Directory (Azure AD). These users can be employees, contractors, or external collaborators.

  • Use Case: User identities are used when a person needs to interact with Azure resources, such as logging into the Azure portal, accessing Office 365 apps, or managing cloud resources.

  • Example: A developer logging into the Azure portal to manage a virtual machine.

2. Service Principal

  • Description: A Service Principal is a non-human identity associated with an application or service that needs to access Azure resources. It is created automatically when you register an application in Azure AD.

  • Use Case: This is commonly used by applications, automation scripts, or services that need to authenticate and access resources programmatically. It ensures that applications can interact with resources without requiring user login.

  • Example: A CI/CD pipeline using a service principal to deploy infrastructure in Azure automatically.

3. Managed Identity

  • Description: Managed Identities are special types of identities assigned to Azure resources like VMs, App Services, or Azure Kubernetes Service (AKS) clusters. They allow these resources to authenticate and access other Azure resources securely, without storing credentials.

  • Types:

    • System-assigned: Automatically created and deleted when the resource is created or deleted.

    • User-assigned: A reusable managed identity that can be assigned to multiple resources.

  • Use Case: Ideal for securing communications between Azure resources by avoiding hardcoded credentials or secrets.

  • Example: A virtual machine that needs to access a storage account via its managed identity.

4. Workload Identity

  • Description: Workload Identity is a newer feature specifically designed for Kubernetes environments. It allows Kubernetes workloads to authenticate to Azure resources using Azure AD without needing secrets or certificates. It integrates Kubernetes Service Accounts (KSA) with Azure Active Directory.

  • Use Case: When workloads running in Azure Kubernetes Service (AKS) need secure access to other Azure services like Azure Key Vault or Blob Storage without storing secrets.

  • Example: A Kubernetes pod using its service account to authenticate to Azure Blob Storage.

5. Application Identity

  • Description: When you register an application in Azure AD, it is assigned an Application Identity, which is essentially the Service Principal tied to the application. This allows the app to authenticate and interact with Azure resources securely.

  • Use Case: This is used when an application needs to authenticate and access resources without user interaction. Applications can either act on their own behalf or on behalf of users.

  • Example: A web application that authenticates with Azure AD to retrieve user data from the Microsoft Graph API.

6. Device Identity

  • Description: This identity represents a physical device, such as a laptop or mobile device, registered with Azure AD. These devices can be controlled and managed as part of an organization's security policies.

  • Use Case: Device identities are used to enforce Conditional Access policies, ensuring that only compliant and secure devices can access organizational resources.

  • Example: A corporate laptop that complies with security policies and is used to access corporate email or internal applications.

7. Guest Identity

  • Description: Guest identities are external users who are invited to collaborate within an organization's Azure AD tenant. These users have limited access to resources compared to internal users.

  • Use Case: Used for B2B (business-to-business) collaboration where external partners, vendors, or contractors need access to specific resources.

  • Example: A contractor being granted access to an internal SharePoint site.

8. Group Identity

  • Description: Groups in Azure AD are collections of users that simplify the management of permissions. Instead of assigning permissions individually, you can assign them to a group.

  • Use Case: Ideal for role-based access control (RBAC), where permissions are assigned to a group of users that share similar responsibilities.

  • Example: A security group called "Developers" that has access to a resource group within Azure.

Key Use Cases for Each Identity Type:

  • User Identity: For individuals who need to interact with Azure resources manually (e.g., logging into the Azure portal).

  • Service Principal: For non-human users like applications or services that need to access resources programmatically.

  • Managed Identity: For securing communications between Azure resources without handling credentials (e.g., a VM accessing Azure Key Vault).

  • Workload Identity: For Kubernetes workloads needing secure access to Azure resources without storing secrets (e.g., a Kubernetes pod accessing Blob Storage).

  • Application Identity: For applications that need to authenticate to Azure AD and access resources on their own or on behalf of users.

  • Device Identity: For managing devices and ensuring only compliant devices can access corporate resources.

  • Guest Identity: For external users who need limited access to collaborate on specific resources.

  • Group Identity: For simplifying role management by assigning permissions to a group of users.

Last updated 8 months ago