AZ-900 Entra ID and Conditional Access — the credential that is not a key

Who you are, then what you may. The directory is not a password file.

<!-- hal:authoritative:yaml -->

Who you are, then what you may. The directory is not a password file.

§I — Frame: the skill area 08-11 left on the table

The first Microsoft fire, 11 August, took the hierarchy and the governance spine. Management groups, subscriptions, resource groups, RBAC as a governance verb, Policy, locks, composite SLA. Identity sat in that lesson as a referenced Bootcamp chapter and as a currency note: the clone says Azure Active Directory, the objectives say Microsoft Entra ID.

The published skill area that lesson did not teach is the one the study guide lists under architecture and services (35-40%): Describe Azure identity, access, and security. Verified again this morning against learn.microsoft.com. Skills measured as of 2026-07-20. Pass score 700. Three domain weights unchanged: cloud concepts 25-30%, architecture and services 35-40%, management and governance 30-35%. The identity bullets, in the guide's own order:

• Directory services: Microsoft Entra ID and Microsoft Entra Domain Services
• Authentication methods: single sign-on, multifactor authentication, passwordless
• External identities
• Microsoft Entra Conditional Access
• Azure role-based access control
• Zero Trust
• Defense-in-depth
• Microsoft Defender for Cloud

Key Vault is not a named bullet in that list. The Bootcamp and the core-services cheatsheet still treat it as the store for secrets, keys, and certificates. Today's Ops lesson is the Python door into that store. Today's exam lesson is the directory that issues the token the door accepts.

Coin: the credential that is not a key. A user, a managed identity, a workload identity. Not a password taped to the Function app settings.

This lesson does not reopen management groups, composite SLA, Policy, or locks. RBAC returns only as the authorization half after Entra has already authenticated.

§II — Domain foundations: who you are, then what you may

The Bootcamp opens the identity chapter with a two-line split (az-900 README, Authentication vs Authorization). Authentication confirms the identity of a user, a device, or a system. Authorization, after that confirmation, decides what the authenticated party may do.

Hold the order. A Conditional Access policy that demands MFA is an authentication decision. An RBAC assignment that grants Key Vault Secrets User is an authorization decision. The exam loves a stem that swaps the two words. The tell is the question being asked. "Prove you are X" is AuthN. "X may get secrets on this vault" is AuthZ.

Microsoft Entra ID is the cloud directory. Users, groups, applications, service principals, managed identities live there. Sign-in to the Azure portal, to Microsoft 365, to thousands of SaaS apps that trust Entra, all go through this directory. The core-services cheatsheet row is one clause: "Identity, SSO, MFA" (azure-core-services.md, Security & Identity). That is the exam depth for the product itself.

Microsoft Entra Domain Services is a different product. It is a managed domain for legacy applications that still want LDAP, NTLM, or Kerberos. It is not "Entra ID with a longer name." A stem that says "lift a line-of-business app that binds to LDAP" is Domain Services. A stem that says "sign in to the Azure portal with MFA" is Entra ID.

On-premises Active Directory Domain Services is a third thing. Azure AD Connect (the clone's name; the current product family is Microsoft Entra Connect) synchronizes on-premises identities into Entra so the same person has one identity in both worlds. The Bootcamp sentence: Azure AD Connect synchronizes your on-premises directories (az-900 README, Azure AD Connect). Hybrid identity is the reason that sentence exists. The exam will not ask you to configure a sync rule. It will ask which tool makes an on-premises user able to sign in to cloud apps.

Three directories, three jobs. Entra ID is the cloud identity plane. Entra Domain Services is managed legacy protocol. On-prem AD DS plus Connect is the hybrid bridge. Coin a handle if it helps: the directory that is not a domain. Entra ID does not Domain-Join your laptop unless Domain Services is in the picture.

§III — Authentication methods, external identities, Conditional Access

Single sign-on. One successful authentication, many applications. The Bootcamp Core Cloud Concepts section already named SSO as Entra's job (az-900 README, Single Sign-On). The identity chapter repeats it: users sign in once and reach Microsoft 365, the Azure portal, and the organization's own cloud apps. The exam stem is usually "reduce password fatigue" or "one identity across SaaS." The answer is SSO via Entra, not a shared password vault.

Multifactor authentication. Something you know, something you have, something you are. A password plus the Authenticator app. A password plus a FIDO2 key. The azurecheatsheet line is "Adds a second verification layer." That is enough for AZ-900. The exam will not grade you on TOTP versus push. It will grade you on "password only is one factor" versus "password plus a phone prompt is two."

Passwordless. Windows Hello, FIDO2 security keys, the Authenticator app as the only factor. The current objectives list passwordless next to SSO and MFA. The clone's identity chapter does not give it a heading. Study the current name. A stem that says "sign in with a hardware key and no password" is passwordless, not "MFA with the password left blank."

External identities. People outside the tenant. B2B: a guest user from another Entra tenant, invited, appearing in your directory with a guest user type, reaching the apps you grant. B2C: customers of an application you own, signing up with their own social or local accounts, not becoming members of your workforce tenant. The exam wants the distinction, not the blade clicks. Guests are B2B. Shoppers are B2C.

Conditional Access. Policies that evaluate a sign-in and demand an extra action, or block it. Typical conditions: user or group, application, location, device compliance, risk. Typical grants: require MFA, require a compliant device, require a password change, block. The 08-11 governance spine had Policy (what shape a resource may have) and locks (what may change). Conditional Access is not Azure Policy. It is an Entra sign-in gate. A stem about "require MFA when the sign-in comes from outside the office" is Conditional Access. A stem about "deny public storage accounts" is Azure Policy. Do not mix the two on the exam.

Conditional Access is also the place Zero Trust becomes a setting. Zero Trust's slogan is never trust, always verify. A policy that re-checks device compliance on every sign-in to the finance app is that slogan with a name and a scope.

§IV — Authorization, Zero Trust, defense-in-depth, Defender, the store

RBAC, the second time. 08-11 taught RBAC as one of four governance answers: who may do what, scoped to management group, subscription, resource group, or resource. Today the same assignment sits after Entra has issued a token. The token is AuthN. The role is AuthZ. Built-in roles the exam still likes: Owner, Contributor, Reader, and the data-plane cousins (Key Vault Secrets User, Storage Blob Data Reader). Custom roles exist. AZ-900 will not ask you to write one.

A managed identity is an Entra object the platform attaches to a resource. System-assigned: one identity, tied to that resource's life. User-assigned: a standalone identity you attach to many resources. The Function that reads Key Vault with DefaultAzureCredential and no AZURE_CLIENT_SECRET is this object doing AuthN. The Secrets User assignment on the vault is AuthZ. The credential that is not a key is the managed identity. The key would have been a client secret in app settings.

Zero Trust. Verify explicitly. Use least privilege. Assume breach. Three statements, not a product you buy. Conditional Access is one control. RBAC least-privilege is another. Defender for Cloud recommendations are a third. A stem that asks "which model assumes a breach and verifies every request" is Zero Trust. A stem that asks "which service scores your security posture" is Defender for Cloud.

Defense-in-depth. The Bootcamp already named it under Core Cloud Concepts: a series of mechanisms that slow an attack (az-900 README, Defense-in-depth). The identity layer is one of those mechanisms. Physical, identity, perimeter, network, compute, application, data. Key Vault sits at the data layer as the place secrets live. Entra sits at the identity layer as the place tokens are issued. A DDoS attack is a perimeter story. An NSG is a network story. Do not put Key Vault on the perimeter layer in a layered-model question.

Microsoft Defender for Cloud. Cloud security posture management plus workload protection. Recommendations, secure score, threat detection for the resources you have turned on. The clone and the azurecheatsheet still say Azure Security Center. The objectives say Microsoft Defender for Cloud. Same product family, current name. Azure Sentinel / Microsoft Sentinel is a SIEM the cheatsheet still lists; it is not in the current identity bullet list. Do not spend study time on Sentinel playbooks for this exam.

Key Vault, at exam depth. Three nouns: secrets, keys, certificates (az-900 README, Azure Key Vault; azure-core-services.md, one row). Applications retrieve at run time instead of storing a password in code. Access is Entra plus RBAC (or the older access-policy model). Soft-delete and purge protection exist; AZ-900 will at most ask "where do you store a database password." The answer is Key Vault. The Ops lesson is the Python that honors that answer without printing the password.

§V — Currency corrections, and the three-cloud map

The az-900 clone names Azure Active Directory throughout. The azurecheatsheet says AAD. The objectives name Microsoft Entra ID. Study Entra. If a practice stem still says Azure AD, treat it as Entra.

The clone's governance chapter still treats Azure Blueprint as an instrument. 08-11 already recorded that the current objectives omit Blueprints. Do not restudy them.

Security Center is Defender for Cloud. Sentinel is out of the identity bullet list. Azure Information Protection in the clone is Microsoft Purview Information Protection in the current naming, and Purview sits in the governance domain (08-11's side), not in today's identity bullets.

Cross-cloud, because the rotation has now sat all four seats once and this is the second Azure pass:

The false friend is "IAM." AWS IAM is accounts, users, roles, policies. Azure's closest split is Entra (identities) plus RBAC (resource permissions). Do not call Entra "Azure IAM" on the exam.

§VI — Exam drills

§VII — Connection to today's Ops and Dev lessons, and closing

Ops constructed SecretClient(vault_url, DefaultAzureCredential()) and listed properties. The walker is AuthN. The role assignment is AuthZ. AZURE_CLIENT_SECRET in the environment is a key that walked in; the coin refuses it.

Dev taught __repr__ and field(repr=False). The exam will not ask about dunders. The operator who fetches secret.value and logs the object has spent the coin the identity lesson just defined. The print is a second leak of the same password Key Vault was meant to hold.

08-11 stays the hierarchy and the governance spine. Today stays the directory, the sign-in, the assignment after the token, and the store the token opens. Two visits, two domains, one vendor.

The Bootcamp Azure AD Connect Health heading exists next to Connect. AZ-900 will not ask you to read a sync-health blade. Know that Connect is the sync tool. Health is the monitoring add-on. Spend the minute on Entra versus Domain Services instead.

Examine a practice stem that says "Azure AD" or "Security Center." Translate it. Then answer.

Related

• Prior arc: AZ-900 resource hierarchy / governance spine (2026-08-11)
• Domain hub: Cross-References/domains/Cert-Prep
• Grounding: AZ-900 Bootcamp — Identity and Security · Azure Core Services — Security & Identity