AZ-305 Authentication and Authorization solutions

Azure Recommendations for Authentication and Authorization Solutions

1. Recommend an Authentication Solution

Microsoft Entra ID is the cornerstone for secure authentication in Azure. Key recommendations include:

• Modern Authentication: Implement passwordless methods (FIDO2, Microsoft Authenticator) and enforce Multi-Factor Authentication (MFA) to reduce credential theft risks¹².
• Service Principals: Use these non-human identities to authenticate applications, scripts, or services without exposing user credentials. Service principals act as local representations of applications in each tenant, enabling secure access to resources³⁴.
  • Key Use Cases:
    • Automating CI/CD pipelines or DevOps workflows⁵⁴.
    • Cross-tenant access via Azure Lighthouse³⁶.

2. Recommend an Identity Management Solution

Microsoft Entra ID provides centralized identity management:

• Hybrid Identity: Synchronize on-premises Active Directory with Entra ID using Entra Connect¹⁶.
• Managed Identities: Prefer these over service principals for Azure-native resources (e.g., VMs, App Services) to eliminate credential management. Managed identities are automatically rotated and tied to the resource lifecycle⁴⁷⁸.
• Service Principals: Use for non-Azure or external applications (e.g., third-party tools) where managed identities are unavailable. Assign least-privilege RBAC roles to limit access⁹⁴.

3. Recommend a Solution for Authorizing Access to Azure Resources

Azure RBAC is the standard for authorization, augmented by management groups:

• Role Assignments: Assign roles (e.g., Contributor, Reader) at the management group level to enforce hierarchical inheritance. Policies and permissions cascade to all child subscriptions and resources¹⁰⁸.
  • Example: Assigning Reader at the root management group grants read access across all subscriptions¹⁰.
• Service Principals: Assign RBAC roles to service principals for automated workflows (e.g., granting Storage Blob Contributor to a DevOps pipeline’s service principal)⁵⁴.
• Best Practices:
  • Use groups instead of individual users for role assignments.
  • Limit management group hierarchy depth (max 6 levels) for simplicity¹⁰.

4. Recommend a Solution for Authorizing Access to On-Premises Resources

• Active Directory: Primary solution for local authorization.
• Azure Arc-enabled Servers: Extend Azure RBAC to on-premises/multi-cloud servers. Use service principals for secure onboarding and management¹¹⁶.
  • Assign Azure Connected Machine Onboarding role to service principals for at-scale server registration¹¹⁶.
• Hybrid Applications: Use Entra ID service principals to authenticate on-premises apps accessing Azure resources (e.g., APIs, storage)⁶¹².

5. Recommend a Solution to Manage Secrets, Certificates, and Keys

Azure Key Vault is the centralized solution for secrets management:

• Access Control: Use Azure RBAC (preferred) or Key Vault access policies. Assign roles at management group scope to inherit permissions across multiple vaults¹³¹⁴⁸.
• Service Principals & Managed Identities:
  • Grant managed identities access to Key Vault for Azure resources (e.g., VMs, Functions) to retrieve secrets securely¹⁵².
  • Use service principals for external applications requiring certificate/client secret authentication⁴⁸.
• Best Practices:
  • Enable logging and monitoring via Azure Monitor for audit trails¹⁵¹⁶.
  • Rotate secrets automatically and enforce least-privilege access¹⁵¹⁶.

Summary Table

Key References

• Service Principals: Enable secure application authentication and automation without user credentials³⁴¹².
• Management Groups: Simplify RBAC and policy enforcement across subscriptions via hierarchical inheritance¹⁰⁸.
• Azure Key Vault: Securely manage secrets with RBAC and automated rotation¹³¹⁵¹⁶.

By integrating these solutions, you achieve a secure, scalable, and governance-aligned authentication and authorization framework in Azure.

Summarised with Perplexity.