Azure Administrator (AZ-104) - Identity & Governance

Microsoft's cloud-based identity and access management (IAM) service. It provides user authentication, single sign-on (SSO), and access control to Azure resources, Microsoft 365, and external SaaS applications.

A dedicated, isolated instance of Microsoft Entra ID created when an organization signs up for a Microsoft cloud service. It represents the organization's cloud identity directory.

Security Groups are used to assign permissions and access control to Azure resources and apps. Microsoft 365 Groups are built for team collaboration, providing shared mailboxes, calendars, files, and SharePoint sites.

Static membership requires manually adding or removing individual users. Dynamic membership uses rule syntax (e.g., user.department -eq "Sales") to automatically manage group membership based on user attributes.

Entra ID resources used to delegate administrative permissions over a subset of users, groups, or devices. They allow regional or departmental helpdesks to manage only their assigned scope.

Permissions inherit downward through four levels of hierarchy:
Management Group $\to$ Subscription $\to$ Resource Group $\to$ Resource.

Azure RBAC Roles grant permissions to manage Azure infrastructure resources (e.g., VMs, SQL databases, storage accounts). Microsoft Entra ID Roles grant permissions to manage directory-level resources (e.g., user accounts, domain names, licenses).

A user-defined role created via JSON or Azure Portal when built-in roles do not meet precise access control needs. Key JSON properties include Actions, NotActions, DataActions, NotDataActions, and AssignableScopes.