Azure Administrator (AZ-104) - Identity & Governance Flashcards

Question 1

What is Microsoft Entra ID (formerly Azure Active Directory)?

Accepted Answer

Microsoft's cloud-based identity and access management (IAM) service. It provides user authentication, single sign-on (SSO), and access control to Azure resources, Microsoft 365, and external SaaS applications.

Question 2

What is an Azure AD / Microsoft Entra Tenant?

Accepted Answer

A dedicated, isolated instance of Microsoft Entra ID created when an organization signs up for a Microsoft cloud service. It represents the organization's cloud identity directory.

Question 3

Security Groups vs. Microsoft 365 Groups

Accepted Answer

`Security Groups` are used to assign permissions and access control to Azure resources and apps. `Microsoft 365 Groups` are built for team collaboration, providing shared mailboxes, calendars, files, and SharePoint sites.

Question 4

Static Assignment vs. Dynamic Membership in Microsoft Entra Groups

Accepted Answer

`Static` membership requires manually adding or removing individual users. `Dynamic` membership uses rule syntax (e.g., `user.department -eq "Sales"`) to automatically manage group membership based on user attributes.

Question 5

What are Administrative Units (AUs)?

Accepted Answer

Entra ID resources used to delegate administrative permissions over a subset of users, groups, or devices. They allow regional or departmental helpdesks to manage only their assigned scope.

Question 6

What is the Azure RBAC Scope Hierarchy?

Accepted Answer

Permissions inherit downward through four levels of hierarchy:
`Management Group` $\rightarrow$ `Subscription` $\rightarrow$ `Resource Group` $\rightarrow$ `Resource`.

Question 7

Difference between Azure RBAC Roles and Microsoft Entra ID Roles

Accepted Answer

`Azure RBAC Roles` grant permissions to manage Azure infrastructure resources (e.g., VMs, SQL databases, storage accounts). `Microsoft Entra ID Roles` grant permissions to manage directory-level resources (e.g., user accounts, domain names, licenses).

Question 8

What is an Azure Custom RBAC Role?

Accepted Answer

A user-defined role created via JSON or Azure Portal when built-in roles do not meet precise access control needs. Key JSON properties include `Actions`, `NotActions`, `DataActions`, `NotDataActions`, and `AssignableScopes`.

Question 9

What is Azure Policy?

Accepted Answer

An Azure service used to create, assign, and manage policies that enforce organizational rules and standards across Azure resources to ensure compliance (e.g., restricting VM sizes or allowed locations).

Question 10

What is an Azure Policy Initiative?

Accepted Answer

A collection of multiple Azure Policy definitions grouped together to simplify assignment and management toward a single business goal (e.g., regulatory compliance benchmarks like ISO 27001).

Question 11

Azure Policy Effects

Accepted Answer

Defines what happens when a policy rule is evaluated as true:
- `Audit`: Logs a non-compliance event.
- `Deny`: Blocks resource creation/update.
- `Append`: Adds required fields to resources.
- `Modify`: Adds, updates, or removes tags/properties.
- `DeployIfNotExists`: Deploys a specified resource if it doesn't exist.

Question 12

What are Azure Management Groups?

Accepted Answer

Containers above subscriptions that provide a governance scope. Policies, RBAC role assignments, and budgets applied to a management group are automatically inherited by all nested subscriptions (supports up to 6 levels of depth).

Question 13

Resource Locks: ReadOnly vs. Delete (CanNotDelete)

Accepted Answer

- `ReadOnly`: Authorized users can read resources, but cannot modify or delete them.
- `CanNotDelete`: Authorized users can read and modify resources, but cannot delete them.

Question 14

What is Conditional Access in Microsoft Entra ID?

Accepted Answer

An automated, signal-based policy tool that uses "if-then" statements (analyzing user identity, IP location, device state, and application) to grant, block, or require additional security steps (like MFA) before allowing access.

Question 15

What are the core components of a Conditional Access policy?

Accepted Answer

1. **Assignments**: Users/Groups, Cloud Apps/Actions, and Conditions (Locations, Device Platforms, Risk levels).
2. **Access Controls**: Grant options (Require MFA, Require Compliant Device, Require Hybrid Join) or Block Access.

Question 16

How can Multi-Factor Authentication (MFA) be enforced in Azure?

Accepted Answer

1. **Conditional Access Policies**: Highly customizable enforcement (requires Entra ID P1/P2).
2. **Security Defaults**: Free basic protection for all tenants that enforces MFA for all users/admins.
3. **Per-User MFA**: Legacy method enabling MFA directly on individual user accounts.

Question 17

What is Self-Service Password Reset (SSPR)?

Accepted Answer

A Microsoft Entra ID feature that allows end users to reset or unlock their passwords without helpdesk intervention, using configured authentication methods (SMS, Mobile App, Email).

Question 18

What is Microsoft Entra Connect?

Accepted Answer

An identity sync tool installed on-premises that connects local Active Directory Domain Services (AD DS) to Microsoft Entra ID, creating a single hybrid identity system.

Question 19

What is the function of Azure Cost Management Budgets and Alerts?

Accepted Answer

Allows admins to set spending limits over specified evaluate periods for subscriptions or resource groups and triggers automated email notifications when actual or forecasted spending breaches defined percentage thresholds.

Question 20

How do Azure RBAC Deny Assignments work?

Accepted Answer

Deny assignments explicitly prevent a user from performing specific actions, regardless of inherited grant roles. Unlike grant assignments, custom deny assignments cannot be manually created; they are applied automatically by Azure system features like Azure Managed Applications.

Azure Administrator (AZ-104) - Identity & Governance

Card Preview

Related Flashcard Sets

Midterm #1 Formulas

French A1 - Basic Greetings & Everyday Phrases

Rust Programming Language - Ownership, Borrowing & Lifetimes

Molecular Biology - DNA Replication & Repair Mechanisms