Azure Security Technologies (AZ-500) Study Notes

Identity & Access Management

Entra ID, PIM, Conditional Access, RBAC, and managed identities

Domain Weight

Manage identity and access accounts for 28% of the AZ-500 exam.

Identity is the primary security perimeter in Azure. AZ-500 heavily tests Entra ID configuration and privileged access management.

Microsoft Entra ID Core

Users, groups, dynamic groups — membership rules based on attributes
Hybrid identity — Entra Connect sync, pass-through auth, federated SSO
App registrations — OAuth2/OIDC for custom apps; service principals
Managed identities — system-assigned (lifecycle tied to resource) vs user-assigned (reusable)
Entra ID Governance — access packages, access reviews, entitlement management

Control	Purpose
Conditional Access	If user/location/device/app → require MFA, block, grant
PIM	Just-in-time privileged role activation with approval and audit
MFA	Second factor required — phone, authenticator, FIDO2
RBAC	Azure resource permissions — Owner, Contributor, Reader + custom roles

PIM vs Standing Access

PIM requires eligible assignment → activation → time-bound access → automatic deactivation. Eliminates always-on admin accounts.

Exam Focus Areas

Conditional Access evaluates signals: user, location, device compliance, app
Managed identities eliminate stored credentials in application code
Azure RBAC is for Azure resources; Entra roles are for directory

Practice This Domain

Test your understanding with free practice questions at /certifications/microsoft/az-500/practice — focus on: Microsoft Entra ID configuration, Microsoft Entra ID Governance, Privileged Identity Management (PIM).

Read AZ-500 notes without distractions

Open Foci to run a focused study block while you review domains, tables, and exam tips.

Focus while reading