Identity & Access Management Entra ID, PIM, Conditional Access, RBAC, and managed identities
Domain Weight Manage identity and access accounts for 28% of the AZ-500 exam.
Identity is the primary security perimeter in Azure. AZ-500 heavily tests Entra ID configuration and privileged access management.
Microsoft Entra ID Core Users, groups, dynamic groups — membership rules based on attributes Hybrid identity — Entra Connect sync, pass-through auth, federated SSO App registrations — OAuth2/OIDC for custom apps; service principals Managed identities — system-assigned (lifecycle tied to resource) vs user-assigned (reusable) Entra ID Governance — access packages, access reviews, entitlement management Control Purpose Conditional Access If user/location/device/app → require MFA, block, grant PIM Just-in-time privileged role activation with approval and audit MFA Second factor required — phone, authenticator, FIDO2 RBAC Azure resource permissions — Owner, Contributor, Reader + custom roles
PIM vs Standing Access PIM requires eligible assignment → activation → time-bound access → automatic deactivation. Eliminates always-on admin accounts.
Exam Focus Areas Conditional Access evaluates signals: user, location, device compliance, app Managed identities eliminate stored credentials in application code Azure RBAC is for Azure resources; Entra roles are for directory Practice This Domain Test your understanding with free practice questions at /certifications/microsoft/az-500/practice — focus on: Microsoft Entra ID configuration, Microsoft Entra ID Governance, Privileged Identity Management (PIM).
