1.5. Reflection Checkpoint

Key Takeaways

• Identity is the control plane of modern security: verify explicitly, grant least privilege, and assume breach — every Entra product family implements one of those three moves.
• Keep the containers straight: tenant = identity boundary (one directory, one set of policies); subscription = resource/billing container that trusts one tenant. Everything administrable is an object — user, group, device, or application — and "security principal" covers them all.
• Authentication proves who you are (factors, MFA, phishing-resistant methods); authorization decides what you may do (role + principal + scope); Conditional Access is the checkpoint between them.
• Tokens make it all portable: ID tokens sign users into apps, access tokens authorize API calls, refresh tokens renew silently — and lifetimes/revocation/CAE govern how fast a policy change or offboarding actually bites.

Connecting Forward

Phase 2 takes the largest exam domain — authentication and access management — and builds directly on this foundation: the factor ladder becomes the authentication methods policy, the authn→authz checkpoint becomes Conditional Access policy anatomy, and token-refresh mechanics become session controls and continuous access evaluation.

Self-Check Questions

• A contractor's account is disabled at 9:00 AM, yet they successfully download files from a legacy (non-CAE) app at 9:40 AM. Explain the mechanism — and the two administrative actions that would have closed the window faster.
• Your CISO asks why the company needs both Entra roles and Azure RBAC when "roles are roles." Give the one-sentence distinction and an example task from each system.
• An app's sign-in works, but its calls to Microsoft Graph return authorization errors. Using the claims from 1.4.3, which token and which claim would you inspect first, and why?