4.5. Reflection Checkpoint

Key Takeaways

• Choose workload identities by asking where the code runs and who must never touch a credential: managed identity for Azure resources (user-assigned when identity must outlive or span resources), service principal with certificate or federated credentials elsewhere, gMSA on-prem — and never a user account with an MFA exemption.
• Blueprint vs instance organizes everything app-shaped: registrations define the contract (audience, redirect URIs, credentials, permissions); enterprise applications hold the tenant's lived state (assignment, SSO mode and certificates, consent grants, ownership); App Proxy publishes on-prem web apps through outbound-only connectors with Entra pre-auth and KCD.
• Delegated permissions channel a present user's rights (scp, intersection rule); application permissions are the app's own standing power (roles, admin consent, client credentials) — and the same permission name means radically different blast radius across the two species.
• Defender for Cloud Apps runs the discover → sanction → connect → police loop: discovery from logs or MDE telemetry with catalog risk scores; session control only via Conditional Access routing (access policies gate entry, session policies govern activities); OAuth app policies audit the standing consent estate that user-consent settings alone can't clean up.

Connecting Forward

Phase 5 closes the loop that every grant in Phases 2–4 opened: entitlement management to make access requestable with expiration built in, access reviews to re-justify what exists, PIM to convert standing privilege into just-in-time activation, and the monitoring stack that proves any of it happened.

Self-Check Questions

• A GitHub Actions workflow deploys to Azure and must read a Key Vault; security bans stored cloud credentials in CI. Name the identity design (two acceptable variants), where each authenticates, and why a client secret fails the requirement even if vaulted.
• Users report a new SaaS tool demands permissions and IT never approved it. Trace the three control layers from this phase that determine (a) whether they could consent, (b) whether the grant is visible and revocable, (c) whether the session into it can be policed — naming the feature at each layer.
• Your API serves a mobile app (users book rooms) and a janitor service (nightly cleanup of stale bookings). Specify for each caller: permission species, OAuth flow, consent ceremony, and the claim your API validates.