1.1.1. Identity as the New Perimeter
💡 First Principle: When the network boundary stops being trustworthy, identity has to do the job the firewall used to do — it becomes the primary control point for deciding what's allowed to happen next.
This is why SC-500's highest-weighted individual skill group is securing access through Microsoft Entra ID, not network security. A user's (or an application's, or now an AI agent's) verified identity is what every downstream decision hangs off: which Conditional Access policy applies, whether Privileged Identity Management requires activation, whether a managed identity can reach a Key Vault secret. Get identity wrong and every control built on top of it — network rules included — is reasoning about the wrong thing.
⚠️ Exam Trap: A resource sitting on a private network with no public IP is not automatically "secure" if its identity controls are weak. SC-500 scenario questions frequently describe a network-hardened resource with an overprivileged managed identity or an overly permissive app registration attached to it — the network configuration is a distractor; the real gap is identity.
Reflection Question: If a virtual machine has no public IP address and sits inside a locked-down subnet, what identity-related question should you still ask before calling it secure?
