2. Manage Identity, Access, and Governance (20-25%)

Phase 1 established that identity is the primary control point once the network perimeter stops being trustworthy. This phase makes that concrete: Microsoft Entra ID for access decisions, Azure Key Vault for the secrets those access decisions ultimately protect, and Azure governance tooling for making sure both stay configured the way you intended at scale — not just on the day you set them up.