1.3. Identity as the New Perimeter
💡 First Principle: Traditional security assumed a hard network edge — a firewall separating a trusted "inside" from an untrusted "outside" — but once employees work from anywhere and applications live in the cloud, that edge stops meaningfully existing, so the question "who is this, and should they be allowed to do this?" (identity) becomes the control point that actually matters.
Picture the old model: a corporate office with a locked front door. Once you're inside the building, you're trusted — you can walk into any unlocked room. Cloud computing removes the building entirely. Users connect from home Wi-Fi, coffee shops, and phones, and the applications they're reaching live in a Microsoft datacenter, not down the hall. There's no "inside the building" left to trust. What replaces the locked front door is verifying identity at every single access attempt, regardless of where that attempt comes from — which is why this guide spends an entire domain (Phase 3, Microsoft Entra) on identity capabilities, and why Zero Trust (Phase 2) treats identity as a foundational signal rather than a one-time login check.
This doesn't mean networks and firewalls became irrelevant — Phase 4 covers plenty of network-layer protection. It means identity became the first and most consistently reliable layer, because it travels with the user no matter what network they're on, while a firewall only protects the network it's attached to.
⚠️ Exam Trap: Don't assume "identity as the perimeter" means network security no longer matters. The exam still tests NSGs, Azure Firewall, and WAF in Phase 4 — identity is the primary perimeter, not the only layer of defense.
Reflection Question: An employee connects from an airport lounge to a cloud application. There is no corporate network in between. What single signal does the system have left to decide whether to trust this connection?
