3.3. Access Management Capabilities of Microsoft Entra ID

💡 First Principle: Access management capabilities decide, in real time, whether an already-authenticated identity should actually be granted access to a specific resource right now — taking into account signals authentication alone can't see, like device health, location, and the sensitivity of what's being accessed.

Why care: authentication only answers "who is this." Access management answers the authorization half of Phase 2's core distinction, dynamically, using context that changes moment to moment — this is where Zero Trust's "verify explicitly" principle becomes a concrete, configurable policy engine rather than just a philosophy.

⚠️ Common Misconception: Thinking of access decisions as a fixed, static list, exactly like a traditional file permission. Conditional Access, covered next, evaluates access dynamically, at the moment of each request.