3.5. Reflection Checkpoint

Key Takeaways

• Microsoft Entra ID is a cloud-native identity provider and directory, distinct from on-premises Active Directory Domain Services, though hybrid identity keeps the two in sync.
• Identity types now extend beyond human users to service principals, managed identities, and agent IDs for AI agents — each governed differently.
• Passwordless and phishing-resistant methods (FIDO2, Windows Hello for Business) are stronger than SMS/voice MFA, which Microsoft is de-emphasizing.
• Conditional Access is a real-time policy engine evaluating multiple signals, not a static allow/block list.
• Microsoft Entra roles (administering Entra ID/M365) and Azure RBAC (administering Azure resources) are two separate, parallel systems.
• Access reviews, entitlement management, and PIM all implement continuous governance rather than one-time provisioning — PIM specifically converts standing privileged access into eligible, time-bound activation.
• Identity Protection detects and scores risk (sign-in risk vs. user risk); Conditional Access is what actually enforces a response to that risk.

Connecting Forward

Phase 4 shifts from "who gets access" to "how is the infrastructure and workload itself protected" — network security, cloud security posture, SIEM/SOAR, and Defender's threat-protection product family. Notice that identity remains a thread throughout: Defender for Identity (4.4.5) specifically protects the on-premises AD and hybrid identity concepts you just learned here.

Self-Check Questions

• Why is a managed identity considered more secure than a service principal with a manually stored client secret?
• What specific signal does Conditional Access rely on that a simple username/password check cannot see?
• Why does PIM's "eligible" model reduce risk even if an attacker already has a privileged user's valid password?