Azure Documentation

Azure Active Directory (Azure AD) Identity Management

Table of Contents

Introduction to Azure AD Identity Management

Azure Active Directory (Azure AD) is a cloud-based identity and access management service that helps your employees sign in to access external resources, such as Microsoft 365, the Azure portal, and thousands of other SaaS applications. It also helps your IT department manage user access and permissions to these resources.

Effective identity management is crucial for modern cloud environments. Azure AD provides a robust and scalable solution for managing users, groups, and their access to applications and data, ensuring security and compliance.

Core Concepts

Users and Groups

Azure AD manages identities through:

  • Users: Individual accounts representing people or service principals.
  • Groups: Collections of users, devices, or other groups, used to simplify management of access and permissions.

You can create, manage, and synchronize user and group identities from on-premises directories (like Active Directory Domain Services) to Azure AD.

Authentication

Authentication is the process of verifying who a user is. Azure AD supports various authentication methods, including:

  • Password-based authentication
  • Multi-Factor Authentication (MFA)
  • Passwordless authentication (e.g., Windows Hello, FIDO2 keys, Authenticator app)
  • Federated identity (e.g., with on-premises AD FS)

Implementing strong authentication, especially MFA, is a key security best practice.

Authorization

Authorization determines what an authenticated user is allowed to do. In Azure AD, authorization is managed through:

  • Role-Based Access Control (RBAC): Assigning specific roles to users or groups to grant permissions for Azure resources.
  • Application assignments: Granting users access to specific SaaS applications.
  • Conditional Access policies: Fine-grained control over access based on conditions like user location, device state, and application.

Roles

Azure AD defines administrative roles that grant specific permissions to manage Azure AD resources and Azure subscriptions. Examples include:

  • Global Administrator
  • User Administrator
  • Application Administrator
  • Billing Administrator

It's recommended to follow the principle of least privilege, assigning only the necessary permissions.

Identity Governance

Azure AD Identity Governance provides tools to manage the identity lifecycle and access for users and applications. Key features include:

  • Entitlement Management: Automate the process of requesting, approving, and reviewing access to resources.
  • Access Reviews: Periodically review user access to groups, applications, and roles to ensure it's still appropriate.
  • Privileged Identity Management (PIM): Manage, control, and monitor access to critical resources by providing just-in-time (JIT) access for users who need it.

Access Management

Azure AD's access management capabilities enable organizations to secure access to applications and data:

  • Single Sign-On (SSO): Users sign in once to access multiple applications.
  • Application Proxy: Provide secure remote access to on-premises applications.
  • Conditional Access: A policy-based engine that allows you to enforce organizational policies for access to cloud apps and resources.

Configure Conditional Access policies to enforce MFA, restrict access based on location, or require compliant devices.

Security Features

Azure AD offers advanced security features to protect your organization's identities and resources:

  • Identity Protection: Detects and responds to identity-based risks by monitoring for sign-in and user behavior anomalies.
  • Multi-Factor Authentication (MFA): A crucial layer of defense against unauthorized access.
  • Device Management: Manage and secure devices accessing your organization's resources through Intune or Mobile Device Management (MDM).

Tutorials and Quickstarts

Get started quickly with our step-by-step guides:

Explore the full Azure AD documentation for more in-depth information.

Related Services