Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Free Learning
Arrow right icon
Azure Architecture Explained
Azure Architecture Explained

Azure Architecture Explained: A comprehensive guide to building effective cloud solutions

Arrow left icon
Profile Icon David Rendón Profile Icon Brett Hargreaves
Arrow right icon
$49.99
Full star icon Full star icon Full star icon Full star icon Empty star icon 4 (6 Ratings)
Paperback Sep 2023 446 pages 1st Edition
eBook
$9.99 $39.99
Paperback
$49.99
Subscription
Free Trial
Renews at $19.99p/m
Arrow left icon
Profile Icon David Rendón Profile Icon Brett Hargreaves
Arrow right icon
$49.99
Full star icon Full star icon Full star icon Full star icon Empty star icon 4 (6 Ratings)
Paperback Sep 2023 446 pages 1st Edition
eBook
$9.99 $39.99
Paperback
$49.99
Subscription
Free Trial
Renews at $19.99p/m
eBook
$9.99 $39.99
Paperback
$49.99
Subscription
Free Trial
Renews at $19.99p/m

What do you get with Print?

Product feature icon Instant access to your digital eBook copy whilst your Print order is Shipped
Product feature icon Paperback book shipped to your preferred address
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Product feature icon AI Assistant (beta) to help accelerate your learning
OR
Modal Close icon
Payment Processing...
tick Completed

Shipping Address

Billing Address

Shipping Methods
Table of content icon View table of contents Preview book icon Preview Book

Azure Architecture Explained

Identity Foundations with Azure Active Directory and Microsoft Entra

In today’s rapidly changing digital landscape, businesses need to embrace cloud technology to remain competitive. Microsoft Azure provides a powerful suite of cloud services, enabling organizations to achieve scalability, agility, and cost-effectiveness. However, adopting Azure can be a daunting task, with a wide range of tools and services to navigate.

This book aims to simplify the process by providing a comprehensive guide to the most essential Azure topics, including managing access to resources, mitigating security threats with Microsoft Sentinel, understanding data solutions, and migrating to the cloud. With a focus on practical applications and real-world scenarios, this book also covers end-to-end observability, working with containers, networking, security principals, governance, building solutions with the Bicep language, and using Azure Pipelines for continuous integration and deployment. The book also includes tips from the field, sharing best practices and common pitfalls to avoid. By the end of this book, readers will have a solid foundation in Azure technologies and be well equipped to implement cloud solutions that drive their organization’s success.

As the modern IT landscape continues to evolve, so does the importance of effective identity and access management (IAM) solutions. Authentication and authorization, engaging and collaborating with employees, partners, and customers, and the significance of digital identities are just a few critical concepts that must be considered by organizations to maintain secure and efficient operations.

Azure Active Directory (AD), a cloud-based identity management service, is an integral component of Microsoft Entra. Microsoft Entra, a powerful identity-driven security tool, offers a comprehensive perspective on IAM in diverse environments. This chapter will delve into the importance of IAM in contemporary organizations, emphasizing the pivotal role of solutions such as Azure AD and Microsoft Entra in bolstering security measures.

In this chapter, we’ll cover the following main topics:

  • Protecting users’ identities and securing the value chain – the importance of IAM in decentralized organizations
  • Authentication and authorization in Azure
  • Engaging and collaborating with employees, partners, and customers
  • The significance of digital identities in the modern IT landscape
  • Securing cloud-based workloads with Microsoft Entra’s identity-based access control

Let’s get started!

Protecting users’ identities and securing the value chain – the importance of IAM in decentralized organizations

Over the last decade, organizations have been decentralizing and outsourcing non-core functions to suppliers, factories, warehouses, transporters, and other stakeholders in the value chain, making it more complex and vulnerable. This is most notable in global manufacturing and retail, where decentralization is crucial to introduce efficiency, lower costs, and decrease supply chain disruption risks.

These companies are pursuing multiple strategies to maximize the value of the various functions across multiple external businesses. Each resource access can grant bridges to several security domains, making it a potential entry point for unauthorized users. This can lead to malicious intent or accidental information access by unknowing users.

As digital transformation continues to change how we interact with businesses and other users, the risk of identity data being exposed in breaches has increased, causing damage to people’s social, professional, and financial lives. What are your beliefs about protecting users’ identities?

In our opinion, every individual has the right to own and control their identity securely, with elements of their digital identity stored in a way that preserves privacy.

Organizations must have a comprehensive cybersecurity strategy to protect the value chain from security risks. A robust strategy involves a multi-layered approach that includes network segmentation, data encryption, secure access controls, and continuous monitoring to identify potential security breaches.

It’s also crucial to implement policies for data access and management across the value chain to control who has access to sensitive information and how it’s used. As organizations continue to decentralize and outsource non-core functions to suppliers, it’s essential to establish trust between partners and have transparency in data management to ensure data security and privacy.

Therefore, data protection and access control are essential for organizations to maintain the confidentiality, integrity, and availability of their digital assets. IAM is a critical component of modern cybersecurity, encompassing a range of technologies and processes that enable organizations to control user access to applications, systems, and data.

IAM is crucial to maintaining the security of an enterprise’s digital assets, including confidential data, applications, and systems. By implementing IAM, organizations can ensure that only authorized individuals can access sensitive information, reducing the risk of data breaches and cyberattacks. IAM also provides an efficient way to manage user accounts, credentials, and permissions, making adding or removing users as necessary easier.

IAM is a crucial technology framework that enables organizations to ensure that their resources are only accessed by authorized individuals. The framework includes two main functions: authentication and authorization. In the next section, we will discuss how IAM solutions can help organizations reduce security risks and protect their sensitive data from unauthorized access and data breaches.

Authentication and authorization in Azure

IAM is a technology framework that helps organizations ensure that the right people have access to the right resources. IAM includes two main functions: authentication and authorization.

Authentication is the process of verifying the identity of a user. It ensures that a user is who they claim to be before they can access an organization’s resources. For example, when you log in to your email account, you must enter your username and password. This form of authentication helps the email provider ensure that you are the legitimate user of the account.

Authorization, conversely, is the process of determining what resources a user is allowed to access after their identity has been verified. For instance, once you have logged in to your email account, the email provider uses authorization to determine what you can do with your account. For example, you may have permission to read emails, compose emails, and send emails, but you may not have permission to delete emails. Authorization helps ensure that users only have access to the resources they are authorized to use.

Another vital component related to the preceding two concepts is multifactor authentication (MFA). Think of MFA as a security process that requires users to provide two or more credentials to access a system or application. These credentials can include something the user knows (such as a password), something the user has (such as a smart card or mobile phone), or something the user is (such as a fingerprint or facial recognition). By requiring multiple authentication factors, MFA makes it more difficult for unauthorized individuals to access sensitive information or systems, even if they do obtain one of the user’s credentials.

For example, a bank may require MFA when a user tries to access their online banking account. After entering their username and password, the user is prompted to enter a unique code generated by a mobile app or sent via text to their phone. This code is a second factor of authentication that proves the user’s identity beyond their login credentials. By requiring this extra step, the bank ensures that only the authorized user can access their account, even if someone else has obtained their login information.

With IAM, organizations can streamline their access management processes, reducing the burden on IT staff and improving overall efficiency. Additionally, IAM can help organizations comply with regulatory requirements, such as the Health Insurance Portability and Accountability Act (HIPAA) or General Data Protection Regulation (GDPR), by providing auditable access controls and ensuring user access aligns with policy requirements.

Effective IAM solutions help organizations enforce security policies and comply with regulations by ensuring users can access only the resources they need to do their jobs.

IAM solutions also provide audit trails and visibility into user activity, making identifying and mitigating security incidents and compliance violations easier. By implementing robust IAM strategies, organizations can reduce security risks and protect their sensitive data from unauthorized access and data breaches.

Engaging and collaborating with employees, partners, and customers

Collaboration and communication are critical components of a successful organization, and they can be challenging to achieve without the proper infrastructure in place. The IT team of an organization may struggle to provide secure access for external users, leaving employees isolated and limited to email communications, which can lead to inefficiencies in managing marketing campaigns and hinder the exchange of ideas between team members. However, with the proper infrastructure that supports IAM, organizations can improve productivity, reduce costs, and increase work distribution while fostering a culture of teamwork and sharing. Improved visibility and consistency in managing project-related information can help teams track tasks and commitments, respond to external demands, and build better relationships with partners and external contributors.

Organizations need to prioritize collaboration capabilities and invest in the right tools and technologies to realize these benefits. This can include everything from shared workspaces and project management platforms to video conferencing and secure access controls. By providing employees with the tools they need to work together effectively, businesses can create a more dynamic and responsive organization better equipped to compete in a rapidly changing marketplace.

The significance of digital identities in the modern IT landscape

In today’s digital age, digital identities are essential for accessing IT-related services. An identity strategy goes beyond just provisioning and adding or removing access but determines how an organization manages accounts, standards for validation, and what a user or service can access.

Reporting on activities that affect identity life cycles is also an essential component of an identity strategy. A well-formed identity infrastructure is based on guidelines, principles, and architectural designs that provide organizations with interoperability and flexibility to adapt to ever-changing business goals and challenges.

An effective identity infrastructure should be based on integration and manageability standards while being user-friendly and secure. In order to simplify the end user experience, the infrastructure should provide easy-to-use and intuitive methods for managing and accessing digital identities. With a well-designed and implemented identity infrastructure, organizations can reduce the risk of unauthorized access to their IT resources and improve their overall security posture. Additionally, a standardized identity infrastructure can facilitate collaboration between organizations and make it easier for users to access resources across multiple organizations.

Also, with the growing trend of organizations seeking to invest in cloud services to achieve modernization, cost control, and new capabilities, IAM capabilities have become the central pillar for cloud-based scenarios. Azure AD has become a comprehensive solution that addresses these requirements for both on-premises and cloud applications. The following section provides insights into common scenarios and demonstrates how Azure AD can help with planning and preparing organizations to use cloud services effectively.

Modernizing your IAM with Microsoft Azure AD

Microsoft’s Azure AD is a cloud-based IAM service designed to help organizations manage access to resources across different cloud environments. With Azure AD, organizations can control access to cloud applications, both Microsoft and non-Microsoft, through a single identity management solution. This enables employees to access the tools and information they need from any device, anywhere in the world, with increased security and efficiency.

The following figure highlights the structure of Azure AD.

Figure 1.1 – Azure AD

Figure 1.1 – Azure AD

Azure AD provides several benefits for organizations looking to modernize their IT infrastructure. It offers seamless integration with other Azure services and enables IT administrators to manage user identities and security policies and access resources from a central location. Additionally, it provides MFA and Conditional Access policies to help protect against identity-based attacks.

Organizations can also use Azure AD to manage access to third-party applications, including Software as a Service (SaaS) applications, such as Salesforce, Box, and Dropbox, providing a consistent and secure user experience across different cloud environments.

However, IAM tasks can significantly burden IT departments, taking up valuable time that could be spent on higher-value work. A crucial piece of an IAM solution is its life cycle management capabilities.

Life cycle management

Provisioning new users can be tedious, requiring administration and configuration across multiple systems. Users may have difficulty obtaining the necessary access to perform their jobs, causing delays and inefficiencies.

For example, the IT team of SpringToys, an online retail organization, may have to access and configure multiple identity utilities and repositories to onboard a new user for online services, making the process even more complicated. With an ad hoc manual method, achieving stringent levels of control and compliance with necessary regulatory standards can be challenging. Each time an employee needs to access an IT service, IT staff must manually handle the request and perform administrative tasks to enable access, creating inefficiencies and delays that impact productivity. By implementing a robust IAM solution, organizations can reduce the burden on IT staff, streamline IAM processes, and improve security and compliance posture.

Effective management of the identity life cycle can bring numerous benefits to organizations, including reducing the time and cost of integrating new users and improving security by controlling access to resources centrally.

By maximizing the investments in existing on-premises identities, organizations can extend them to the cloud, reducing the time for new users to access corporate resources and streamlining the provisioning process. Consistent application of security policies enhances the security posture and reduces exposure to outdated credentials. It also minimizes business interruptions and reduces the time and cost required to enable applications to be accessible from the internet.

Additionally, the increased capacity of IT to develop core application features and the ability to delegate specific administration tasks can lead to increased flexibility and auditing capabilities, enhancing the overall efficiency and effectiveness of IAM solutions.

Leveraging the Microsoft Cloud Adoption Framework

If your organization is on its journey of adopting Azure IAM, consider leveraging the Microsoft Cloud Adoption Framework (CAF) for Azure (https://bit.ly/azurecaf), a guide that helps organizations create and implement strategies for cloud adoption in their business.

It provides a set of best practices, guidance, and tools for different stages of cloud adoption, from initial planning to implementation and optimization. The framework is designed to help organizations develop a comprehensive cloud adoption plan, create a governance structure, and identify the right tools and services for their specific business needs.

The CAF comprises multiple stages: strategy, plan, ready, migrate, innovate, secure, manage, and govern. Each stage includes a set of recommended practices, tools, and templates that help organizations to assess their readiness, build a cloud adoption plan, migrate applications and data to the cloud, and optimize cloud resources.

The following figure highlights the CAF stages:

Figure 1.2 – Microsoft CAF for Azure

Figure 1.2 – Microsoft CAF for Azure

The framework is flexible and can be customized to fit an organization’s specific needs. It is designed to work with different cloud services and technologies, including Microsoft Azure, Amazon Web Services (AWS), and Google Cloud.

Also, the CAF includes a specific IAM design area that focuses on providing guidance and best practices for designing secure and scalable IAM solutions in the Azure cloud platform. This includes managing identities, implementing authentication and authorization mechanisms, and establishing proper governance and compliance policies. By following the Azure IAM design principles, organizations can ensure their cloud environments are secure and compliant and effectively manage access to their cloud resources.

Utilize this framework to expedite your cloud adoption process. The accompanying resources can assist you in every stage of adoption. These resources, including tools, templates, and assessments, can be applied across multiple phases: https://bit.ly/azure-caf-tools.

Azure AD terminology, explained

Azure AD is a system used to manage access to Microsoft cloud services. It involves several terms that are important to understand. Identity is something that can be authenticated, such as a user with a username and password or an application with a secret key or certificate. An account is an identity that has data associated with it.

Azure AD supports two distinct types of security principals: user principals, which represent user accounts, and service principals, which represent applications and services. A user principal encompasses a username and password, while a service principal (also referred to as an application object/registration) can possess a secret, key, or certificate.

An Azure AD account is an identity created through Azure AD or another Microsoft cloud service, such as Microsoft 365. The account administrator manages billing and all subscriptions, while the service administrator manages all Azure resources.

The owner role helps manage Azure resources and is built on a newer authorization system, called Azure role-based access control (RBAC). The Azure AD Global Administrator is automatically assigned to the person who created the Azure AD tenant and can assign administrator roles to users.

An Azure tenant is a trusted instance of Azure AD created when an organization signs up for a Microsoft cloud service subscription. A custom domain name can be added to Azure AD to make usernames more familiar to users.

When an Azure AD tenant is created, it comes with a default *.on.microsoft.com domain. A custom domain name such as springtoys.com can be added to the Azure AD tenant to make usernames more familiar to the users.

For example, imagine SpringToys wanting to use Microsoft Azure to store and manage its data. They would need to create an Azure subscription, which would automatically generate an Azure AD directory for them. They would then create Azure AD accounts for each employee who needs access to the company’s data stored in Azure.

Each employee’s Azure AD account would be associated with their Microsoft 365 account, which they use to log in to their work computer and access company resources. The company could also add a custom domain name to Azure AD so that employees can use email addresses with their company’s domain name to log in to their Azure AD account, such as john@springtoys.com. The company would also need to assign roles to each employee’s Azure AD account, such as the owner role or service administrator role, to manage access to Azure resources. In broad terms, Azure roles govern permissions for overseeing Azure resources, whereas Azure AD roles govern permissions for managing Azure AD resources.

The following table summarizes the Azure AD terminology:

Concept

Description

Identity

An object that can be authenticated

Account

An identity that has data associated with it

Azure AD account

An identity created through Azure AD or another Microsoft cloud service

Azure AD tenant/directory

A dedicated and trusted instance of Azure AD, a tenant is automatically created when your organization signs up for a Microsoft cloud service subscription

Azure AD is a crucial aspect of cloud security that enables organizations to control access to their resources and data in the cloud.

Securing applications with the Microsoft identity platform

Managing the information of multiple usernames and passwords across various applications can become challenging, time-consuming, and vulnerable to errors. However, this problem can be addressed using a centralized identity provider. Azure AD is one such identity provider that can handle authentication and authorization for various applications. It provides several benefits, including conditional access policies, MFA, and single sign-on (SSO). SSO is a significant advantage as it enables users to sign in once and automatically access all the applications that share the same centralized directory.

More broadly speaking, the Microsoft identity platform simplifies authentication and authorization for application developers. It offers identity as a service and supports various industry-standard protocols and open source libraries for different platforms. Developers can use this platform to build applications that sign in to all Microsoft identities, get tokens to call Microsoft Graph, and access other APIs. Simply put, by utilizing the Microsoft identity platform, developers can reduce the complexity of managing user identities and focus on building their applications’ features and functionality.

Microsoft’s identity platform can help organizations streamline identity management and improve security. Organizations can take advantage of features such as conditional access policies and MFA by delegating authentication and authorization responsibilities to a centralized provider such as Azure AD. Furthermore, developers can benefit from the platform’s ease of use, supporting various industry-standard protocols and open source libraries, making it easier to build and integrate applications.

By integrating your app with Azure AD, you can ensure that your app is secure in the enterprise by implementing Zero Trust principles.

As a developer, integrating your app with Azure AD provides a wide range of benefits that help you secure your app in the enterprise. One of the significant benefits of using Azure AD is the ability to authenticate and authorize applications and users. Azure AD provides a range of authentication methods, including SSO, which can be implemented using federation or password-based authentication. This simplifies the user experience by reducing the need for users to remember multiple passwords.

Another benefit of using Azure AD is the ability to implement RBAC, which enables you to restrict access to your app’s features based on a user’s role within the organization. You can also use OAuth authorization services to authenticate and authorize third-party apps that access your app’s resources.

The Microsoft identity platform supports multiple protocols for authentication and authorization. It is crucial to understand the differences between these protocols to choose the best option for your application.

One example is the comparison between OAuth 2.0 and SAML. OAuth 2.0 is commonly used for authorization, while SAML is frequently used for authentication. The OAuth 2.0 protocol allows users to grant access to their resources to a third-party application without giving the application their login credentials. On the other hand, SAML provides a way for a user to authenticate to multiple applications using a single set of credentials. An example of SAML being used in the Microsoft identity platform is with Active Directory Federation Services (AD FS) federated to Azure AD.

Another example is the comparison between OpenID Connect (OIDC) and SAML. OIDC is commonly used for cloud-based applications, such as mobile apps, websites, and web APIs. It allows for authentication and SSO using a JSON web token. SAML, on the other hand, is commonly used in enterprise applications that use identity providers such as AD FS federated to Azure AD. Both protocols support SSO, but SAML is commonly used in enterprise applications.

The following table summarizes the protocols and descriptions and their typical usage scenarios:

Protocol

Description

Use Cases

OAuth

OAuth is used for authorization, granting permissions to manage Azure resources

When managing permissions to access and perform operations on Azure resources

OIDC

OIDC builds on top of OAuth 2.0 and is used for authentication, verifying the identity of users

When authenticating users and obtaining information about their identity

SAML

SAML is used for authentication and is commonly used with identity providers, such as AD FS, to enable SSO in enterprise applications

When integrating with enterprise applications and identity providers, particularly with AD FS federated to Azure AD

Understanding these protocols and their differences can help you choose the best option for your application and ensure secure and efficient authentication and authorization.

As more companies transition their workloads to the cloud, they face the challenge of ensuring the security of their resources in these new environments. In order to effectively manage access to cloud-based workloads, organizations must establish definitive user identities and control access to data, while also ensuring authorized operations are performed. This is where Microsoft Entra comes in – which provides a set of multiple components that provide identity-based access control, permissions management, and identity governance to help organizations securely manage their cloud-based workloads.

Securing cloud-based workloads with Microsoft Entra’s identity-based access control

When transitioning workloads to the cloud, companies must consider the security implications of moving their resources. They need to define authorized users, restrict access to data, and ensure that employees and vendors only perform authorized operations. To centrally control access to cloud-based workloads, companies must establish a definitive identity for each user used for every service. This identity-based access control ensures that users have the necessary permissions to perform their jobs while restricting unauthorized access to resources.

Microsoft Entra comprises a set of multiple components, including the following:

  • Azure AD
  • Microsoft Entra Permissions Management
  • Microsoft Entra Verified ID
  • Microsoft Entra workload identities
  • Microsoft Entra Identity Governance
  • Microsoft Entra admin center

Let’s look at them in detail.

Azure AD

To simplify the process of securing cloud-based resources, Azure AD, a cloud-based IAM service that is part of Microsoft Entra, offers features such as SSO and MFA, which helps protect both users and data. By learning the basics of creating, configuring, and managing users and groups of users, organizations can effectively control access to their cloud-based resources. Additionally, by managing licenses through Azure AD, organizations can ensure that their employees and vendors have access to the necessary tools to perform their jobs while maintaining a secure environment.

Azure AD provides three ways to define users, which are helpful for different scenarios. The first way is cloud identities, which only exist in Azure AD. These can include administrator accounts and users managed directly in Azure AD. Cloud identities are deleted when removed from the primary directory, making them an excellent option for managing temporary access to Azure resources. The following figure represents the cloud identity.

Figure 1.3 – Cloud identity

Figure 1.3 – Cloud identity

The second way is directory-synchronized identities, which exist in an on-premises AD. These users are brought into Azure through a synchronization activity with Azure AD Connect, making them useful for organizations with existing on-premises infrastructure.

You can leverage directory synchronization with Pass-through Authentication (PTA) or SSO with AD FS.

Finally, there are guest users that might exist outside of Azure or can be on a different Azure AD tenant. These can be accounts from other cloud providers or Microsoft accounts, such as an Xbox Live account. Guest users are invited to access Azure resources. They can be removed once their access is no longer necessary, making them an excellent option for external vendors or contractors who require temporary access.

Managing permissions is a critical aspect of Zero Trust security and is increasingly challenging for organizations adopting a multi-cloud strategy. With the proliferation of cloud services and identities, high-risk cloud permissions are exploding, creating a larger attack surface for organizations. IT security teams are pressured to ensure access to their expanding cloud estate is secure and compliant. However, the inconsistency of cloud providers’ native access management models makes it even more complex for security and identity teams to manage permissions and enforce least privilege access policies across their entire environment.

Microsoft Entra Permissions Management

Organizations need a cloud infrastructure entitlement management (CIEM) solution such as Microsoft Entra Permissions Management to enable comprehensive visibility into permissions assigned to all identities across multi-cloud infrastructures such as Microsoft Azure, AWS, and Google Cloud Platform (GCP). Microsoft Entra Permissions Management can detect and right-size unused and excessive permissions while continuously monitoring permissions to maintain a least privilege access policy. By implementing a CIEM solution such as Permissions Management, organizations can improve their cloud security posture and better manage access to their cloud-based resources.

Microsoft Entra Verified ID

The digital identity we use today is controlled by other parties, leading to potential privacy concerns. Users give apps and devices access to their data, making it challenging to track who has access to which information. Securely exchanging data with consumers and partners is difficult in the enterprise world. A standards-based decentralized identity system can improve user and organizational control over data, resulting in increased trust and security for apps, devices, and service providers.

Decentralized identifiers (DIDs) are a key component of verifiable credentials (VCs) in Azure AD. DIDs are unique identifiers created in a decentralized system and are not controlled by a central authority. DIDs can be used to represent individuals, organizations, devices, and other entities in a secure and privacy-preserving way. They can also be used to prove ownership of digital assets, such as domain names or social media handles.

Azure AD supports using DIDs and VCs to enable secure and trusted digital identities. This allows organizations to reduce the reliance on traditional usernames and passwords and instead use more secure and privacy-preserving methods for identity verification. The article also highlights the benefits of using DIDs and VCs, including increased security, privacy, and interoperability. It provides resources for developers and organizations to use DIDs and VCs in Azure AD.

Microsoft Entra workload identities

In the world of cloud computing, a workload identity is essential for authenticating and accessing other resources and services securely and efficiently. Workload identities can take different forms, such as a user account that an application uses to access a database or a service role attached to an instance with limited access to a specific resource. Regardless of its form, a workload identity ensures that the software entity can securely access the resources it needs while also helping to prevent unauthorized access and data breaches.

In Azure AD, a workload identity is a way for a software program, such as an application or service, to identify and authenticate itself when accessing other services and resources. There are three types of workload identities in Azure AD: applications, which are like templates that define how a program can access resources; service principals, which are like local copies of applications that are specific to a particular tenant; and managed identities, which are a special type of service principal that don’t require a developer to manage passwords or credentials.

Here are a few examples of how you can leverage workload identities:

  • You can use a managed identity to access resources protected by Azure AD without the need to manage credentials or keys to authenticate your identity
  • You can use workload identity federation to access Azure AD-protected resources without needing to manage secrets or credentials for workloads running in supported scenarios such as GitHub Actions, Kubernetes, or compute platforms outside Azure
  • You can use access reviews for service principals to review and audit the access of service principals and applications assigned to privileged directory roles in Azure AD
  • You can leverage Conditional Access policies for workload identities to control access to resources based on certain conditions or policies and use continuous access evaluation to monitor and evaluate access to resources in real time
  • You can use Identity Protection to detect and respond to identity-related risks and threats for your workload identities and apply security policies to protect your identities from cyberattacks

As organizations embrace digital transformation, the need for the secure and efficient management of access to resources becomes increasingly important. Microsoft Entra Identity Governance is a tool designed to address this need, enabling companies to balance productivity and security by ensuring the right people have access to the right resources. Identity Governance uses a foundation of identity life cycle management to keep track of who has access to what resources and ensure that access is updated as needed.

Microsoft Entra Identity Governance

Microsoft Entra Identity Governance is a tool that helps organizations balance the need to keep their data secure and ensure employees can get their work done efficiently. It helps by ensuring the right people have access to the right things, and the company can keep an eye on who is accessing what. This helps reduce the risk of someone getting access to something they shouldn’t have and helps the company ensure employees can still do their jobs.

Identity Governance helps organizations to manage access to their resources in a way that balances productivity and security. It is designed to answer questions such as “Who should have access to which resources?” and “How can we ensure that access is appropriate and secure?” To do this, Identity Governance relies on a foundation of identity life cycle management, which involves keeping track of who has access to what resources and making sure that access is updated as needed. This process helps organizations ensure that their resources are protected while enabling their employees to get the access they need to do their jobs.

Sometimes, organizations need to work with people outside of their own company. Azure AD B2B collaboration is a feature that allows companies to safely share their apps and services with other people, such as guests and partners from different organizations. This way, organizations can maintain control over their own data while still allowing others to use their resources. Microsoft Entra entitlement management will enable organizations to decide which users from other organizations can request access and become guests in their directory. It will also remove these guests when they no longer need access.

Microsoft Entra admin center

Microsoft launched the Entra admin center for its Microsoft 365 and Azure AD customers. And you can log in to the portal using your Microsoft 365 account. The Entra admin center provides customers with better security, governance, and compliance features for their organization.

The portal is accessible through the following URL: https://entra.microsoft.com.

As you can see, Microsoft Entra helps organizations to make sure the right people have access to the right things. It does this by verifying who someone is and allowing them to access the apps and resources needed to do their job. Microsoft Entra works across different environments, such as cloud and on-premises systems. It also makes it easier for people to access what they need by using smart tools to make quick decisions about who should have access to what.

Summary

This chapter covered several important topics related to IAM in the modern IT landscape. We discussed authentication and authorization, which are crucial components of any IAM solution. Then, we moved on to explore the importance of engaging and collaborating with employees, partners, and customers, as well as the role that digital identities play in this process.

We provided an overview of Azure AD, a cloud-based IAM service that enables organizations to control access to cloud applications. Finally, we discussed how Microsoft Entra’s identity-based access control can help organizations secure their cloud-based workloads by establishing definitive identities for each user and controlling access to resources.

In the next chapter, we will discuss the core IAM capabilities that can be utilized with Azure AD.

Left arrow icon Right arrow icon
Download code icon Download Code

Key benefits

  • Develop your business case for the cloud with technical guidance from industry experts
  • Address critical business challenges effectively by leveraging proven combinations of Azure services
  • Tackle real-world scenarios by applying practical knowledge of reference architectures
  • Purchase of the print or Kindle book includes a free PDF eBook

Description

Azure is a sophisticated technology that requires a detailed understanding to reap its full potential and employ its advanced features. This book provides you with a clear path to designing optimal cloud-based solutions in Azure, by delving into the platform's intricacies. You’ll begin by understanding the effective and efficient security management and operation techniques in Azure to implement the appropriate configurations in Microsoft Entra ID. Next, you’ll explore how to modernize your applications for the cloud, examining the different computation and storage options, as well as using Azure data solutions to help migrate and monitor workloads. You’ll also find out how to build your solutions, including containers, networking components, security principles, governance, and advanced observability. With practical examples and step-by-step instructions, you’ll be empowered to work on infrastructure-as-code to effectively deploy and manage resources in your environment. By the end of this book, you’ll be well-equipped to navigate the world of cloud computing confidently.

Who is this book for?

This book is an indispensable resource for Azure architects looking to develop cloud-based services along with deploying and managing applications within the Microsoft Azure ecosystem. It caters to professionals responsible for crucial IT operations, encompassing budgeting, business continuity, governance, identity management, networking, security, and automation. If you have prior experience in operating systems, virtualization, infrastructure, storage structures, or networking, and aspire to master the implementation of best practices in the Azure cloud, then this book will become your go-to guide.

What you will learn

  • Implement and monitor cloud ecosystem including, computing, storage, networking, and security
  • Recommend optimal services for performance and scale
  • Provide, monitor, and adjust capacity for optimal results
  • Craft custom Azure solution architectures
  • Design computation, networking, storage, and security aspects in Azure
  • Implement and maintain Azure resources effectively
Estimated delivery fee Deliver to Japan

Standard delivery 10 - 13 business days

$8.95

Premium delivery 3 - 6 business days

$34.95
(Includes tracking information)

Product Details

Country selected
Publication date, Length, Edition, Language, ISBN-13
Publication date : Sep 22, 2023
Length: 446 pages
Edition : 1st
Language : English
ISBN-13 : 9781837634811
Tools :

What do you get with Print?

Product feature icon Instant access to your digital eBook copy whilst your Print order is Shipped
Product feature icon Paperback book shipped to your preferred address
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Product feature icon AI Assistant (beta) to help accelerate your learning
OR
Modal Close icon
Payment Processing...
tick Completed

Shipping Address

Billing Address

Shipping Methods
Estimated delivery fee Deliver to Japan

Standard delivery 10 - 13 business days

$8.95

Premium delivery 3 - 6 business days

$34.95
(Includes tracking information)

Product Details

Publication date : Sep 22, 2023
Length: 446 pages
Edition : 1st
Language : English
ISBN-13 : 9781837634811
Tools :

Packt Subscriptions

See our plans and pricing
Modal Close icon
$19.99 billed monthly
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Simple pricing, no contract
$199.99 billed annually
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just $5 each
Feature tick icon Exclusive print discounts
$279.99 billed in 18 months
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just $5 each
Feature tick icon Exclusive print discounts

Frequently bought together


Stars icon
Total $29.97 $111.97 $82.00 saved
Azure Architecture Explained
$49.99
Azure Security Cookbook
$39.99
Designing and Implementing Microsoft Azure Networking Solutions
$49.99
Total $29.97$111.97 $82.00 saved Stars icon
Banner background image

Table of Contents

19 Chapters
Part 1 – Effective and Efficient Security Management and Operations in Azure Chevron down icon Chevron up icon
Chapter 1: Identity Foundations with Azure Active Directory and Microsoft Entra Chevron down icon Chevron up icon
Chapter 2: Managing Access to Resources Using Azure Active Directory Chevron down icon Chevron up icon
Chapter 3: Using Microsoft Sentinel to Mitigate Lateral Movement Paths Chevron down icon Chevron up icon
Part 2 – Architecting Compute and Network Solutions Chevron down icon Chevron up icon
Chapter 4: Understanding Azure Data Solutions Chevron down icon Chevron up icon
Chapter 5: Migrating to the Cloud Chevron down icon Chevron up icon
Chapter 6: End-to-End Observability in Your Cloud and Hybrid Environments Chevron down icon Chevron up icon
Chapter 7: Working with Containers in Azure Chevron down icon Chevron up icon
Chapter 8: Understanding Networking in Azure Chevron down icon Chevron up icon
Chapter 9: Securing Access to Your Applications Chevron down icon Chevron up icon
Part 3 – Making the Most of Infrastructure-as-Code for Azure Chevron down icon Chevron up icon
Chapter 10: Governance in Azure – Components and Services Chevron down icon Chevron up icon
Chapter 11: Building Solutions in Azure Using the Bicep Language Chevron down icon Chevron up icon
Chapter 12: Using Azure Pipelines to Build Your Infrastructure in Azure Chevron down icon Chevron up icon
Chapter 13: Continuous Integration and Deployment in Azure DevOps Chevron down icon Chevron up icon
Chapter 14: Tips from the Field Chevron down icon Chevron up icon
Index Chevron down icon Chevron up icon
Other Books You May Enjoy Chevron down icon Chevron up icon

Customer reviews

Top Reviews
Rating distribution
Full star icon Full star icon Full star icon Full star icon Empty star icon 4
(6 Ratings)
5 star 50%
4 star 33.3%
3 star 0%
2 star 0%
1 star 16.7%
Filter icon Filter
Top Reviews

Filter reviews by




Amazon Customer Nov 11, 2023
Full star icon Full star icon Full star icon Full star icon Full star icon 5
This book was a pleasant surprise for me. Unlike most books about cloud architecture that are aimed at experts in Azure cloud architecture, this book is accessible and informative for a wider range of readers. You don't need to be a beginner or a master of cloud services to benefit from this book. It covers the basics of all the Azure cloud service primitives and shows how they relate to existing on-prem architectures and how to migrate to the Azure platform. This book is a valuable resource for anyone interested in cloud architecture and its relationship to both existing deployed open source or MSFT supported services\products.
Amazon Verified review Amazon
Dieter Nov 03, 2023
Full star icon Full star icon Full star icon Full star icon Full star icon 5
I recently had the opportunity to take a glance at this book, and I must say I am thoroughly impressed. As someone who deals with the subject matter on a daily basis, I found the content to be not only relevant but also highly engaging. Here's a summary of my initial impressions:The book features clear and informative figures that effectively highlight the key points discussed in the text. Each chapter is thoughtfully summarized at the end, providing a convenient recap of the essential takeaways.I was particularly pleased to find that the book's content is up to date. For example, it distinguishes between Azure Active Directory and the newer Microsoft Entra ID, a distinction that's vital for those working with the latest technologies.The inclusion of Microsoft URL links throughout the book is a valuable resource. It allows readers to explore specific topics in greater depth, providing a wealth of additional information.What sets this book apart is its focus on practicality. It offers step-by-step instructions and examples to demonstrate the "how to" of various processes. For instance, on page 49, the book guides readers through the process of assigning roles in PIM.Page 86 is a goldmine of information on storage account redundancy, which is a topic that generates numerous inquiries from Line of Business (LOB) teams. The clear and informative images and figures used as examples greatly enhance the understanding of the subject matter.Page 100 is dedicated to providing a comprehensive and well-organized guide to creating a SQL database. This step-by-step approach is incredibly valuable for beginners looking to understand the nuances of resource provisioning in the cloud.For those organizations venturing into cloud migration, page 117 offers an abundance of "how to" steps and guidance on getting started with resource deployment.Page 228 delves into the complex world of management groups, offering a valuable resource for those seeking a deeper understanding of this topic.Finally, page 334 shines a light on Azure pipelines, a subject in which I have a particular interest and would like to explore further.In conclusion, the book offers a wealth of practical insights and information, making it a valuable resource for anyone working with Azure and cloud technologies.
Amazon Verified review Amazon
Danishka Navin Nov 02, 2023
Full star icon Full star icon Full star icon Full star icon Full star icon 5
This book covers crucial aspects of cloud architecture, beginning with how you can efficiently and effectively utilize security management and operational tools within the Azure cloud. It then discusses compute and network solutions, including containers, observability, migrations, and securing applications. The final section deals with infrastructure as code for the Azure cloud, including building Azure solutions using the Bicep language and implementing CI/CD pipelines.There are plenty of examples, including screenshots and example code, available for each topic.
Amazon Verified review Amazon
Shanthababu Pandian Nov 11, 2023
Full star icon Full star icon Full star icon Full star icon Empty star icon 4
The authors have explained Azure Architecture precisely and covered from Azure Active Directory to building overall cloud environments using Azure pipeline.Part 1 – Effective and Efficient Security Management and Operations in Azure: The authors start with how to modernize your IAM with Microsoft Azure AD, Microsoft Cloud Adoption Framework(CAF), and the capabilities of Microsoft Entra.Crystal-clear explanation of the most relevant features of the IAM capabilities that you can leverage using Azure AD in every detail. They are providing an outline of the Zero Trust strategy and Microsoft Sentinel potentials.Part 2: Under-Architecting Compute and Network Solutions: the authors cover various migrating solutions for web applications, data, and monitoring, along with exclusive details about the containers and how networking and security function in the Azure space.Coming to Part 3: Making the Most of Infrastructure-as-Code for Azure: The authors are bringing the governance in Azure, its components and services significantly, and how to build infra solutions using the Bicep Language and CI/CD Pipelines are significant milestones.All chapters are unique and have a high potential for building effective cloud solutions.This is a well-structured and comprehensive guide for Azure beginners and practitioners to build perfect cloud solutions.-Shanthababu PandianArtificial Intelligence and Analytics | Cloud Data and ML Architect | Scrum MasterNational and International Speaker | Blogger |
Amazon Verified review Amazon
peter de tender - Business Program Manager - Azure Technical Trainer at Microsoft Dec 11, 2023
Full star icon Full star icon Full star icon Full star icon Empty star icon 4
I don't see myself as the target audience for this book, since I *live in Azure* every day, yet still enjoyed reading the book page-by-page. The fact that it is this complete, stretching over a lot of the Azure resources and services, combining both Architect-like as well as Administrator-like content, makes this a great book to have on your shelf. If you found this book in preparation for your AZ-305 exam, I hope you see this in time when you are working on the prerequisite of AZ-104, as this book will help you for both exams. The Architect-level details, together with the exercises for the Admin-level part of your cloud job role.
Amazon Verified review Amazon
Get free access to Packt library with over 7500+ books and video courses for 7 days!
Start Free Trial

FAQs

What is the delivery time and cost of print book? Chevron down icon Chevron up icon

Shipping Details

USA:

'

Economy: Delivery to most addresses in the US within 10-15 business days

Premium: Trackable Delivery to most addresses in the US within 3-8 business days

UK:

Economy: Delivery to most addresses in the U.K. within 7-9 business days.
Shipments are not trackable

Premium: Trackable delivery to most addresses in the U.K. within 3-4 business days!
Add one extra business day for deliveries to Northern Ireland and Scottish Highlands and islands

EU:

Premium: Trackable delivery to most EU destinations within 4-9 business days.

Australia:

Economy: Can deliver to P. O. Boxes and private residences.
Trackable service with delivery to addresses in Australia only.
Delivery time ranges from 7-9 business days for VIC and 8-10 business days for Interstate metro
Delivery time is up to 15 business days for remote areas of WA, NT & QLD.

Premium: Delivery to addresses in Australia only
Trackable delivery to most P. O. Boxes and private residences in Australia within 4-5 days based on the distance to a destination following dispatch.

India:

Premium: Delivery to most Indian addresses within 5-6 business days

Rest of the World:

Premium: Countries in the American continent: Trackable delivery to most countries within 4-7 business days

Asia:

Premium: Delivery to most Asian addresses within 5-9 business days

Disclaimer:
All orders received before 5 PM U.K time would start printing from the next business day. So the estimated delivery times start from the next day as well. Orders received after 5 PM U.K time (in our internal systems) on a business day or anytime on the weekend will begin printing the second to next business day. For example, an order placed at 11 AM today will begin printing tomorrow, whereas an order placed at 9 PM tonight will begin printing the day after tomorrow.


Unfortunately, due to several restrictions, we are unable to ship to the following countries:

  1. Afghanistan
  2. American Samoa
  3. Belarus
  4. Brunei Darussalam
  5. Central African Republic
  6. The Democratic Republic of Congo
  7. Eritrea
  8. Guinea-bissau
  9. Iran
  10. Lebanon
  11. Libiya Arab Jamahriya
  12. Somalia
  13. Sudan
  14. Russian Federation
  15. Syrian Arab Republic
  16. Ukraine
  17. Venezuela
What is custom duty/charge? Chevron down icon Chevron up icon

Customs duty are charges levied on goods when they cross international borders. It is a tax that is imposed on imported goods. These duties are charged by special authorities and bodies created by local governments and are meant to protect local industries, economies, and businesses.

Do I have to pay customs charges for the print book order? Chevron down icon Chevron up icon

The orders shipped to the countries that are listed under EU27 will not bear custom charges. They are paid by Packt as part of the order.

List of EU27 countries: www.gov.uk/eu-eea:

A custom duty or localized taxes may be applicable on the shipment and would be charged by the recipient country outside of the EU27 which should be paid by the customer and these duties are not included in the shipping charges been charged on the order.

How do I know my custom duty charges? Chevron down icon Chevron up icon

The amount of duty payable varies greatly depending on the imported goods, the country of origin and several other factors like the total invoice amount or dimensions like weight, and other such criteria applicable in your country.

For example:

  • If you live in Mexico, and the declared value of your ordered items is over $ 50, for you to receive a package, you will have to pay additional import tax of 19% which will be $ 9.50 to the courier service.
  • Whereas if you live in Turkey, and the declared value of your ordered items is over € 22, for you to receive a package, you will have to pay additional import tax of 18% which will be € 3.96 to the courier service.
How can I cancel my order? Chevron down icon Chevron up icon

Cancellation Policy for Published Printed Books:

You can cancel any order within 1 hour of placing the order. Simply contact customercare@packt.com with your order details or payment transaction id. If your order has already started the shipment process, we will do our best to stop it. However, if it is already on the way to you then when you receive it, you can contact us at customercare@packt.com using the returns and refund process.

Please understand that Packt Publishing cannot provide refunds or cancel any order except for the cases described in our Return Policy (i.e. Packt Publishing agrees to replace your printed book because it arrives damaged or material defect in book), Packt Publishing will not accept returns.

What is your returns and refunds policy? Chevron down icon Chevron up icon

Return Policy:

We want you to be happy with your purchase from Packtpub.com. We will not hassle you with returning print books to us. If the print book you receive from us is incorrect, damaged, doesn't work or is unacceptably late, please contact Customer Relations Team on customercare@packt.com with the order number and issue details as explained below:

  1. If you ordered (eBook, Video or Print Book) incorrectly or accidentally, please contact Customer Relations Team on customercare@packt.com within one hour of placing the order and we will replace/refund you the item cost.
  2. Sadly, if your eBook or Video file is faulty or a fault occurs during the eBook or Video being made available to you, i.e. during download then you should contact Customer Relations Team within 14 days of purchase on customercare@packt.com who will be able to resolve this issue for you.
  3. You will have a choice of replacement or refund of the problem items.(damaged, defective or incorrect)
  4. Once Customer Care Team confirms that you will be refunded, you should receive the refund within 10 to 12 working days.
  5. If you are only requesting a refund of one book from a multiple order, then we will refund you the appropriate single item.
  6. Where the items were shipped under a free shipping offer, there will be no shipping costs to refund.

On the off chance your printed book arrives damaged, with book material defect, contact our Customer Relation Team on customercare@packt.com within 14 days of receipt of the book with appropriate evidence of damage and we will work with you to secure a replacement copy, if necessary. Please note that each printed book you order from us is individually made by Packt's professional book-printing partner which is on a print-on-demand basis.

What tax is charged? Chevron down icon Chevron up icon

Currently, no tax is charged on the purchase of any print book (subject to change based on the laws and regulations). A localized VAT fee is charged only to our European and UK customers on eBooks, Video and subscriptions that they buy. GST is charged to Indian customers for eBooks and video purchases.

What payment methods can I use? Chevron down icon Chevron up icon

You can pay with the following card types:

  1. Visa Debit
  2. Visa Credit
  3. MasterCard
  4. PayPal
What is the delivery time and cost of print books? Chevron down icon Chevron up icon

Shipping Details

USA:

'

Economy: Delivery to most addresses in the US within 10-15 business days

Premium: Trackable Delivery to most addresses in the US within 3-8 business days

UK:

Economy: Delivery to most addresses in the U.K. within 7-9 business days.
Shipments are not trackable

Premium: Trackable delivery to most addresses in the U.K. within 3-4 business days!
Add one extra business day for deliveries to Northern Ireland and Scottish Highlands and islands

EU:

Premium: Trackable delivery to most EU destinations within 4-9 business days.

Australia:

Economy: Can deliver to P. O. Boxes and private residences.
Trackable service with delivery to addresses in Australia only.
Delivery time ranges from 7-9 business days for VIC and 8-10 business days for Interstate metro
Delivery time is up to 15 business days for remote areas of WA, NT & QLD.

Premium: Delivery to addresses in Australia only
Trackable delivery to most P. O. Boxes and private residences in Australia within 4-5 days based on the distance to a destination following dispatch.

India:

Premium: Delivery to most Indian addresses within 5-6 business days

Rest of the World:

Premium: Countries in the American continent: Trackable delivery to most countries within 4-7 business days

Asia:

Premium: Delivery to most Asian addresses within 5-9 business days

Disclaimer:
All orders received before 5 PM U.K time would start printing from the next business day. So the estimated delivery times start from the next day as well. Orders received after 5 PM U.K time (in our internal systems) on a business day or anytime on the weekend will begin printing the second to next business day. For example, an order placed at 11 AM today will begin printing tomorrow, whereas an order placed at 9 PM tonight will begin printing the day after tomorrow.


Unfortunately, due to several restrictions, we are unable to ship to the following countries:

  1. Afghanistan
  2. American Samoa
  3. Belarus
  4. Brunei Darussalam
  5. Central African Republic
  6. The Democratic Republic of Congo
  7. Eritrea
  8. Guinea-bissau
  9. Iran
  10. Lebanon
  11. Libiya Arab Jamahriya
  12. Somalia
  13. Sudan
  14. Russian Federation
  15. Syrian Arab Republic
  16. Ukraine
  17. Venezuela