What IAM is
Identity and access management is the set of processes and technology that make sure the right identities get the right access to the right resources, at the right time, for the right reasons, and that you can prove it afterwards. In UK public sector writing you will often see the same discipline called IDAM.
Four words get used loosely in day-to-day conversation. Keeping them separate makes everything else easier to follow.
The real person, service or device that needs access.
Asha Smith, finance analystThe record a system keeps for that identity. One identity often has several.
asmith@northgate.co.ukThe secret or key the account uses to prove it is genuine.
Password plus a FIDO2 keyA specific permission the account has been granted.
Member of Finance-ReadersThe identity is you. The account is your staff pass record. The credential is the pass and PIN you present. The entitlement is the list of doors the pass opens.
The four As
Every access decision passes through the same four stages. Most identity incidents are a failure at one of them.
The subject claims an identity, usually by entering a username.
The subject proves the claim with one or more factors.
The system decides what the proven identity may do.
Actions are logged so they can be traced back to the identity.
Authentication answers who are you? Authorisation answers what are you allowed to do? Mixing the two up is common. A Conditional Access policy that requires MFA is about authentication strength; a role assignment such as User Administrator is about authorisation.
Authentication factors and strength
Factors fall into three families: something you know (password, PIN), something you have (phone, security key) and something you are (fingerprint, face). Multi-factor authentication combines at least two different families.
Not all MFA is equal. The important question is whether the method can be phished: can an attacker trick the user into handing over, or approving, something the attacker then replays?
Phishing-resistant methods use public key cryptography bound to the genuine website's origin. A look-alike site cannot get a valid signature, so there is nothing to relay. That is why Lab 04 demands them for administrators.
Lab 02 moves users off SMS, Lab 03 requires MFA for everyone, and Lab 04 raises admin sign-ins to a phishing-resistant authentication strength.
Directories: Active Directory and Entra ID
A directory is the authoritative store of identities and their attributes. Most organisations run two, and they are often confused because of their names. Microsoft Entra ID was called Azure Active Directory until 2023, but it is not Active Directory moved to the cloud.
| Active Directory Domain Services | Microsoft Entra ID | |
|---|---|---|
| Where it runs | Domain controllers in your data centre | Microsoft-run cloud service |
| Main protocols | Kerberos, NTLM, LDAP | OpenID Connect, OAuth 2.0, SAML 2.0 |
| Typical resources | Domain-joined PCs, file shares, on-premises apps | Microsoft 365, SaaS apps, Azure, modern web apps |
| Structure | Forests, domains, organisational units, Group Policy | Flat tenant, groups, administrative units, Conditional Access |
| Managed with | AD tools, ActiveDirectory PowerShell module | Entra admin centre, Microsoft Graph and its PowerShell SDK |
When both exist, a synchronisation service (Entra Connect Sync or Cloud Sync) copies on-premises identities to Entra ID. That bridge is powerful and sensitive, which is the subject of Lab 09.
The protocols you will meet
You do not need to know these byte by byte, but you should recognise each one and know what job it does.
| Protocol | What it does | Where you meet it |
|---|---|---|
| Kerberos | Ticket-based authentication inside a Windows domain | Domain sign-in, file shares, Seamless SSO (Lab 09) |
| NTLM | Older challenge and response authentication | Legacy apps; Microsoft has announced its deprecation in Windows |
| LDAP | Reading and writing directory data | Apps that query Active Directory |
| SAML 2.0 | XML-based single sign-on between an identity provider and an app | Enterprise SaaS apps, AD FS federation |
| OAuth 2.0 | Delegated authorisation: lets an app call an API on a user's behalf using access tokens | Microsoft Graph scopes in every lab |
| OpenID Connect | An identity layer on top of OAuth 2.0 that adds the ID token | Modern sign-in to web and mobile apps |
| SCIM 2.0 | A standard API for creating, updating and removing accounts in other systems | Automatic provisioning to SaaS apps |
How a modern sign-in works
This is the OpenID Connect authorisation code flow, which is what happens behind most "Sign in with Microsoft" buttons. Conditional Access is evaluated at step 3, which is why it can demand MFA or block the sign-in before any token is issued.
The three tokens
- ID token: proves to the app who the user is. Meant for the app, not for APIs.
- Access token: a short-lived bearer token sent to an API. Its scopes (such as
User.Read.All) limit what it can do. - Refresh token: lets the app get new access tokens without asking the user to sign in again. Stealing one is valuable to an attacker, which is why session controls and Continuous Access Evaluation matter.
When you run Connect-MgGraph -Scopes ... interactively, you use delegated permissions: you act as yourself, limited by your own roles. The managed identity in Labs 06 and 11 uses application permissions: it acts as itself, with no signed-in user. Application permissions are usually broader, so grant them sparingly.
Identity types in Microsoft Entra ID
Your workforce. Created in Entra or synchronised from Active Directory.
External people invited through B2B collaboration. They authenticate at their own organisation.
Security and Microsoft 365 groups, assigned or dynamic. The main way to grant access at scale.
The app's definition and its instance in your tenant. Secrets and certificates live here.
Service principals for Azure resources with no secret to manage. Used by the runbooks in Labs 06 and 11.
Registered, joined or hybrid joined devices. Device state can be a Conditional Access signal.
Non-human identities (service principals, managed identities, automation accounts) now usually outnumber people in a tenant, and they are often less well governed. Keep that in mind in every lab.
Access models and principles
| Concept | Meaning | Example |
|---|---|---|
| RBAC | Role-based access control: permissions are bundled into roles, and people are assigned roles | Helpdesk Administrator can reset non-admin passwords |
| ABAC | Attribute-based access control: decisions use attributes of the user, resource and context | Dynamic group of everyone with department = Finance |
| Least privilege | Only the access needed, only for as long as it is needed | Just-in-time role activation in Lab 07 |
| Separation of duties | No single person can complete a sensitive process alone | Whoever creates accounts cannot also grant admin roles (Lab 08) |
| Need to know | Access to information is limited to people whose job requires it | Board papers restricted to directors |
Entra roles (such as Global Administrator) control the directory and Microsoft 365. Azure RBAC roles (such as Owner or Contributor) control Azure subscriptions and resources. They are assigned separately, and holding one does not grant the other, although a Global Administrator can elevate themselves to manage all Azure subscriptions.
Zero Trust in one picture
Zero Trust is a strategy, not a product. Microsoft describes it with three principles, and NIST SP 800-207 sets out the architecture in more depth. Identity is the main control plane in every version of it.
Decide every request using all available signals: identity, device, location, risk. Labs 03, 04 and 10.
Just-in-time and just-enough access, reviewed regularly. Labs 07 and 08.
Limit blast radius, segment access, and detect and respond quickly. Labs 06, 09 and 10.
Key takeaways
- Keep identity, account, credential and entitlement separate in your head.
- Authentication proves who you are; authorisation decides what you can do.
- Prefer phishing-resistant methods, especially for privileged roles.
- Active Directory and Entra ID are different directories with different protocols.
- OAuth scopes and Entra roles are both authorisation, at different layers.
- Non-human identities need the same governance as people.