{"id":906,"date":"2022-02-12T15:30:00","date_gmt":"2022-02-12T15:30:00","guid":{"rendered":"https:\/\/thecloudmarathoner.com\/?p=906"},"modified":"2022-04-25T13:55:40","modified_gmt":"2022-04-25T13:55:40","slug":"study-guide-for-az-305-part-2-design-authentication-and-authorization-solutions","status":"publish","type":"post","link":"https:\/\/thecloudmarathoner.com\/index.php\/2022\/02\/12\/study-guide-for-az-305-part-2-design-authentication-and-authorization-solutions\/","title":{"rendered":"Study Guide for AZ-305:                     Part 2 &#8211; Design Authentication and Authorization Solutions"},"content":{"rendered":"\n<p>Hi Cloud Marathoners!<\/p>\n\n\n\n<p>This is the continuation (Part 2\/12) of blog post series to help you get ready for the latest <a rel=\"noreferrer noopener\" href=\"https:\/\/docs.microsoft.com\/en-us\/learn\/certifications\/exams\/az-305\" target=\"_blank\">AZ-305 exam<\/a>. As title says &#8211; our focus will be on understanding and designing Authentication and Authorization Solutions in Microsoft Azure.<br><br>Feel free to check the previous post (<a rel=\"noreferrer noopener\" href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/02\/11\/study-guide-for-az-305-designing-microsoft-azure-infrastructure-solutions-part-1-design-a-governance-solution\/\" target=\"_blank\">Part 1\/12<\/a>) if you did not look into it yet \ud83d\ude42 <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"table-of-content-blog-series\">Table of content (blog series)<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>*** Design Identity, Governance, and Monitoring Solutions ***<\/strong><\/li><li><a rel=\"noreferrer noopener\" href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/02\/11\/study-guide-for-az-305-designing-microsoft-azure-infrastructure-solutions-part-1-design-a-governance-solution\/\" target=\"_blank\">Part 1: Design a governance solution<\/a><\/li><li><a href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/02\/12\/study-guide-for-az-305-part-2-design-authentication-and-authorization-solutions\/\">Part 2:&nbsp;Design Authentication and Authorization Solutions<\/a><\/li><li><a rel=\"noreferrer noopener\" href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/02\/19\/study-guide-for-az-305-part-3-design-a-solution-to-log-and-monitor-azure-resources\/\" target=\"_blank\">Part 3:&nbsp;Design a solution to log and monitor Azure resources<\/a><\/li><li><strong>*** Design Infrastructure Solutions ***<\/strong><\/li><li><a rel=\"noreferrer noopener\" href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/02\/24\/study-guide-for-az-305-part-4-design-a-compute-solution\/\" target=\"_blank\">Part 4: Design a compute solution<\/a><\/li><li><a rel=\"noreferrer noopener\" href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/03\/07\/study-guide-for-az-305-part-5-design-an-application-architecture-solution\/\" target=\"_blank\">Part 5:&nbsp;Design an application architecture solution<\/a><\/li><li><a rel=\"noreferrer noopener\" href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/03\/11\/study-guide-for-az-305-part-6-design-a-network-infrastructure-solution\/\" target=\"_blank\">Part 6:&nbsp;Design a network infrastructure solution<\/a><\/li><li><a rel=\"noreferrer noopener\" href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/03\/19\/study-guide-for-az-305-part-7-design-a-migration-solution\/\" target=\"_blank\">Part 7:&nbsp;Design a migration solution<\/a><\/li><li><strong>*** Design Data Storage Solutions ****<\/strong><\/li><li><a rel=\"noreferrer noopener\" href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/03\/25\/study-guide-az-305-part-8-design-a-non-relational-storage-solution\/\" target=\"_blank\">Part 8:&nbsp;Design a non-relational data storage solution<\/a><\/li><li><a href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/04\/01\/study-guide-az-305-part-9-design-a-data-storage-solution-for-relational-data\/\">Part 9:&nbsp;Design a data storage solution for relational data<\/a><\/li><li><a href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/04\/10\/study-guide-az-305-part-10-design-a-data-integration-solution\/\">Part 10:&nbsp;Design a data integration solution<\/a><\/li><li><strong><strong>*** Design Business Continuity Solutions ***<\/strong><\/strong><\/li><li><a href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/04\/16\/study-guide-az-305-part-11-design-for-business-continuity-backup-and-disaster-recovery\/\">Part 11:&nbsp;Design a solution for Business Continuity, backup and disaster recovery<\/a>&nbsp;<\/li><li><a href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/04\/22\/study-guide-for-az-305-part-12-design-for-high-availability\/\" target=\"_blank\" rel=\"noreferrer noopener\">Part 12: Design for high availability<\/a><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"what-is-the-authentication-and-authorization\">What is the Authentication and Authorization?<\/h3>\n\n\n\n<p>To put it in plain English language,&nbsp;authentication is the process of verifying who someone is, where as authorization is the process of verifying what specific applications, files, and data a user has access to.<\/p>\n\n\n\n<p>To relate these concepts to a real-world scenarious, you may think about your airport access and on-boarding to the plane experience.  Thus, when you go through the security in an airport, you are required to show your ID to authenticate your identity. Then, you proceed and arrive at the gate, you present your boarding pass to the flight attendant, so they can authorize you to board your flight and allow access to your assigned seat.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/miro.medium.com\/max\/1400\/0*Ggee4mghBiY6OxJV\" alt=\"Authentication vs Authorization. Authentication vs. Authorization\u2014 These\u2026 |  by Frank D'Amico | Medium\"\/><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"what-you-can-do-with-authentication-and-authorization\">WHAT YOU CAN DO WITH Authentication and Authorization?<\/h4>\n\n\n\n<p>The authentication and authorization services are part of the <a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/develop\/?WT.mc_id=AZ-MVP-5004750\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft&#8217;s identity platform<\/a>.<\/p>\n\n\n\n<p>The Authentication sometimes shortened to&nbsp;<strong>&#8216;AuthN&#8217;<\/strong>. <br>The Microsoft identity platform uses the&nbsp;<a href=\"https:\/\/openid.net\/connect\/\">OpenID Connect<\/a>&nbsp;protocol for handling authentication. On the other hand, Authorization  sometimes shortened to&nbsp;<strong>&#8216;AuthZ<\/strong>&#8216;. The Microsoft identity platform uses the&nbsp;<a href=\"https:\/\/oauth.net\/2\/\">OAuth 2.0<\/a>&nbsp;protocol for handling authorization.<\/p>\n\n\n\n<p>In Microsoft Azure your authentication and authorization is delegated to Azure Active Directory (Azure AD). By using this centralized identity provider you can enable following secure workflows for your business:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Conditional Access policies &#8211; that require a user to be in a specific location.<\/li><li>The use of&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/concept-mfa-howitworks\/?WT.mc_id=AZ-MVP-5004750\">multi-factor authentication<\/a>, which is sometimes called two-factor authentication or 2FA.<\/li><li>Enabling a user to sign in once and then be automatically signed in to all of the web apps that share the same centralized directory. This capability is called&nbsp;<em>single sign-on (SSO)<\/em>.<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/newsignature.com\/wp-content\/uploads\/2019\/05\/5030991-637118249809250355-16x9-1-1024x683.jpg\" alt=\"From AD to Azure AD \u2013 Your Hybrid Identity Journey - New Signature\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"part-2-designing-authentication-and-authorization-solutions\">Part 2: Designing Authentication and Authorization solutions<\/h4>\n\n\n\n<p>The references below are taken from official Microsoft docs and focused on designing Azure Authentication and Authorization solutions. You could also find it helpful to check the Microsoft docs and learning paths with [Tutorials] below \ud83d\ude42<\/p>\n\n\n\n<p>This collection of links is gathered with a focus on the exam objectives of the AZ-305 certification exam.<\/p>\n\n\n\n<p><a href=\"https:\/\/docs.microsoft.com\/azure\/security\/fundamentals\/identity-management-overview\/?WT.mc_id=AZ-MVP-5004750\">Azure identity management security overview<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/security\/fundamentals\/identity-management-best-practices\/?WT.mc_id=AZ-MVP-5004750\">Azure Identity Management and access control security best practices<\/a>  <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/security\/fundamentals\/steps-secure-identity\/?WT.mc_id=AZ-MVP-5004750\">Five steps to securing your identity infrastructure<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/azure\/active-directory\/fundamentals\/active-directory-whatis\/?WT.mc_id=AZ-MVP-5004750\">What is Azure Active Directory?<\/a><br><a rel=\"noreferrer noopener\" href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/fundamentals\/active-directory-compare-azure-ad-to-ad\/?WT.mc_id=AZ-MVP-5004750\" target=\"_blank\">Compare Active Directory to Azure Active Directory<\/a>  <br><a rel=\"noreferrer noopener\" href=\"https:\/\/docs.microsoft.com\/azure\/active-directory\/external-identities\/b2b-fundamentals\/?WT.mc_id=AZ-MVP-5004750\" target=\"_blank\">Azure Active Directory B2B best practices<\/a> <br><a rel=\"noreferrer noopener\" href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/external-identities\/cross-tenant-access-overview\/?WT.mc_id=AZ-MVP-5004750\" target=\"_blank\">Overview: Cross-tenant access with Azure AD External Identities (Preview)<\/a> <br><a rel=\"noreferrer noopener\" href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/external-identities\/identity-providers\/?WT.mc_id=AZ-MVP-5004750\" target=\"_blank\">Identity Providers for External Identities<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/external-identities\/authentication-conditional-access\/?WT.mc_id=AZ-MVP-5004750\">Authentication and Conditional Access for External Identities<\/a><br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory-b2c\/overview\/?WT.mc_id=AZ-MVP-5004750\">What is Azure Active Directory B2C?<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory-b2c\/technical-overview\/?WT.mc_id=AZ-MVP-5004750\">Technical and feature overview of Azure Active Directory B2C<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/conditional-access\/overview\/?WT.mc_id=AZ-MVP-5004750\">What is Conditional Access?<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/conditional-access\/plan-conditional-access\/?WT.mc_id=AZ-MVP-5004750\">Plan a Conditional Access deployment<\/a><br><br>[<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/tutorial-enable-azure-mfa\/?WT.mc_id=AZ-MVP-5004750\">Tutorial]: Secure user sign-in events with Azure AD Multi-Factor Authentication<\/a> <br><a rel=\"noreferrer noopener\" href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/tutorial-enable-sspr\/?WT.mc_id=AZ-MVP-5004750\" target=\"_blank\">[Tutorial]: Enable users to unlock their account or reset passwords using Azure AD self-service password reset (SSPR)<\/a><br><a rel=\"noreferrer noopener\" href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/authentication\/tutorial-enable-sspr-writeback\/?WT.mc_id=AZ-MVP-5004750\" target=\"_blank\">[Tutorial]: Enable Azure Active Directory self-service password reset writeback to an on-premises environment<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/identity-protection\/overview-identity-protection\/?WT.mc_id=AZ-MVP-5004750\">What is Identity Protection?<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/identity-protection\/concept-identity-protection-risks\/?WT.mc_id=AZ-MVP-5004750\">What is risk?<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/identity-protection\/concept-identity-protection-security-overview\/?WT.mc_id=AZ-MVP-5004750\">Azure Active Directory Identity Protection &#8211; Security overview <\/a><br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/identity-protection\/concept-identity-protection-policies\/?WT.mc_id=AZ-MVP-5004750\">Identity Protection policies<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/governance\/access-reviews-overview\/?WT.mc_id=AZ-MVP-5004750\">What are Azure AD access reviews?<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/managed-identities-azure-resources\/overview\/?WT.mc_id=AZ-MVP-5004750\">What are managed identities for Azure resources?<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/governance\/what-is-identity-lifecycle-management\/?WT.mc_id=AZ-MVP-5004750\">What is identity lifecycle management?<\/a><br><br><a href=\"https:\/\/docs.microsoft.com\/en-us\/learn\/modules\/azure-well-architected-security\/?WT.mc_id=AZ-MVP-5004750\">Microsoft Azure Well-Architected Framework &#8211; Security<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/learn\/modules\/authenticate-apps-with-managed-identities\/?WT.mc_id=AZ-MVP-5004750\" target=\"_blank\" rel=\"noreferrer noopener\">Authenticate apps to Azure services by using service principals and managed identities for Azure resources<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/develop\/app-objects-and-service-principals\/?WT.mc_id=AZ-MVP-5004750\">Application and service principal objects in Azure AD<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/key-vault\/general\/basic-concepts\/?WT.mc_id=AZ-MVP-5004750\">Azure Key Vault basic concepts<\/a><br><br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/key-vault\/general\/best-practices\/?WT.mc_id=AZ-MVP-5004750\">Best practices for using Azure Key Vault<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/key-vault\/general\/logging\/?WT.mc_id=AZ-MVP-5004750\">Azure Key Vault logging<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/key-vault\/general\/overview-vnet-service-endpoints\/?WT.mc_id=AZ-MVP-5004750\">Virtual network service endpoints for Azure Key Vault<\/a> <br><a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/key-vault\/general\/event-grid-overview\/?WT.mc_id=AZ-MVP-5004750\">Monitoring Key Vault with Azure Event Grid<\/a> <\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"summary\">SUMMARY<\/h4>\n\n\n\n<p>Thank you for visiting the AZ-305 Study Guide and checking the <em><a href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/02\/12\/study-guide-for-az-305-part-2-design-authentication-and-authorization-solutions\/\">Part 2 <strong>\u2013 <\/strong>Designing Authentication and Authorization Solutions<\/a><\/em>.<br><br>The next blog will cover the<a rel=\"noreferrer noopener\" href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/02\/19\/study-guide-for-az-305-part-3-design-a-solution-to-log-and-monitor-azure-resources\/\" target=\"_blank\">&nbsp;<em>Part 3:&nbsp;<em>Design a solution to log and monitor Azure resources<\/em><\/em><\/a>.<\/p>\n<div class=\"pvc_clear\"><\/div><p id=\"pvc_stats_906\" class=\"pvc_stats all  \" data-element-id=\"906\" style=\"\"><i class=\"pvc-stats-icon medium\" aria-hidden=\"true\"><svg aria-hidden=\"true\" focusable=\"false\" data-prefix=\"far\" data-icon=\"chart-bar\" role=\"img\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 512 512\" class=\"svg-inline--fa fa-chart-bar fa-w-16 fa-2x\"><path fill=\"currentColor\" d=\"M396.8 352h22.4c6.4 0 12.8-6.4 12.8-12.8V108.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v230.4c0 6.4 6.4 12.8 12.8 12.8zm-192 0h22.4c6.4 0 12.8-6.4 12.8-12.8V140.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v198.4c0 6.4 6.4 12.8 12.8 12.8zm96 0h22.4c6.4 0 12.8-6.4 12.8-12.8V204.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v134.4c0 6.4 6.4 12.8 12.8 12.8zM496 400H48V80c0-8.84-7.16-16-16-16H16C7.16 64 0 71.16 0 80v336c0 17.67 14.33 32 32 32h464c8.84 0 16-7.16 16-16v-16c0-8.84-7.16-16-16-16zm-387.2-48h22.4c6.4 0 12.8-6.4 12.8-12.8v-70.4c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v70.4c0 6.4 6.4 12.8 12.8 12.8z\" class=\"\"><\/path><\/svg><\/i> <img loading=\"lazy\" decoding=\"async\" width=\"16\" height=\"16\" alt=\"Loading\" src=\"\/wp-content\/plugins\/page-views-count\/ajax-loader-2x.gif\" border=0 \/><\/p><div class=\"pvc_clear\"><\/div>","protected":false},"excerpt":{"rendered":"<p>Hi Cloud Marathoners! This is the continuation (Part 2\/12) of blog post series to help you get ready for the latest AZ-305 exam. As title says &#8211; our focus will be on understanding and designing Authentication and Authorization Solutions in Microsoft Azure. Feel free to check the previous post (Part 1\/12) if you did not &hellip; <a href=\"https:\/\/thecloudmarathoner.com\/index.php\/2022\/02\/12\/study-guide-for-az-305-part-2-design-authentication-and-authorization-solutions\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Study Guide for AZ-305:                     Part 2 &#8211; Design Authentication and Authorization Solutions&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,28,6,34,29],"tags":[],"class_list":["post-906","post","type-post","status-publish","format-standard","hentry","category-architecture","category-azure-active-directory","category-certification","category-identity-and-access-management","category-study-guides"],"_links":{"self":[{"href":"https:\/\/thecloudmarathoner.com\/index.php\/wp-json\/wp\/v2\/posts\/906","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thecloudmarathoner.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thecloudmarathoner.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thecloudmarathoner.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thecloudmarathoner.com\/index.php\/wp-json\/wp\/v2\/comments?post=906"}],"version-history":[{"count":36,"href":"https:\/\/thecloudmarathoner.com\/index.php\/wp-json\/wp\/v2\/posts\/906\/revisions"}],"predecessor-version":[{"id":1417,"href":"https:\/\/thecloudmarathoner.com\/index.php\/wp-json\/wp\/v2\/posts\/906\/revisions\/1417"}],"wp:attachment":[{"href":"https:\/\/thecloudmarathoner.com\/index.php\/wp-json\/wp\/v2\/media?parent=906"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thecloudmarathoner.com\/index.php\/wp-json\/wp\/v2\/categories?post=906"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thecloudmarathoner.com\/index.php\/wp-json\/wp\/v2\/tags?post=906"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}