Question 1

What is Conditional Access?

Accepted Answer

A policy engine that evaluates every Entra ID sign-in against conditions (user, location, device, risk, app) and enforces controls (allow, block, require MFA, require compliant device). It is the modern replacement for network perimeter security.

Question 2

How does PIM reduce standing privilege?

Accepted Answer

PIM replaces permanent role assignments with eligible + activation. A user has the permission to activate a role but only does so when needed, with MFA, optional approval, and a time bound (1-24 hours). After expiration the role is gone.

Question 3

What is the difference between B2B and External ID?

Accepted Answer

Entra B2B invites external users into your workforce tenant — they authenticate with their own credentials and access your resources as guests. External ID (formerly B2C) is a separate customer identity layer for your apps — social IdPs, custom policies, branded sign-up.

Question 4

What is a Managed Identity?

Accepted Answer

An Azure-managed credential for Azure resources. Two types: system-assigned (one per resource) and user-assigned (shared across resources). No client secret to leak, no rotation to manage. Used by App Service, VMs, Functions, AKS via Workload Identity.

Question 5

What is the Entra ID default role for a new tenant?

Accepted Answer

No default user has Global Administrator. You (the creator) are the first Global Admin. Best practice: create 2-3 break-glass Global Admins, then assign privileged roles only via PIM to specific users.

Question 6

How do Access Reviews reduce standing privilege?

Accepted Answer

Access Reviews force periodic attestation by resource owners. If a user no longer needs access, the owner removes them. Without Access Reviews, group memberships and app permissions accumulate indefinitely.

Question 7

What is Entra Connect used for?

Accepted Answer

Synchronising on-prem Active Directory users, groups, and passwords to Entra ID. Three auth methods: Password Hash Sync (cheapest), Pass-Through Authentication, ADFS federation (legacy). Modern alternative: Entra Cloud Sync.

Question 8

How would you protect Global Admins?

Accepted Answer

PIM for just-in-time elevation. Conditional Access requiring MFA + compliant device + phishing-resistant auth. Two break-glass accounts excluded from CA with monitoring alerts. Quarterly Access Reviews of admin roles.

Question 9

What is Workload Identity Federation?

Accepted Answer

OIDC-based federation between Entra ID and external workloads (AKS pods, GitHub Actions, GitLab CI). The external workload receives an Entra ID token without storing any client secret.

Question 10

How does Conditional Access handle legacy authentication?

Accepted Answer

Block legacy authentication is a one-click toggle in CA. Legacy protocols (POP3, IMAP, basic auth) cannot satisfy modern MFA challenges, so blocking them closes the #1 attack vector against Entra ID tenants.

Question 11

What is the difference between a security group and a Microsoft 365 group?

Accepted Answer

Security groups are for access control (members + permissions). Microsoft 365 groups add collaboration features (mailbox, SharePoint, Teams). Entra ID supports both; PIM works with both; Conditional Access works the same way for both.

Question 12

How do you give an Azure VM access to Key Vault?

Accepted Answer

Enable Managed Identity on the VM (system-assigned or user-assigned). Grant the identity `get` and `list` permissions on Key Vault secrets via an access policy or RBAC. No secrets in code, no rotation to manage.

Question 13

What is dynamic group membership?

Accepted Answer

A dynamic group automatically adds/removes users based on rules over user attributes (department, location, jobTitle). Useful for auto-licensing, auto-Conditional Access scoping, auto-team membership.

Question 14

What is the Microsoft Graph API?

Accepted Answer

The unified API for Entra ID, Microsoft 365, and Azure. Single endpoint for users, groups, mail, files, Teams. Powers most Entra-integrated tooling and custom automation.

Question 15

How do you handle guest users securely?

Accepted Answer

Conditional Access requiring MFA on invitee IdP. Restricted guest access by default (no enumeration of users, no group creation). External access reviews quarterly. Just-in-time guest invitations via access packages.

Question 16

What is an Access Package?

Accepted Answer

An Entra ID Governance concept — a bundle of resources (apps, groups, SharePoint sites) with an approval workflow and time-bound access. Used for B2B partners, contractors, internal project teams.

Question 17

How do you detect Entra ID compromise?

Accepted Answer

Monitor Azure AD audit logs + sign-in logs. Wire to SIEM (Sentinel, Splunk). Alert on: impossible travel, unfamiliar sign-in properties, MFA fatigue patterns, OAuth consent grants to unknown apps, PIM activations outside business hours.

Question 18

What is the role of Entra ID in a defence-in-depth strategy?

Accepted Answer

Entra ID is the identity layer — it enforces authentication and authorisation for every Microsoft 365 and Azure resource. Combined with Conditional Access, PIM, and Access Reviews, it is the most important control surface for Microsoft-stack tenants.

Question 19

How do you migrate from ADFS to Entra ID?

Accepted Answer

Phase 1: stand up Entra Connect with Pass-Through Authentication. Phase 2: parallel run with ADFS. Phase 3: cut over per application with seamless SSO. Phase 4: decommission ADFS. Expect months of phased migration, not weeks.

Question 20

What is the difference between authentication and authorisation in Entra ID?

Accepted Answer

Authentication is proving identity (sign-in, MFA, tokens). Authorisation is granting access (RBAC for Azure, app role assignments for apps). Conditional Access acts at authentication; RBAC + access packages act at authorisation.

Question 21

How do you enforce MFA on a third-party SaaS app?

Accepted Answer

Configure the SaaS app for SAML/OIDC SSO via Entra ID. Add the app to a Conditional Access policy requiring MFA. Users authenticate to Entra ID with MFA; Entra ID issues the token to the SaaS.

Question 22

What is Pass-Through Authentication?

Accepted Answer

PTA is an Entra Connect auth method where a lightweight agent on-prem validates passwords against AD. Users get single sign-on without password hash sync. Less secure than PHS but keeps passwords on-prem.

Question 23

How do you secure service-to-service auth in Azure?

Accepted Answer

Use Managed Identity wherever possible. For multi-cloud or external workloads, use Workload Identity Federation (OIDC). Avoid client secrets in config — they leak. Rotate any remaining secrets via Azure Key Vault with auto-rotation.

Question 24

What is the risk of not using Conditional Access?

Accepted Answer

Without CA, any user with valid credentials can sign in from anywhere, on any device, with no MFA challenge. This is the default tenant posture. Almost every Entra ID compromise could have been prevented by even a baseline CA policy.

Question 25

How do you scope Conditional Access policies?

Accepted Answer

Use named locations, user/group targeting, app targeting. Avoid "All users" except for baseline MFA. Tier admin access (Global Admin, Exchange Admin) with stricter policies than regular users. Test with report-only mode before enforcing.