> For the complete documentation index, see [llms.txt](https://ghoulsec.gitbook.io/ghoulsec-vault/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ghoulsec.gitbook.io/ghoulsec-vault/exam-prep-notes/sc-900/microsoft-identity-as-primary-security-perimeter.md).

# Microsoft Identity as Primary Security Perimeter

In Microsoft’s security model, **Identity** is the foundational layer. By making **identity verification** a primary security perimeter, Microsoft ensures that only trusted users, applications, devices, and identities can access resources. This approach integrates **user**, **application**, **device**, **cloud/on-premises identities**, and other factors to enforce strong authentication and authorization measures.

***

## 1. Identity Verification 

{% tabs %}
{% tab title="Users" %}
The **user** is the most common entity in identity verification. Users must be authenticated using secure methods like **Multi-Factor Authentication (MFA)**, **password policies**, or **biometric verification** (fingerprint, face recognition). Verification ensures the user requesting access is indeed the legitimate one.
{% endtab %}

{% tab title="Applications" %}
**Applications**:\
Applications need to authenticate themselves before accessing resources, especially when accessing data on behalf of a user. This is typically achieved through **OAuth 2.0**, **OpenID Connect**, and **API security mechanisms** such as **client secrets** or **certificates**.
{% endtab %}

{% tab title="Devices" %}
**Devices**:\
**Device identity verification** ensures that the devices accessing corporate resources are trusted. This can include:

* **Azure AD Join** and **Intune** to manage device compliance.
* **Conditional Access** policies that require devices to meet security standards (e.g., device encryption or up-to-date antivirus software).

Ensuring that only compliant, trusted devices can access corporate resources is critical for preventing unauthorized access.
{% endtab %}

{% tab title="Cloud/On-Prem" %}
**Cloud / On-Premises Identities**:\
Users, applications, and devices can have identities either in the **cloud** (via **Azure Active Directory**) or on-premises (via **Active Directory**). Microsoft enables hybrid identity solutions, where you can synchronize or federate identities between **Azure AD** (cloud) and **Active Directory** (on-prem). This allows seamless access to resources regardless of where the identities are stored.

* **Azure AD Connect**: Synchronizes on-premises Active Directory with Azure AD, enabling a unified identity across both environments.
* **Federated Identities**: Enables single sign-on (SSO) across cloud and on-premises resources.
  {% endtab %}

{% tab title="Other" %}
**Other**:\
There may be other identity sources in an organization’s environment, such as **guest users** or **third-party providers**. These are often integrated into **Azure AD B2B** or **B2C** to enable secure external access or collaboration.
{% endtab %}
{% endtabs %}

## 2. Pillars of Identity

**Identity management** in Microsoft’s framework involves three primary pillars: **Administration**, **Authentication**, **Authorization**, and **Auditing**. These pillars work together to ensure that only authorized identities can access resources in a secure and compliant way.

> **Administration**
>
> * **Identity Administration** refers to the management of user identities, roles, and access to resources. This includes:
>
>   * **User lifecycle management** (creation, modification, deletion of users).
>   * **Role-based Access Control (RBAC)**: Administrators assign roles to users, granting them the right level of access to resources.
>   * **Self-service tools** (e.g., **Azure AD Self-Service Password Reset**) that allow users to manage their own identities.
>
>   **Tools**:
>
>   * **Azure Active Directory** provides centralized management for identities.
>   * **Microsoft Entra** focuses on unified identity governance.

> **Authentication**
>
> * **Authentication** ensures that the identity claiming access is legitimate. Microsoft offers multiple secure authentication methods:
>   * **Username and Password**: The most basic form of authentication, but vulnerable to attacks such as phishing and brute force.
>   * **Multi-Factor Authentication (MFA)**: Adds an extra layer of security by requiring two or more methods of authentication (something you know, something you have, something you are).
>   * **Biometric Authentication**: Fingerprints, facial recognition, and other biometric factors provide high assurance that the user is genuine.
>   * **Single Sign-On (SSO)**: Users authenticate once and are granted access to all resources without needing to re-enter credentials, which improves both security and user experience.
>   * **Certificate-Based Authentication**: Secure, strong authentication using digital certificates to identify users and devices.

> **Authorization**
>
> * **Authorization** is the process of determining if an authenticated user has the necessary permissions to access a resource. It ensures that users can only access resources for which they have been granted permission.
>   * **Role-Based Access Control (RBAC)**: Provides fine-grained access control by assigning roles to users and defining what actions those roles can perform on specific resources.
>   * **Attribute-Based Access Control (ABAC)**: Access is based on the attributes of the user, environment, and resource (e.g., user’s department, location, device compliance).
>   * **Conditional Access Policies**: These policies allow organizations to enforce access restrictions based on factors like location, device compliance, user risk, and more. For example, an employee in the U.S. might be able to access a corporate resource, but an employee in another country might be blocked or required to use additional authentication methods.

> **Auditing**
>
> * **Auditing** involves the continuous monitoring of identity-related activities to ensure that all access attempts are legitimate and that the identity system is functioning securely.
>   * **Audit Logs**: Microsoft services like **Azure AD** provide detailed logs of user sign-ins, changes to permissions, and resource access.
>   * **Security Monitoring**: Tools like **Azure Sentinel** can analyze audit logs and detect unusual or potentially malicious activity, providing alerts in real-time.
>   * **Compliance Reporting**: Regular audits ensure compliance with regulatory standards like **GDPR**, **HIPAA**, and **SOX**. Microsoft provides reporting tools to assist in tracking and maintaining compliance.