2 - Design Identity and Security (25-30%).md

AZ-304: Design Identity and Security (25-30%)

Design authentication

• Recommend a solution for single-sign on (SSO)
  • What is single sign-on (SSO)?
  • Azure Active Directory Seamless Single Sign-On
  • Azure Active Directory Seamless Single Sign-On: FAQ
  • Azure Active Directory Seamless Single Sign-On: Quickstart
  • Configure SaaS apps for B2B collaboration
• Recommend a solution for authentication
  • Authentication flows and application scenarios
  • Authentication vs. authorization
• Recommend a solution for Conditional Access, including:
  • Multi-factor authentication (MFA)
    • Conditional Access: Require MFA for all users
    • Tutorial: Secure user sign-in events with Azure AD MFA
    • Conditional Access: Sign-in risk-based Conditional Access
• Recommend a solution for network access authentication
  • Using the location condition in a Conditional Access policy
• Recommend a solution for a hybrid identity including:
  • Azure AD Connect
    • What is Azure AD Connect?
    • Select which installation type to use for Azure AD Connect
    • Custom installation of Azure Active Directory Connect
  • Azure AD Connect Health
• Recommend a solution for user self-service
  • Plan an Azure Active Directory self-service password reset deployment
• Recommend and implement a solution for B2B integration
  • What is guest user access in Azure Active Directory B2B?
  • What are External Identities in Azure Active Directory?
• NOT: Federation with ADFS or PingFederate

Design authorization

• Choose an authorization approach
  • Authentication vs. authorization
• Recommend a hierarchical structure that includes:
  • Management groups
    • Quickstart: Create a management group
  • Subscriptions
  • Resource groups
• Recommend an access management solution including:
  • RBAC policies
  • Access reviews
    • Quickstart: Check access for a user to Azure resources
  • Role assignments
  • Privileged Identity Management (PIM)
  • Azure AD Identity Protection
  • Just In Time (JIT) access

Design governance

• Recommend a strategy for Tagging
• Recommend a solution for using Azure Policy
  • Tutorial: Create and manage policies to enforce compliance
• Recommend a solution for using Azure Blueprints
  • Quickstart: Define and assign a blueprint in the portal
• Recommend a solution that leverages Azure Resource Graph

Design security for applications

• Recommend a solution that includes KeyVault
  • Azure Key Vault keys, secrets and certificates overview
• Recommend a solution that includes Managed Identities
  • Use a Windows VM system-assigned managed identity to access Resource Manager
• Recommend a solution for integrating applications into Azure AD

Return to Table of Contents