What's changed: Created SC-100 Chapter 3 (Domain 2 second-half: Entra ID/hybrid identity (Entra Connect, PHS/PTA/federation)/external identity (B2B/decentralized); Conditional Access/Entra ID Protection risk/CAE/protected actions/AD DS hardening/Key Vault/managed identity; enterprise access model/PIM/entitlement management/access reviews/CIEM (Entra Permissions Management)/PAW; regulatory compliance (requirements→controls)/Microsoft Purview/Microsoft Priva/Azure Policy/Defender for Cloud regulatory dashboard).
3.2Modern authentication/authorization and Conditional Access
Understand a modern authentication/authorization strategy including Conditional Access, continuous access evaluation (CAE), risk scoring, and protected actions; validating Conditional Access alignment with Zero Trust; AD DS hardening; and managing secrets/keys/certificates.
Modern authorization is not "log in once and you’re done." It evaluates continuously based on signals and tightens immediately when risk rises. The keystones are Conditional Access plus CAE and Identity Protection risk evaluation that complement it.
3.2.1Conditional Access and risk-based access
Conditional Access is an authorization engine defining "if (user/location/device compliance/app/risk) then (allow/block/MFA/require compliant device)." Microsoft Entra ID Protection scores user risk/sign-in risk via ML, and CA responds risk-based: "high sign-in risk → MFA, high user risk → password change." Continuous access evaluation (CAE) revokes sessions immediately on dangerous changes (account disabled, location change) without waiting for token expiry. Architects combine these to implement Zero Trust’s "verify explicitly."
3.2.2Protected actions and AD DS hardening
Apply protected actions to the most dangerous operations (e.g., deleting CA policies), blocking them unless a strong authentication context (e.g., phishing-resistant MFA) is met. On-prem AD DS remains a key target—design hardening requirements such as a tier model/privileged-access separation, reducing unneeded rights, and disabling legacy protocols. Centralize keys and secrets in Azure Key Vault (HSM option), and rather than distributing keys to apps, let them access via managed identity.
Cues: "allow/MFA/block by condition" = Conditional Access. "score risk" = Entra ID Protection. "revoke sessions immediately on dangerous change (don’t wait for token expiry)" = CAE. "require strong auth for ultra-dangerous ops like deleting CA" = protected actions. "give apps access without distributing keys" = managed identity + Key Vault.
Watch the mix-ups: (1) CAE tightens immediately without waiting for token expiry—unlike token-lifetime reliance. (2) Distinguish user risk (credential compromise) from sign-in risk (anomaly this session). (3) Prefer staged MFA via risk and protected actions over a blanket one-size-fits-all.
3.2.3Section summary
- Conditional Access = allow/MFA/block by condition; risk-based via Entra ID Protection risk
- CAE = immediate session revocation on dangerous change; protected actions = require strong auth context for ultra-dangerous ops
- Harden AD DS via tiering/privileged separation; keys/secrets in Key Vault + managed identity (don’t distribute keys)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To cut off access the moment an account is disabled—without waiting for token expiry—which is best?
Q2. To require MFA only when sign-in risk is high, without impeding low-risk sign-ins, which is best?
Q3. To require phishing-resistant MFA for the most dangerous admin operations, such as deleting Conditional Access policies, which is best?
Q4. To let an application access Azure resources/Key Vault without distributing keys, which is best?
Q5. Which is the most appropriate AD DS hardening design?