Q1: What is Microsoft Entra ID and how does it differ from traditional Active Directory?
Microsoft Entra ID (formerly Azure AD) is a cloud-based identity and access management service. Unlike traditional Active Directory which is on-premises and uses LDAP/Kerberos, Microsoft Entra ID is cloud-native, uses modern protocols like OAuth 2.0/SAML, and is designed for internet-scale applications and SaaS integration.
Q2: How do you create and manage users in Microsoft Entra ID?
Users can be created through:
- Azure Portal (single or bulk creation)
- PowerShell using
New-AzureADUsercmdlet - Azure CLI using
az ad user create - Microsoft Graph API
- Synchronized from on-premises AD using Azure AD Connect
- Invited as guest users (B2B collaboration)
Q3: What are the different types of groups in Microsoft Entra ID?
- Security Groups: Used for managing access to resources
- Microsoft 365 Groups: Provide collaboration services (email, SharePoint, Teams)
- Assignment Types: Assigned (manual membership) or Dynamic (rule-based membership)
Q4: Explain Self-Service Password Reset (SSPR) in Azure.
SSPR allows users to reset their own passwords without IT intervention. Key features:
- Authentication methods: Phone, email, security questions, Microsoft Authenticator
- Requires Azure AD Premium P1 or P2 license
- Can be configured with password writeback to sync with on-premises AD
- Administrators can configure minimum number of authentication methods required
Q5: What are managed identities in Azure?
Managed identities provide Azure services with automatically managed credentials in Microsoft Entra ID:
- System-assigned: Tied to a specific Azure resource lifecycle
- User-assigned: Independent identity that can be assigned to multiple resources
- Eliminates need to store credentials in code
Q6: What are the built-in Azure roles and their hierarchy?
- Owner: Full access including ability to delegate access
- Contributor: Can create and manage resources but cannot grant access
- Reader: View-only access to resources
- User Access Administrator: Can manage user access to Azure resources
Q7: At what scopes can you assign RBAC roles?
RBAC roles can be assigned at four scopes (hierarchical):
- Management Group: Highest level, applies to multiple subscriptions
- Subscription: Applies to all resource groups in subscription
- Resource Group: Applies to all resources in the group
- Resource: Individual resource level
Q8: How do you interpret access assignments in Azure?
Access assignments consist of:
- Security Principal: Who (user, group, service principal, managed identity)
- Role Definition: What permissions
- Scope: Where the permissions apply
- Assignments are additive (permissions accumulate)
- Deny assignments (Azure Blueprints) override allow assignments
Q9: What is Azure Policy and how does it work?
Azure Policy is a governance service that enforces organizational standards:
- Policy Definitions: Rules to evaluate resource compliance
- Policy Initiatives: Groups of related policies
- Effects: Deny, Audit, Append, DeployIfNotExists, Modify, Disabled
- Assignments: Apply policies at specific scopes
- Evaluated during resource creation/update and periodic compliance scans
Q10: What are resource locks in Azure?
Resource locks prevent accidental deletion or modification:
- CanNotDelete (Delete lock): Allows read and modify but prevents deletion
- ReadOnly: Allows only read operations
- Locks are inherited by child resources
- Even owners need to remove locks before performing restricted operations
Q11: How do you implement tagging strategy in Azure?
Tags are metadata key-value pairs:
- Maximum 50 tags per resource
- Tag names are case-insensitive, values are case-sensitive
- Common uses: Cost allocation, environment identification, owner tracking
- Can be enforced through Azure Policy
- Some tags can be inherited using Azure Policy
Q12: What are Management Groups in Azure?
Management Groups provide enterprise-scale governance:
- Hierarchical structure above subscriptions
- Maximum 6 levels of depth (excluding root and subscription)
- Enable governance at scale (policies, RBAC)
- Root management group created automatically
- All subscriptions inherit settings from parent management groups
Q13: How do you manage Azure costs and budgets?
- Cost Management + Billing: Track and analyze spending
- Budgets: Set spending limits with alerts at threshold percentages
- Azure Advisor: Provides cost optimization recommendations
- Reservations: Pre-purchase compute capacity for discounts
- Auto-shutdown: Schedule VM shutdowns to save costs
- Tags: Track costs by department, project, or environment