AZ-104 Study Cards

"Unique identity"

"An identity that distinguishes an actor so permissions can be assigned correctly and actions can be traced to that actor."

"Authentication vs. authorization"

"Authentication verifies who you are. Authorization determines what you can do."

"Identity provider (IdP)"

"A service that manages identities

"Azure RBAC role assignment"

"The combination of a security principal

"Scope"

"The boundary where a role assignment applies

"Principle of least privilege"

"Grant only the permissions needed to perform a task at the narrowest appropriate scope."

"Successful sign-in but access denied"

"An authorization issue: the identity was authenticated but lacks the required access."

"Decentralized identity"

"An approach that gives holders control over credentials they hold and when they share them with verifiers."

"Decentralized identifier (DID)"

"An identifier that can be resolved to information such as public keys used to verify cryptographic proofs. It is not the wallet or credential itself."

"Verifiable credential (VC)"

"A digitally signed set of claims made by an issuer about a subject

"Issuer

holder

"Digital wallet"

"Stores credentials and enables the holder to consent to presenting them to a verifier."

Azure Owner

Has full access to manage all types of Azure resources

Can assign roles in Azure RBAC and delegate access

Azure Contributor

Has full access to create, read, update, and delete all types of resources

Cannot assign roles in Azure RBAC or handle access

Assign this role for least-privilege

"Microsoft Entra ID"

"Microsoft's cloud identity and access management service used by Azure

"Microsoft Entra tenant"

"A dedicated instance of Microsoft Entra ID containing an organization's identities

"Azure subscription and tenant relationship"

"Each Azure subscription trusts one Microsoft Entra tenant. Multiple subscriptions can trust the same tenant."

"Microsoft Entra ID vs. AD DS"

"Entra ID provides cloud identity management using modern protocols. AD DS provides traditional domain services such as Kerberos authentication

"Organizational unit (OU)"

"An AD DS container used to organize objects

"OpenID Connect (OIDC)"

"An authentication protocol built on OAuth 2.0 that enables an application to verify a user's identity."

"OAuth 2.0"

"An authorization framework that lets applications obtain limited access to protected resources using access tokens."

"SAML and WS-Federation"

"Federation protocols supported by Entra ID that enable sign-in and single sign-on to compatible applications."

"Microsoft Graph"

"An API gateway for accessing and managing data across Microsoft cloud services such as Entra ID and Microsoft 365."

"Microsoft Entra ID licensing tiers"

"The core tiers are Free

"Initial tenant domain"

"The initial domain provided with a tenant

"Custom domain"

"An organization-owned domain added to Entra ID after verifying ownership through DNS

"Primary domain"

"The default domain used when creating new users. A verified custom domain can become primary without removing the initial onmicrosoft.com domain."

"User object"

"An object representing a person in Entra ID

"Bulk user creation"

"Creating multiple Entra ID users by uploading a CSV file containing the required user information."

"Security group"

"A group used to assign access to resources collectively instead of assigning permissions separately to each member."

"Assigned group membership"

"Group membership managed by explicitly adding or removing members."

"Dynamic group membership"

"Group membership automatically determined by rules that evaluate user or device attributes."

"App registration"

"The process that creates an application object defining an application's identity configuration in its home tenant."

"Service principal"

"The local representation of an application in a tenant

"Managed identity"

"A special service principal whose credentials Azure manages

"Device object"

"An object representing a registered or joined device