1. Microsoft Entra ID #
The identity directory.
Principles #
Microsoft Entra ID (formerly Azure Active Directory) authenticates users and applications for Azure, Microsoft 365 and thousands of SaaS applications (SSO). It synchronizes with an on-premises Active Directory through Entra Connect.
- MFA for everyone, and conditional access: require MFA or a compliant device based on risk, location and application.
- Managed identities: an application on Azure (VM, App Service, Functions) gets an identity with no secret to store.
- PIM (Privileged Identity Management): administration roles activated on demand, time-limited, with approval.
2. RBAC #
Who can do what, where.
Assigning roles #
| Built-in role | Permissions |
|---|---|
| Owner | Everything, including assigning roles |
| Contributor | Everything except assigning roles |
| Reader | Read only |
| User Access Administrator | Manage role assignments |
az role assignment create --assignee-object-id <id-groupe> --assignee-principal-type Group \
--role "Contributor" --scope /subscriptions/<abonnement>/resourceGroups/rg-app
az role assignment list --scope /subscriptions/<abonnement>/resourceGroups/rg-app -o table
az vm identity assign -g rg-app -n vm-web # identité managée système3. Governance #
Azure Policy, locks, tags.
Azure Policy #
Azure Policy enforces rules on resources: allowed regions, mandatory tags, encryption, forbidden SKUs. Effects: deny, audit, modify, deployIfNotExists. Initiatives group policies together (for example the Microsoft cloud security benchmark).
az policy assignment create --name regions-ue --scope /subscriptions/<abonnement> \
--policy e56962a6-4747-49cd-b67b-bf8b01975c4c \
--params '{"listOfAllowedLocations":{"value":["francecentral","westeurope"]}}'
az lock create --name ne-pas-supprimer --lock-type CanNotDelete -g rg-prod
az tag update --resource-id /subscriptions/<abonnement>/resourceGroups/rg-app --operation merge --tags centre_cout=1234Good practice: RBAC says who can act; Azure Policy says what is allowed. The two are complementary.
