Authentication, Authorization and Identity Design
Identity design questions cover Microsoft Entra ID, managed identities, RBAC, conditional access, hybrid identity, workload identities, and secrets.
How to study for AZ-305
Treat each AZ-305 item as an architecture decision: identify the workload requirement, governance boundary, data shape, recovery objective, and infrastructure tradeoff before choosing.
Core concepts
Concept 1
Authentication, Authorization and Identity Design questions test Azure architecture tradeoff decisions rather than isolated service-name recall.
Exam cue: Identify the requirement, workload type, data shape, access boundary, recovery target, and operational ownership model.
Concept 2
The best answer maps business requirements to identity, governance, data, resilience, compute, network, security, cost, and operations constraints.
Exam cue: Choose the Azure design that satisfies the constraint with the least unnecessary operational burden.
Concept 3
Eliminate answers that ignore governance scope, recovery objectives, data durability, private connectivity, security boundaries, or workload fit.
Exam cue: Prefer Well-Architected choices: secure, reliable, cost-aware, observable, governed, and scalable.
Risk pitfalls and guardrails
Choosing a service before identifying the business driver and nonfunctional requirement.
Guardrail: Avoid answers that pick services without checking governance scope, data model, recovery target, migration dependency, or network boundary.
Solving availability while ignoring identity, data protection, compliance, or cost constraints.
Guardrail: Avoid answers that pick services without checking governance scope, data model, recovery target, migration dependency, or network boundary.
Assuming a migration, networking, or storage pattern is correct without checking workload dependencies.
Guardrail: Avoid answers that pick services without checking governance scope, data model, recovery target, migration dependency, or network boundary.
Memory anchors
Microsoft Entra ID
Microsoft Entra ID provides cloud identity and access management for users, applications, and workloads.
Managed Identity
A managed identity lets Azure resources authenticate without storing credentials in code.
Azure RBAC
Azure role-based access control grants management permissions by principal, role, and scope.
Conditional Access
Conditional Access enforces access decisions based on signals such as user, device, location, risk, and app.
Privileged Identity Management
PIM provides just-in-time privileged access with approval, auditing, and time limits.
Hybrid Identity
Hybrid identity connects on-premises directories with Microsoft Entra ID for consistent authentication.
Workload Identity
A workload identity lets applications or services authenticate securely to Azure resources.
Key Vault
Azure Key Vault stores and controls access to keys, secrets, and certificates.
Identity Governance
Identity governance manages access reviews, entitlement management, and lifecycle controls.
Least Privilege
Least privilege grants only the access needed for the approved architecture task.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
An Azure Function needs to read secrets from Key Vault without any credentials stored in code or configuration. Which identity design should you use?
Several VMs and functions must share one identity that persists even if individual resources are deleted and recreated. Which identity type fits?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”