Lesson 2: Identity Concepts: AuthN, AuthZ, IdPs and Federation

Before you start

This course follows Microsoft's free Study guide for Exam SC-900 on Microsoft Learn. The guide itself is not reproduced here. Check Microsoft's official exam page for current length, price and languages. This course is independent of Microsoft and is not endorsed by it, and no course can promise you a pass.

This level covers the identity half of the first skill area, Describe the concepts of security, compliance, and identity (10–15%). The study guide lists six items under Define identity concepts:

1. Define identity as the primary security perimeter
2. Define authentication
3. Define authorization
4. Describe identity providers
5. Describe the concept of directory services and Active Directory
6. Describe the concept of federation

Task 1: Explain why identity is the primary security perimeter

The old model. Organisations used to protect a network perimeter: a boundary around corporate systems, enforced by firewalls and VPN gateways. Anything inside was trusted. That worked when everyone sat in one office on company devices and used local servers.

What changed. The following trends broke that boundary down:

• Cloud and SaaS apps: email and business apps now run outside the corporate network.
• Remote and hybrid work: people connect from home and public Wi-Fi.
• Personal devices (BYOD): phones and laptops the organisation doesn't fully control.
• Partner and customer access: outsiders need some resources without joining the network.
• IoT devices: these are hard to manage with traditional tools.

The new model. An identity is the set of attributes that define a person, device or software component. Every access request now starts with one question: who or what is making this request, and should it be trusted? An attacker with a stolen cloud account can walk straight past the firewall. That is why identity is now the main security boundary.

Identities come in four types: human, device, workload (software such as apps and services) and agent (AI agents). Level 3 covers identity types in detail.

The four pillars of an identity infrastructure. Learn these four names:

Do this: For each pillar, say aloud one example from a workplace you know.

Task 2: Tell authentication from authorization

• Authentication (AuthN) proves you are who you say you are. It answers "Who are you?" It relies on credentials, grouped into three factor categories: something you know (password, PIN), something you have (phone, security key) and something you are (fingerprint, face). Level 4 covers authentication methods and MFA in depth.
• Authorization (AuthZ) decides what an authenticated identity may do. It answers "What are you allowed to do?" Decisions are based on roles, permissions (read, write, delete) and attributes (department, location). Under the principle of least privilege, people get only the minimum access their job needs.

The order never changes: authentication comes first, then authorization. A system can't decide what you may do until it knows who you are.

Hotel analogy (Microsoft's own):

1. You show your ID at reception, and staff confirm who you are. That is authentication.
2. You get a keycard that opens your room and the gym, but not other rooms. That is authorization.

Do this: In any scenario question, find the verb. Verify, prove, sign in, confirm identity means authentication. Permit, grant, allow, restrict access means authorization.

Task 3: Describe identity providers

An identity provider (IdP) creates, maintains and manages identity information. It also offers authentication, authorization and auditing services to applications. Each app hands these jobs to the IdP instead of keeping its own accounts. Microsoft calls this model modern authentication.

How a sign-in works:

1. The user opens an application.
2. The application sends the user to the identity provider.
3. The IdP checks the user's credentials.
4. If the check succeeds, the IdP issues a security token.
5. The application trusts the IdP, so it accepts the token as proof of sign-in.

Tokens carry claims, which are pieces of data such as the user ID, name, roles and expiry time. An ID token proves who signed in. An access token grants permission to a resource. Tokens expire, so a stolen token can't be used forever.

The common protocols are OpenID Connect (authentication, built on OAuth 2.0), OAuth 2.0 (authorization) and SAML (enterprise and older apps, and federation).

Single sign-on (SSO): you sign in once to the IdP and reach every app that trusts it. Microsoft Entra ID is a cloud-based IdP. Google, Amazon, LinkedIn and GitHub are other examples.

Task 4: Describe directory services and Active Directory

• A directory is a structured store of objects: users, devices, groups, policies and applications.
• A directory service is the software that stores this data and makes it available. It answers questions like "Which groups is this user in?"
• Active Directory (AD) is Microsoft's set of directory services. It was first released with Windows 2000 Server for on-premises, domain-based networks.
• Active Directory Domain Services (AD DS) is its most widely deployed part. It stores users, devices and groups, checks credentials at sign-in and sets access rights. A server running AD DS is called a domain controller (DC). AD DS uses Kerberos and NTLM, applies Group Policy and groups objects into organizational units (OUs).

Limitations of AD DS:

• It doesn't natively authenticate users to cloud or SaaS apps.
• It doesn't natively support OAuth 2.0 or OpenID Connect.
• It doesn't natively manage non-Windows mobile devices.
• Remote users usually need a VPN to reach it.

Microsoft describes Microsoft Entra ID as the cloud evolution of directory services, delivered as Identity as a Service. Level 3 covers it.

Task 5: Describe federation

Federation gives access to services across organisational or domain boundaries by setting up trust relationships between separate identity providers. Users sign in with credentials they already have, so no new account is needed.

Passport analogy: your home country issues your passport, and other countries accept it without issuing you a new ID.

The key exam point is that trust is not automatically bidirectional. If Organisation A trusts Organisation B, B does not automatically trust A. A two-way trust has to be set up on purpose.

Common scenarios:

• B2B collaboration: partner staff use their own company credentials.
• Social sign-in: "Sign in with Google/Microsoft/GitHub" on a consumer app.
• On-premises extension: Active Directory Federation Services (AD FS) lets on-premises AD users reach cloud apps.

Choosing in a best-answer question

What the exam asks about this

• Scenario questions about whether something is authentication or authorization.
• Why the network perimeter is no longer enough, and which reason applies.
• What an IdP does: it issues security tokens, centralises authentication and enables SSO.
• AD DS terms: domain controller, on-premises, Kerberos and NTLM.
• True/false items on federation trust direction.

Key takeaways

• Identity is the primary security perimeter because cloud, remote work, BYOD, partners and IoT have broken down the network boundary.
• The four pillars are Administration, Authentication, Authorization and Auditing.
• Authentication proves who you are. Authorization decides what you may do. Authentication always comes first.
• An IdP centralises sign-in and issues security tokens that contain claims, which makes SSO possible.
• AD DS is the on-premises directory service, and a server running it is a domain controller.
• Federation is trust between identity providers, and it is one-way unless both sides set it up.