Lesson 1: The Azure Security and Identity Map

Why start with a map

Azure security changes names faster than most teams update their wikis. A runbook from 2021 says "Azure Security Center", a Terraform module still says azuread, and your auditor asks about "Microsoft Entra". It is the same estate under three names. Before you can choose a service you need to know what exists, which job each one does, what it used to be called, and whether you can still buy it.

Think of this level as the floor plan of a building you are about to wire. We sort every service into seven job groups. Later levels open each room in turn.

The one-page map

Gotcha: renames are only skin-deep. The product name changed but the API surface often did not. The Azure CLI still uses az ad, Defender for Cloud still lives under the Microsoft.Security resource provider, and Sentinel under Microsoft.SecurityInsights. Search for both the old and the new name when you read logs, policies and IaC.

Walkthrough: what is in my subscription?

A map is only useful once you mark where you are standing. These read-only commands sort what is already deployed into the groups above.

# 1. Sign in and pick the subscription you want to look at
az login
az account set --subscription "<subscription-id>"

# 2. Which security resource providers are registered?
#    Registered usually means "someone has used this here"
az provider list \
  --query "[?contains('Microsoft.Security Microsoft.SecurityInsights Microsoft.KeyVault Microsoft.OperationalInsights', namespace)].{ns:namespace, state:registrationState}" \
  -o table

# 3. Inventory key, network-security and logging resources with Azure Resource Graph
az extension add --name resource-graph   # one-time setup
az graph query -q "
  resources
  | where type in~ (
      'microsoft.keyvault/vaults',            // Keys & secrets
      'microsoft.keyvault/managedhsms',       // Keys & secrets (HSM)
      'microsoft.operationalinsights/workspaces', // Logging & audit
      'microsoft.network/azurefirewalls',     // Zero trust / network (brief)
      'microsoft.network/ddosprotectionplans')
  | summarize count() by type" -o table

# 4. Threat detection & posture: which Defender for Cloud plans are on?
az security pricing list --query "value[].{plan:name, tier:pricingTier}" -o table

Sample output from step 4:

Plan             Tier
---------------  --------
VirtualMachines  Standard   <- Defender for Servers is on (billed)
StorageAccounts  Free       <- posture checks only, no threat protection
KeyVaults        Standard

Standard means a paid Defender plan is switched on. Free means you get the posture checks only. We cover costs in the Defender for Cloud lesson. For now, just mark the group as occupied.

Best practice: run this inventory on every subscription before any design workshop. In real estates you will often find a Key Vault nobody owns, or a Log Analytics workspace taking in data that no Sentinel instance reads. Both are the starting points for decisions later in the course.

Reading the retirement column

The retirement flags change what you can recommend:

• Starting fresh with customer sign-in? Azure AD B2C is not an option for new customers. Choose Entra External ID.
• Still using Blueprints? Plan to move definitions to template specs (or Git) and assignments to deployment stacks before January 2027.
• Running Sentinel in the Azure portal? Your analysts' screens and bookmarks will change. Plan the move to the Defender portal before 31 March 2027.
• Need a single-tenant HSM? New projects go to Cloud HSM, Managed HSM or Key Vault, not Dedicated HSM.

Trade-off: a retiring service still works today, so it can be tempting to wait. But every month you wait adds to the migration bill, and new features land only on the successor.

In depth vs brief

This course spends full nine-part lessons on Entra ID and External ID, RBAC, Policy and management groups, Key Vault and Managed HSM, Defender for Cloud, Sentinel and confidential computing. Purview, Azure Firewall and DDoS Protection get short treatment. Purview is mostly a data-governance and Microsoft 365 compliance product, and Firewall and DDoS belong to the networking course. You will still see them in the scorecard. We just will not do a full quick start for them.

Key takeaways

• Sort services by job: identity, access and governance, keys and secrets, threat detection and posture, logging and audit, data protection, zero trust access.
• Azure AD → Microsoft Entra ID. Azure Security Center + Azure Defender → Defender for Cloud. Azure Sentinel → Microsoft Sentinel. Azure Purview → Microsoft Purview.
• Closed or retiring: Azure AD B2C (no new customers from 1 May 2025), Sentinel in the Azure portal (31 March 2027), Blueprints (31 January 2027), Dedicated HSM (no new customers), Entra Permissions Management (already retired).
• Old names live on in CLI commands and resource providers, so search for both.
• Purview, Firewall and DDoS Protection are covered only briefly in this course.