Identity and Security Interview Questions for Microsoft Azure

Show answer

Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity and access service. It stores users, groups, applications and devices for a tenant and handles sign-in with OAuth 2.0, OpenID Connect and SAML, plus MFA and Conditional Access. Azure, Microsoft 365 and thousands of SaaS apps use it. Unlike on-premises Active Directory, it does not use Kerberos, LDAP or organisational units by default.

Explain the built-in roles Owner, Contributor, Reader and User Access Administrator.

Show answer

Owner has full access to resources and can assign roles to others. Contributor can create and manage all resources but cannot grant access or manage role assignments. Reader can only view resources. User Access Administrator can manage role assignments but not resources. Follow least privilege: most engineers need Contributor on their own resource groups and Reader elsewhere, with Owner held by very few people.

What is a managed identity and what types exist?

Show answer

A managed identity is an Entra ID identity that Azure creates and rotates for a resource, so code can get tokens without storing secrets. A system-assigned identity is tied to one resource and deleted with it. A user-assigned identity is a standalone resource you can attach to many resources and that survives their deletion. User-assigned is better when several apps share access or when you pre-create role assignments.

What is Azure Key Vault and what can it store?

Show answer

Key Vault securely stores secrets like connection strings and API keys, cryptographic keys used for encryption and signing, and TLS certificates with automatic renewal. Access is controlled by Azure RBAC, which is recommended, or legacy access policies. Soft delete is always on and purge protection prevents permanent deletion during retention. The Premium tier uses HSM-backed keys, and Managed HSM gives a dedicated single-tenant FIPS 140-3 Level 3 HSM.

What is Azure Policy and how is it different from RBAC?

Show answer

RBAC controls who can do actions. Azure Policy controls what resources and settings are allowed, whoever deploys them. Policies use effects such as deny, audit, append, modify, deployIfNotExists and auditIfNotExists. For example, deny public IPs on VMs or deploy diagnostic settings automatically. Group policies into initiatives, assign them at management groups and view compliance on the dashboard.

Assign a role to a group at resource group scope with Azure CLI.

Show answer

Look up the group object ID, then create the role assignment with the narrowest scope: GROUP_ID=$(az ad group show --group 'grp-shop-devs' --query id -o tsv) az role assignment create \ --assignee-object-id $GROUP_ID \ --assignee-principal-type Group \ --role Contributor \ --scope /subscriptions/<sub-id>/resourceGroups/rg-shop-dev Assigning to groups instead of users keeps access easy to audit.

Store and read a secret from Key Vault using Azure CLI.

Show answer

Create an RBAC-enabled vault, grant yourself Key Vault Secrets Officer, then set and read the secret: az keyvault create -g rg-sec -n kv-shop-prod \ --location centralindia --enable-rbac-authorization true az keyvault secret set --vault-name kv-shop-prod \ --name SqlPassword --value 'S3cure#Pass' az keyvault secret show --vault-name kv-shop-prod \ --name SqlPassword --query value -o tsv

How do you keep up with security changes in Azure?

Show answer

Situation: Azure releases security changes every month, and missing one can expose our systems. Task: stay current without losing project time. Action: I follow Azure Updates and the Azure Security blog, read the monthly Defender for Cloud changes, review Service Health retirement notices and spend an hour weekly in a lab. Result: our team was ready for the mandatory MFA rollout for Azure sign-ins before it was enforced.

What is the difference between Entra ID roles and Azure RBAC roles?

Show answer

Entra ID roles, such as Global Administrator or User Administrator, control the directory: users, groups, app registrations and tenant settings. Azure RBAC roles, such as Owner, Contributor and Reader, control Azure resources at management group, subscription, resource group or resource scope. A Global Administrator has no resource access by default, though they can elevate themselves to User Access Administrator at root scope.

What is the difference between an app registration and a service principal?

Show answer

An app registration is the global definition of an application in its home tenant, with client ID, redirect URIs, API permissions and credentials. A service principal is the local instance of that app in a tenant, used for sign-in and role assignments. One multi-tenant app registration can have service principals in many tenants. Managed identities are special service principals whose credentials Azure manages.

What is Conditional Access?

Show answer

Conditional Access is the Entra ID policy engine that decides how users sign in. Policies combine signals like user or group, app, location, device compliance, client app and sign-in risk, then grant access, require MFA or a compliant device, or block. For example, require MFA for all admins and block legacy authentication. It requires Entra ID P1, and risk-based policies need P2.

What is Privileged Identity Management (PIM)?

Show answer

PIM gives just-in-time, time-bound access to privileged Entra ID roles and Azure RBAC roles. Users are eligible, not permanently assigned, and must activate the role for a few hours with justification, MFA and optionally approval. Every activation is audited and access reviews remove stale eligibility. It reduces standing admin access, which is a key control against compromised accounts. It needs Entra ID P2 or governance licensing.

What is Microsoft Defender for Cloud?

Show answer

Defender for Cloud is a cloud security posture management and workload protection platform. The free foundational tier gives a secure score and recommendations based on the Microsoft cloud security benchmark. Paid Defender plans add threat detection for servers, storage, SQL, containers, Key Vault and App Service, vulnerability scanning and attack path analysis. It also covers AWS and GCP accounts and on-premises servers through Arc.

How does encryption at rest and in transit work in Azure?

Show answer

All Azure Storage, managed disks and Azure SQL data is encrypted at rest with AES-256 by default using Microsoft-managed keys. You can switch to customer-managed keys in Key Vault for control over rotation and revocation, and use double encryption or confidential computing for stricter needs. In transit, services use TLS 1.2 or higher, and you should enforce HTTPS only and minimum TLS version settings.

What is Microsoft Sentinel?

Show answer

Sentinel is Microsoft's cloud-native SIEM and SOAR built on Log Analytics. It ingests logs through connectors from Entra ID, Defender, Azure activity, firewalls and third-party sources, runs analytics rules written in KQL to raise incidents, and uses playbooks built on Logic Apps to automate responses like disabling a user. Cost depends on data ingestion, so filter noisy logs and use basic or auxiliary log tiers.

How do you reference Key Vault secrets in App Service app settings?

Show answer

Enable a managed identity on the app, grant it Key Vault Secrets User on the vault, then set the app setting value to a Key Vault reference: @Microsoft.KeyVault(SecretUri=https://kv-shop-prod.vault.azure.net/secrets/SqlPassword/). The app reads it as a normal environment variable. Omitting the version makes App Service pick up rotated secrets automatically within about a day, or on restart.

How do you create a custom RBAC role?

Show answer

Export a similar built-in role as JSON, keep only needed Actions and DataActions, set AssignableScopes and create it: az role definition list --name 'Virtual Machine Contributor' > vm-op.json # edit: Name 'VM Operator', Actions: # Microsoft.Compute/virtualMachines/read # Microsoft.Compute/virtualMachines/start/action # Microsoft.Compute/virtualMachines/restart/action # Microsoft.Compute/virtualMachines/deallocate/action az role definition create --role-definition vm-op.json

A developer's service principal secret was committed to a public GitHub repo. What do you do?

Show answer

Treat it as compromised. Immediately delete the secret on the app registration and create a new one only if needed, then update the pipeline. Check Entra sign-in logs for service principal sign-ins and the activity log for changes made with it, and remove anything suspicious. Purge it from Git history. Long term, move pipelines to workload identity federation so no secret exists to leak.

How do you give an external auditor read-only access to your Azure environment for two weeks?

Show answer

Invite the auditor as a B2B guest user in Entra ID, add them to a group, and assign the Reader role, plus Security Reader if they review Defender findings, at the required scope through PIM with a two-week expiry. Require MFA through Conditional Access for guests. Avoid sharing accounts. After the audit, an access review or expiry removes access automatically, with all activity logged.

Your secure score in Defender for Cloud is low. How do you improve it?

Show answer

Sort recommendations by the score increase and effort. Typical quick wins are enabling MFA for all privileged accounts, restricting management ports with just-in-time access, enabling endpoint protection and vulnerability assessment on VMs, and turning on diagnostic logs. Use Azure Policy to enforce fixes so new resources stay compliant. Assign owners and due dates through governance rules and track progress weekly.

Tell me about a time you pushed back on a request that broke security rules.

Show answer

Situation: a project manager asked me to give a vendor Owner access to production to speed up a fix. Task: unblock the vendor without breaking policy. Action: I explained the risk, then created a time-bound PIM eligible Contributor role on just one resource group with approval, and paired with the vendor during the change. Result: the fix shipped the same day and the audit had no findings.

What is workload identity federation?

Show answer

Workload identity federation lets external workloads such as GitHub Actions, Kubernetes pods or other clouds get Entra ID tokens by exchanging their own OIDC tokens, without storing client secrets. You add a federated credential on an app registration or user-assigned managed identity that trusts a specific issuer and subject, such as a repo branch. AKS Workload ID uses this for pods to access Azure resources.

Write a Bicep snippet for a custom Azure Policy that denies resources outside India regions.

Show answer

Define the rule with an allowed list and a deny effect, then assign it at a management group: resource pol 'Microsoft.Authorization/policyDefinitions@2023-04-01' = { name: 'allowed-india-regions' properties: { policyType: 'Custom' mode: 'Indexed' policyRule: { if: { field: 'location' notIn: ['centralindia', 'southindia', 'westindia'] } then: { effect: 'deny' } } } }

Design identity and access for a multi-team Azure platform in a bank.

Show answer

Use Entra ID groups mapped to roles per team and environment, with no direct user assignments. Make production access eligible-only through PIM with approval and MFA, and require phishing-resistant MFA and compliant devices via Conditional Access. Use managed identities and workload federation for apps and pipelines. Keep break-glass accounts excluded from policies but monitored. Run quarterly access reviews and stream logs to Sentinel.

How would you secure an AKS cluster?