Microsoft Azure Identity, Privacy and Compliance Features

What is Microsoft Azure Privacy?

Microsoft Azure privacy gives customers ownership and control over their data. You can trust that your data remains private and confidential.

What is Microsoft Azure Identity?

Identity is the primary security perimeter to keep customer data safe. Microsoft Azure Identity simplifies security as a control measure to restrict or grant access to various features:

Identity and Access Management: Manage identity and control access.
Data Protection: Safeguard data.

What is Microsoft Azure Compliance?

Azure adheres to global standards and regulations. It ensures compliance across various industries and geographies

What is Authentication?

Authentication in Microsoft Azure refers to the process of verifying the identity of a user or application that accesses Azure services. This ensures that only authorized entities can interact with resources. A key point is stated below:

Azure App Service Authentication: Azure App Service provides built-in authentication capabilities. It simplifies authentication by integrating with federated identity providers like Microsoft Entra, Facebook, Google, and Twitter. One doesn’t need to implement authentication yourself; App Service handles it for you.

What is Authorization?

Authorization in Microsoft Azure refers to the process of allowing or denying actions requested by verified identities. Authorization also means the process of granting or refusing access to a verified person to some certain resources or applications. Here are some underlying points:

What is the purpose of Authorization:

Authorization sets permissions that determine access to resources or functionality. It ensures that only authorized entities can perform specific actions. These actions might be operational (e.g., read, write, delete) or related to resource management.

Assigning Permissions:

To implement authorization, you assign permissions to identities (users, applications, services). These permissions define what actions an identity can perform on specific resources. You configure permissions using the functionality provided by your identity provider (IdP).

Azure App Service and Authorization:

Azure App Service provides built-in authorization capabilities. Authorization complements authentication by controlling what authenticated users can do.

What are the differences between Authentication and Authorization?

Authentication:

Purpose: Authentication verifies the identity of a user, application, or service. It ensures that the entity attempting to access a resource is who it claims to be.

Process: During authentication, credentials (such as username and password, tokens, or certificates) are presented. Azure validates these credentials against an identity store (like Azure Active Directory) to grant or deny access.

Examples includes:

User Authentication: When a user logs in to an Azure portal, they provide their username and password for authentication.
Service-to-Service Authentication: Applications or services authenticate using tokens (e.g., OAuth tokens) to access Azure services.

Authorization:

Purpose: Authorization determines what actions an authenticated entity is allowed to perform on specific resources.

Process: After successful authentication, Azure evaluates permissions based on the user’s role, group membership, or policies. It grants access to specific resources or operations.

Examples includes:

Role-Based Access Control (RBAC): Assigns roles (like Owner, Contributor, or Reader) to users or groups at different scopes (subscription, resource group, or resource level).
Resource Policies: Define fine-grained permissions for specific resources (e.g., storage accounts, virtual machines).

Conditional Access Policies: Control access based on conditions (e.g., location, device state).

In Summary:

Authentication verifies identity while Authorization controls access to resources based on roles and permissions.

What is a Security Policy in Microsoft Azure Security?

A security policy defines the set of controls that are recommended for resources within the specified subscription. In Azure Security Center, you define policies for your Azure subscriptions according to your company's security requirements and the type of applications or sensitivity of the data in each subscription.

This also helps to restrict access to what your organization want verified entities to see or do.
The security policies enabled in Azure Security Center drive security recommendations and monitoring.

What is Lock in Microsoft Azure?

Microsoft Azure Lock is a mechanism that allows you to protect your resources from accidental deletions or modifications. As an administrator, you can apply locks at different levels:

Subscription Level:

Locks applied at the subscription level affect all resources within that subscription. They override user permissions, ensuring that authorized users cannot accidentally delete or modify critical resources.
Resource Group Level:

Locks at the resource group level apply to all resources within a specific group. They help prevent unintended changes to the entire resource group.
Resource Level:

Locks applied directly to a specific resource protect that resource individually. You can choose between two types of locks:
- Read-only Lock: Allows authorized users to view the resource but prevents modifications.
- Delete Lock: Prevents the deletion of the resource entirely