Identity: The New Security Perimeter
Firewalls used to be the front door. Now identity is. Authentication, authorisation, identity providers, directory services, and federation — the foundation of modern security.
Why is identity the new perimeter?
The office wall used to be the security boundary. Now your login is.
In the old days, your company network was like a walled garden. The firewall was the gate. If you were physically in the office and connected to the network, you were “inside” and trusted.
But now people work from home, from coffee shops, from airports. Data lives in the cloud, not on a server in the basement. There’s no “inside” anymore.
So the new security boundary is identity — who you are, how you prove it, and what you’re allowed to do. Your login credentials are now the front door.
Authentication vs authorisation
These two concepts appear on almost every SC-900 exam:
| Feature | Authentication (AuthN) | Authorisation (AuthZ) |
|---|---|---|
| Question it answers | Who are you? | What are you allowed to do? |
| When it happens | First — before access is granted | Second — after identity is confirmed |
| What it checks | Credentials (password, MFA, biometrics) | Permissions (roles, group memberships, policies) |
| Analogy | Showing your ID at the hotel front desk | Your room key only opens YOUR room, not every room |
| Example | Signing in with password + Authenticator app | Having 'read-only' access to the finance folder |
Key exam concept: Authentication always comes before authorisation. You must prove who you are before the system decides what you can access.
Scenario: Raj explains it to new intern Mia
Mia just joined Lakewood University’s IT helpdesk. Raj explains how the login process works:
- Authentication: Mia enters her username and password, then approves the MFA prompt on her phone. The system now knows she is Mia — not someone pretending to be her.
- Authorisation: The system checks Mia’s group memberships and role. As a helpdesk intern, she can reset passwords and view basic user info — but she cannot delete user accounts or access financial data.
“Think of it this way,” Raj says. “Authentication is the bouncer checking your ID. Authorisation is the VIP list deciding which areas you can enter.”
Identity providers (IdPs)
An identity provider is a service that creates, stores, and manages digital identities. It handles the authentication process so that applications don’t have to.
| Concept | What It Means |
|---|---|
| Identity provider (IdP) | The trusted service that verifies identities (e.g., Microsoft Entra ID, Google Identity) |
| Service provider (SP) | The application or resource the user wants to access (e.g., SharePoint, Salesforce) |
| Token | A digital ticket issued by the IdP after successful authentication — the SP trusts this token |
| Single sign-on (SSO) | Sign in once with the IdP, access many SPs without re-entering credentials |
How it works:
- User tries to access an app (service provider)
- App redirects user to the identity provider
- IdP authenticates the user (password + MFA)
- IdP issues a token confirming identity
- User presents the token to the app
- App grants access based on the token
Key exam concept: Microsoft Entra ID is Microsoft’s cloud-based identity provider. It issues tokens that applications trust. This is the foundation of SSO in Microsoft 365.
Directory services and Active Directory
A directory service is a database that stores information about users, groups, devices, and other objects in a network. Think of it as a phone book for your organisation.
| Feature | Active Directory Domain Services (AD DS) | Microsoft Entra ID (Cloud) |
|---|---|---|
| Where it runs | On-premises servers | Microsoft's cloud |
| What it manages | Users, computers, group policies on local network | Users, groups, apps, devices across cloud and on-prem |
| Authentication | Kerberos, NTLM | OAuth 2.0, SAML, OpenID Connect |
| Device management | Group Policy (GPO) | Intune, Conditional Access |
| Access scope | Corporate network | Anywhere with internet |
| Multi-factor auth | Requires additional infrastructure | Built-in, cloud-native |
Why both exist
Many organisations started with on-premises Active Directory years ago. They can’t just switch it off — thousands of apps and services depend on it.
Microsoft Entra ID was built for the cloud era. It handles modern authentication protocols and works from anywhere.
Hybrid identity (which you’ll learn about in the Entra domain) connects both — letting organisations use their existing AD investments while extending to the cloud.
Federation
Federation is a trust relationship between two separate identity providers that allows users from one organisation to access resources in another — without creating a separate account.
Simple analogy: Your EU driving licence lets you drive in New Zealand. The NZ authorities don’t issue you a new licence — they trust the EU authority that issued yours. That’s federation.
How federation works
- Organisation A trusts Organisation B’s identity provider
- A user from Organisation B tries to access a resource in Organisation A
- Organisation A redirects the user to Organisation B’s IdP for authentication
- Organisation B’s IdP verifies the user and issues a token
- Organisation A accepts the token and grants access
Key exam concept: Federation is about trust between organisations. The user authenticates with THEIR OWN identity provider — not the resource’s provider. This enables cross-organisation collaboration without duplicate accounts.
Scenario: Lakewood University uses federation
Lakewood University wants to share a research portal with partner universities.
- Without federation: Every researcher from every partner university needs a new Lakewood account. That’s thousands of accounts to create, manage, and eventually delete.
- With federation: Lakewood trusts each partner university’s identity provider. Researchers sign in with their own university credentials. Lakewood never sees their passwords.
Raj sets up the federation trust once per partner. From then on, researchers can access the portal using their existing credentials.
🎬 Video walkthrough
🎬 Video coming soon
Identity Fundamentals — SC-900 Module 4
Identity Fundamentals — SC-900 Module 4
~10 minFlashcards
Knowledge Check
Raj needs to verify whether a user trying to access the university portal is actually who they claim to be. Which process should Raj rely on?
Lakewood University sets up a trust relationship with a partner university so their researchers can access Lakewood's portal using their own credentials. What is this called?
Which statement correctly describes the relationship between authentication and authorisation?