Quick Note — Recommend an Identity Management Solution
AZ-305 › Unit 1 › Design authentication and authorization solutions › Recommend an identity management solution
Quick Note — Recommend an Identity Management Solution
This lesson covers the identity lifecycle—how on-premises and cloud-based identities are synchronized, provisioned, and managed in hybrid and cloud-native Azure environments. Based on AZ-305 exam guidance (Ch. 2, §2.2, p. 47–65), the focus is on synchronization strategy, Seamless SSO, group sync, B2B/B2C, and managed identities. Identity management is distinct from authentication (LO4) and authorization (LO6/7) — we emphasize the lifecycle: how identities are created, synced, and deprovisioned.
Retrieval target
- Recommend an Identity Management Solution
- Closed-book recall
- 5 minutes
- Open the full lesson after a miss
Decision anchors
| Prompt | Compact answer |
|---|---|
Entra ID user — Member vs Guest | Two userType values in an Entra tenant. Member — a regular employee identity owned by your tenant (default for synced or in-cloud-created users). Guest — an external person invited via B2B; they sign in with their home tenant's identity and appear in your directory but cannot be assigned licenses by default and have a more limited Directory view. |
Dynamic group | An Entra ID group whose membership is determined by a rule over user (or device) attributes — e.g., user.department -eq "Sales". Members join and leave automatically as attributes change. Requires Entra ID P1 licensing. Use for license / app assignment that should track org changes without manual list maintenance. |
Service principal | The identity an application, service, or automation uses to authenticate to Entra-protected resources. Created automatically when you register an app in the portal. Two flavors: Application service principal (manual app registration, you manage the credential) and Managed identity (Azure-managed credential lifecycle, see separate card). |
Managed identity | A service principal whose credential is created, rotated, and deleted by Azure — your code never sees a secret. Available on most Azure compute (VM, VMSS, App Service, Functions, Logic Apps, AKS). Get a token from the IMDS endpoint, present it to any resource that does Entra auth (Storage, Key Vault, SQL, etc.). |
Read the answers once, then cover the right-hand column and reconstruct each one from the prompt. A useful answer names the requirement, the recommended control or service boundary, and the nearest alternative it rejects. If you can only recognize the answer after seeing it, retrieval is not yet secure.
Ninety-second explanation
Without notes, explain:
- What requirement signals this learning objective rather than a neighbouring one?
- Which two solution families are most likely to be compared?
- Which hard constraint eliminates the strongest distractor?
- What identity, network, data, or failure boundary must appear in the design?
- Which operational test would prove the recommendation works?
Then compare your explanation with the full lesson. Record the missing decision rule—not merely the missed product name—in your error log.
When to open the full lesson
Open the curriculum-linked lesson when you cannot explain a comparison, when a scenario depends on a numeric limit or SKU feature, or when the service is on a retirement path. Use current Microsoft Learn documentation for availability, limits, pricing, naming, and migration milestones; the quick note is intentionally compact.
Source and freshness
Derived from the linked AZ-305 lesson and retrieval deck, grounded in both attached course sources. Reviewed 2026-08-02. Current Microsoft documentation controls changing product contracts.