At the heart of managing any secure system is a simple question: who is allowed to do what? In Azure, the answer starts with Microsoft Entra ID. This is Azure's cloud-based service for managing identities and controlling access.

Think of it as the digital bouncer for your organization's resources. Every person who needs access gets a user account. You can create users directly in your Entra ID directory for employees, or you can invite external collaborators, like contractors or partners, as guest users. Each user has a unique identity to sign in and access the resources they've been granted permission to use.

But managing permissions for each person individually would be a nightmare, especially in a large organization. That's where groups come in. By creating groups, you can bundle users together and assign permissions to the group as a whole. If a new developer joins the team, you just add them to the 'Developers' group, and they instantly get all the necessary access. When they leave, you remove them from the group, and their access is revoked. It's efficient and less prone to error.

Once you have your users and groups, you need a system to control what they can access. That system is Role-Based Access Control, or RBAC. The core idea is to grant users only the permissions they need to do their jobs, and no more. This is known as the principle of least privilege.

RBAC works by combining three key elements:

1. Security Principal: This is the 'who'—a user, group, or application that needs access.
2. Role Definition: This is the 'what'—a collection of permissions, like 'Reader' (can view resources but not change them) or 'Contributor' (can manage resources but not access to them).
3. Scope: This is the 'where'—the specific resource, resource group, or subscription the permissions apply to.

When you put these three together, you create a role assignment. For example, you might assign the 'Contributor' role to the 'Developers' group for a specific resource group where they are building an application. This lets them manage everything in that resource group, but they can't touch resources anywhere else.

The final piece of the puzzle is how you organize all your Azure resources. This is where subscriptions and governance come into play. A subscription is a container for billing and management. An organization might have multiple subscriptions to separate different departments, like 'Marketing' and 'Engineering', or different environments, like 'Production' and 'Development'.

Governance is the set of rules and policies you put in place to ensure everything stays secure, compliant, and cost-effective. Azure provides tools to help you enforce these rules automatically.

One of the most powerful governance tools is Azure Policy. It lets you create rules that your resources must follow. For example, you could create a policy that only allows virtual machines of a certain size to be deployed to control costs, or a policy that requires all storage accounts to have encryption enabled. If someone tries to create a resource that violates a policy, Azure can either block the action or log it for review.

By using Entra ID for identity, RBAC for access control, and policies for governance, you can build a secure and well-managed Azure environment. These tools give you fine-grained control, ensuring the right people have the right access to the right resources, and that your organization's standards are always met.

Ready to check your understanding? Let's review what we've covered.

Managing identities and governance is a foundational skill for working securely and effectively in Azure.