Managing a digital workspace is a lot like managing a physical building. You need to know who has access, what they're allowed to do, and how to keep things organized. In Azure, this all starts with Microsoft Entra ID, the service that manages users and their access.

Think of it as your building's directory. Every person who needs access gets an entry, which we call a user account. You can create user accounts for employees, contractors, or anyone who needs to interact with your Azure resources.

But managing permissions one person at a time is tedious. If ten people need the same access, you'd have to repeat the process ten times. That's where groups come in. You can create a group, assign permissions to the group itself, and then just add or remove users from that group. It's much simpler. For example, you could have a "Developers" group and a "Marketing" group, each with different levels of access.

Forgotten passwords are a constant headache. They lock users out and create a stream of support tickets for administrators. Azure provides a simple solution to this problem: self-service password reset (SSPR).

When you enable SSPR, users can reset their own passwords without needing to call for help. To set it up, users register one or more authentication methods, like a phone number for a text or call, or an authenticator app. When they forget their password, they just need to prove their identity using one of these methods to set a new one.

This small feature has a big impact. It empowers users to solve their own problems quickly and frees up IT staff to focus on more important tasks.

Just because someone is in the building doesn't mean they should have access to every room. Some people need to reconfigure servers, while others just need to view reports. Azure uses Role-Based Access Control (RBAC) to manage these permissions precisely.

RBAC works by assigning roles to users or groups. Each role is a collection of permissions. Azure has hundreds of specific roles, but three are most common:

You assign these roles at a specific scope: a single resource, a resource group (a collection of resources), or an entire subscription. This lets you follow the principle of least privilege, giving people only the access they absolutely need to do their jobs.

Beyond managing people, you need to manage the resources themselves. How do you prevent someone from accidentally deploying a massive, expensive virtual machine or ensure every resource is created in the correct geographic region? You use Azure Policy.

You can use built-in policies or write your own. For example, you can create a policy that requires all resources to have a specific tag, or one that restricts which virtual machine sizes can be deployed. Policies can either audit for non-compliance or actively deny the creation of resources that break the rules.

For an even stronger layer of protection, you can apply resource locks. A lock overrides any user permissions, including those of an owner, to protect critical resources from accidental deletion or modification. There are two types:

• CanNotDelete: Users can still read and modify the resource, but they can't delete it.
• ReadOnly: Users can only read the resource. They can't modify or delete it.

A well-organized Azure environment is easier to manage, secure, and track for costs. The main tools for organization are subscriptions, resource groups, and tags.

A subscription is the primary boundary for billing and management. Large organizations might have multiple subscriptions for different departments.

Inside a subscription, you use resource groups to hold related resources for a solution. For example, a web application might have its virtual machine, database, and networking components all in one resource group. This makes them easier to manage as a single unit.

Finally, tags are key-value pairs you can apply to resources and resource groups. They are incredibly useful for organizing everything. You can tag resources by department, project, or environment (like "production" or "development"). This not only helps you find things but is also essential for tracking costs and applying specific policies.

By using these tools together, you can build a secure, compliant, and well-organized Azure environment.

Ready to check your understanding of these core concepts?

Mastering these fundamentals of identity, access, and governance is the first step toward becoming a proficient Azure administrator.