When you build something in the cloud, you need a way to control who can access it. Think of it like a digital bouncer for your applications and data. In Azure, this bouncer is called Microsoft Entra ID. It's the central hub for managing user identities and ensuring the right people have the right level of access to the right resources.

At its core, identity management is about two things: users and groups. A user is a single identity, like an employee, a contractor, or even an automated service, that needs access. A group is simply a collection of users. Groups make life much easier. Instead of giving permissions to twenty people one by one, you can put them all in a group and assign permissions to the group itself. If someone leaves the team, you just remove them from the group, and their access is instantly revoked.

Once you have users and groups, how do you specify what they can actually do? You don't want your marketing intern to have the ability to delete a critical database. This is where Role-Based Access Control, or RBAC, comes in. RBAC works by assigning roles to users or groups, and each role comes with a specific set of permissions.

Azure has many built-in roles. The three most common ones you'll encounter are:

• Owner: Has full access to manage everything, including the ability to give access to others.
• Contributor: Can create and manage all types of Azure resources, but can't grant access to others.
• Reader: Can view existing Azure resources, but can't change them.

Critically, you don't just assign a role. You assign it at a specific scope. This determines which resources the permissions apply to. Think of it like a hierarchy.

If you make someone an Owner at the Subscription level, they are automatically an Owner for all the Resource Groups and Resources within that subscription. This inheritance makes managing permissions efficient, but it also means you should always assign roles at the lowest possible scope that still gets the job done.

Beyond controlling who can do what, Azure provides tools to help you organize your resources and protect them from accidental mistakes. Two of the most important governance features are resource locks and tags.

Resource Locks are like putting a digital padlock on your most important services. They prevent users—even Owners—from accidentally deleting or modifying critical resources. There are two types of locks:

• CanNotDelete: Users can still read and modify a resource, but they can't delete it.
• ReadOnly: Users can only read a resource. They can't modify or delete it.

Tags are simple key-value pairs of metadata that you can apply to your Azure resources. They don't affect how the resources run, but they are incredibly powerful for organization. You can use tags to categorize resources by department, environment (like 'Production' or 'Development'), or project. This makes it easy to track costs and manage resources that belong together, even if they're in different resource groups.

By mastering users, groups, roles, locks, and tags, you create a secure and well-organized foundation for everything you build in Azure.