🔑 Azure Identity & Access - Advanced

Conditional Access Policies

# Create conditional access policy
az ad conditional-access policy create \
  --display-name "Require MFA for sensitive apps" \
  --conditions '{"applications":{"includeApplications":["Office365"]},"users":{"includeRoles":["Admin"]}}' \
  --grant-controls mfa

Privileged Identity Management (PIM)

# Activate eligible role
az rest --method post \
  --uri "https://management.azure.com/subscriptions/{subscription-id}/providers/Microsoft.Authorization/roleAssignments" \
  --body '{"properties":{"roleDefinitionId":"/subscriptions/{subscription-id}/providers/Microsoft.Authorization/roleDefinitions/admin"}}'

Zero Trust Architecture

// Validate every request
async function verifyAccess(context) {
  const token = context.headers.authorization;
  const validated = await validateToken(token);
  
  if (!validated.isValid) {
    throw new Error("Access denied");
  }
  
  return validated;
}

Key Takeaways

• **Conditional Access** enforces security policies

• **PIM** limits privileged access

• **Zero Trust** validates every request

• **Governance** ensures compliance

Next Steps

Learn about advanced scaling and optimization.