Azure Security Fundamentals: Entra ID, Defender, Sentinel

Securing Azure comes down to three pillars: identity control in Microsoft Entra ID, posture and workload protection in Microsoft Defender for Cloud, and detection and response in Microsoft Sentinel. Get those three working together and you have covered most of what an Azure security engineer is hired to do.

If you are moving into cloud security from IT support, systems administration, or networking, Azure is one of the friendlier entry points. The tooling is opinionated, the documentation is strong, and the job market for Azure security skills is broad because so many enterprises already run Microsoft 365 and Windows Server estates. This guide walks through the core services, how they fit together, and how to build the hands-on skill that employers actually test for.

Why Azure security is structured around identity

In on-premises environments, the firewall was the primary control. In Azure, identity is. Almost every action against an Azure resource is an authenticated and authorized API call, which means the identity layer decides what happens before any network control ever gets a vote.

That layer is Microsoft Entra ID, formerly Azure Active Directory. It handles authentication, multifactor authentication, Conditional Access, privileged role management, and identity governance. Azure role-based access control (Azure RBAC) then decides what an authenticated identity can do to resources inside a subscription or resource group.

Two distinct permission models trip up newcomers constantly:

• Microsoft Entra roles control the directory itself: users, groups, applications, and tenant settings. Global Administrator lives here.
• Azure RBAC roles control resources: virtual machines, storage accounts, key vaults, networks. Owner and Contributor live here.

A person can hold one without the other. Understanding that separation is one of the fastest ways to sound competent in an Azure security interview.

Microsoft Entra ID: the controls that matter most

Conditional Access

Conditional Access is the policy engine that evaluates signals such as user, device, location, application, and risk level, then grants access, blocks it, or requires an additional control like MFA. Microsoft positions it as the Zero Trust policy engine for the tenant, and in practice it is where most of an organization's real access decisions live.

A few practices carry disproportionate weight:

1. Use report-only mode first. Deploy a new policy in report-only mode and review the results before enforcing it. The What If tool lets you simulate how a policy would apply to a specific user and app.
2. Exclude break-glass accounts. Keep at least one emergency access account outside your Conditional Access policies so a misconfiguration cannot lock every administrator out of the tenant.
3. Cover every application. Microsoft recommends policies scoped to all resources rather than per-app policies, so newly onboarded applications are protected by default.
4. Adopt a naming convention. Conditional Access has a hard per-tenant policy limit, so consolidating well-named policies scales better than creating a new one for every request.

Privileged Identity Management

Standing administrative access is one of the largest risks in any tenant. Microsoft Entra Privileged Identity Management (PIM) lets you make privileged roles eligible rather than permanently assigned, so an administrator activates the role for a limited window, with justification and approval, and Conditional Access can be evaluated at activation time.

Managed identities

For workload-to-workload authentication, managed identities remove the need to store credentials in code or configuration. An Azure resource gets an identity in Entra ID, and you grant that identity RBAC permissions directly. If you take one habit from this article into a lab, make it this one: stop putting secrets in application settings.

Microsoft Defender for Cloud: posture and workload protection

Defender for Cloud does two jobs. It tells you how secure your environment is, and it protects the workloads running in it.

The posture side is cloud security posture management. The foundational CSPM tier provides asset discovery, continuous assessment, security recommendations, compliance against the Microsoft Cloud Security Benchmark, and a secure score that summarizes your current posture. A higher secure score means lower identified risk. The paid Defender CSPM plan adds capabilities such as attack path analysis, a cloud security explorer for graph-style queries, agentless scanning, and AI security posture management.

The workload protection side is delivered through per-resource Defender plans covering servers, storage, containers, databases, key vaults, and more. These generate security alerts rather than posture recommendations.

A useful mental model:

Question you are answering	Where to look
How exposed am I right now?	Secure score and recommendations
Which misconfiguration should I fix first?	Attack path analysis, risk prioritization
Am I meeting a specific standard?	Regulatory compliance dashboard
Is something happening right now?	Defender plan security alerts
Can I investigate across the whole estate?	Microsoft Sentinel

Microsoft Sentinel: detection, investigation, and response

Microsoft Sentinel is the cloud-native SIEM and SOAR platform. It ingests logs from Azure, Microsoft 365, on-premises systems, and third-party sources, then supports detection through analytics rules, investigation through Kusto Query Language (KQL), and automated response through playbooks built on Azure Logic Apps.

For someone building a security engineering career, Sentinel is where the work becomes visible. Writing a KQL query that finds impossible-travel sign-ins, or a playbook that disables a compromised account automatically, is exactly the kind of artifact that belongs in a portfolio.

Start with these skills in order:

1. Connect a data source and confirm data is arriving in the workspace.
2. Learn enough KQL to filter, summarize, and join tables.
3. Build a scheduled analytics rule that produces an incident.
4. Attach a playbook that performs one automated response action.
5. Document the detection logic, the false positive rate you observed, and what you would tune.

How Azure compares to AWS and Google Cloud

Cloud security concepts transfer, but the names do not. If you already know one platform, this mapping shortens the learning curve considerably.

Capability	Azure	AWS	Google Cloud
Identity provider	Microsoft Entra ID	IAM and IAM Identity Center	Cloud Identity and IAM
Posture management	Defender for Cloud	Security Hub	Security Command Center
Threat detection	Defender plans	GuardDuty	Security Command Center
SIEM	Microsoft Sentinel	Security Lake with partner SIEM	Google Security Operations
Secrets and keys	Azure Key Vault	KMS and Secrets Manager	Cloud KMS and Secret Manager
Network isolation	Virtual Network, NSG, Azure Firewall	VPC, security groups, Network Firewall	VPC, firewall rules

The shared responsibility split works the same way across all three: the provider secures the cloud, you secure what you put in it. We covered that boundary in detail in our guide to the cloud shared responsibility model, and the identity principles carry over from our AWS IAM security best practices walkthrough.

Where AZ-500 fits

The Microsoft Certified: Azure Security Engineer Associate credential is earned by passing Exam AZ-500: Microsoft Azure Security Technologies. Microsoft's published study guide groups the skills measured into four areas: secure identity and access, secure networking, secure compute, storage and databases, and securing Azure using Microsoft Defender for Cloud and Microsoft Sentinel, with the Defender and Sentinel area carrying the largest weighting.

Microsoft expects candidates to have practical experience administering Azure and hybrid environments, and familiarity with Entra ID plus Azure compute, networking, and storage. That is worth taking seriously. AZ-500 rewards people who have actually configured Conditional Access, enabled a Defender plan, and written a KQL query, not people who have only read about them.

Because exam objectives can be updated, always confirm the current version against the official AZ-500 study guide before you book. Our certifications page shows how AZ-500 sits alongside the AWS and Google Cloud security tracks.

A practical 30-day Azure security lab plan

You do not need a corporate tenant to build real skill. A personal Azure subscription and a Microsoft 365 developer tenant are enough.

Week 1: identity. Create users and groups, enforce MFA, build three Conditional Access policies in report-only mode, then enforce them. Configure a break-glass account and document why it is excluded.

Week 2: resource security. Deploy a virtual network with subnets and network security groups. Create a Key Vault, store a secret, and access it from a virtual machine using a managed identity rather than a stored credential.

Week 3: posture. Enable Defender for Cloud, review your secure score, and remediate the three highest-impact recommendations. Capture the score before and after.

Week 4: detection. Create a Sentinel workspace, connect the Entra ID sign-in logs connector, write a KQL detection for repeated failed sign-ins followed by a success, and wire a playbook to it.

Write each week up as a short project document with the objective, the steps, the evidence, and what you would do differently. Four documents like that are worth more in an interview than a certification alone.

Frequently asked questions

Is Microsoft Entra ID the same as Azure Active Directory?

Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID. The service and its capabilities remain the same, but current documentation, portal labels, and exam content use the Entra ID name, so learn the new terminology.

Do I need AZ-104 before AZ-500?

It is not a formal prerequisite. Microsoft does expect candidates to have practical Azure administration experience, so many people find AZ-104 a useful foundation. If you already administer Azure day to day, you can go straight to AZ-500.

What is the difference between Microsoft Defender for Cloud and Microsoft Sentinel?

Defender for Cloud focuses on the security posture of your cloud resources and on protecting specific workloads. Sentinel is a SIEM and SOAR platform that collects logs from many sources, correlates them into incidents, and automates response. Most organizations run both, with Defender for Cloud alerts feeding into Sentinel.

Can I learn Azure security without paying for a subscription?

Largely, yes. Azure offers a free account with credits, and Microsoft provides free learning paths and sandbox exercises on Microsoft Learn. Some advanced Defender for Cloud and Sentinel features are paid, so plan your labs and turn resources off when you finish.

Does Azure security experience transfer to AWS and Google Cloud?

The concepts transfer very well. Identity, least privilege, network segmentation, encryption, logging, and posture management exist on all three platforms. What changes is the service names and the configuration model, which is why multi-cloud training is more efficient than learning one platform at a time.

How long does it take to become job ready in Azure security?

That depends on your starting point. Someone with IT support or systems administration experience can typically build job-ready cloud security skills in several months of consistent, hands-on study. Someone starting from scratch should plan for longer and prioritize building a documented portfolio of labs and projects.

Bring it together with structured practice

Azure security is learnable, but scattered tutorials rarely produce the depth interviews test for. PrimeSec Academy's 20-week program covers AWS, Azure, Google Cloud, and AI platform security through hands-on labs, 36 projects, and a defended capstone, so you finish with evidence rather than just notes.

See what is covered in the curriculum, or enroll and start building.