AZ-104: Microsoft Azure Administrator Preparation (Part 1)
Tags: azure, identity, authentication
Published: 2023-03-29 15:31:23

This is the syllabus we will cover here for the AZ-104 exam.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5r1uwdor9yketwrvj4g9.png)



**Managing Azure Active Directory**
- Identity : Something that can be authenticated ex: A user / service etc.

- Account : Data attributes associated with an identity is an account.
- Azure AD account: Accounts created in Microsoft cloud or AD.

- Azure Tenant /directory: Dedicated instance of an Azure AD which is generally created during  sign up of any Microsoft cloud subscription.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5ed3oi2xq5pkebkttwzs.png)

**Azure active directory (AD) vs Azure active directory  domain services (ADDS)**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lo5n6a4ci5npko3y3r7u.png)

**Azure AD pricing**

Azure Active Directory comes in four editions—Free, Office 365 apps, Premium P1, and Premium P2. The Free edition is included with a subscription of a commercial online service, e.g. Azure, Dynamics 365, Intune, and Power Platform. Office 365 subscriptions include the Free edition, but Office 365 E1, E3, E5, F1 and F3 subscriptions also include the features listed under the Office 365 apps column. The Premium editions are available through your Microsoft representative, the Open Volume License Program, and the Cloud Solution Providers program. Azure and Office 365 subscribers can also buy Azure Active Directory Premium P1 and P2 online. Sign in here to purchase.

Check out from this [link](https://azure.microsoft.com/en-us/pricing/details/active-directory/)

)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8zqbpz4pjo6v70qd1vdw.png)

**User accounts**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cvte4c4x2wu27e68dt62.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xpqc9qz3oooi3sw6u2c6.png)



**Group**

We can have 2 type of groups. 1) Security Groups

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n12j58yhrfxn3w6nrx44.png)
2)Microsoft 365 Groups

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/un9g3g9g5qpl3a28rxkc.png)
While creating a group, you can also see these two:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c6jpjkfmj9d5ptg1g50v.png)




Moreover, the assigned type can be 1)Assigned
Note: You can not use Dynamic user and Dynamic device in Azure free account. You need Premium 1 or 2 to use these assigned features.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gt129pf0e1za3ud533k2.png)


2) Dynamic user: You can set some rules by which if any user follows those, they get assigned to those groups... Or automatically gets added or removed. 
While using dynamic user, you have to provide dynamic query.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1zjxbopxefh8iyoo9l8i.png)

You have to then provide property, operator and value.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qnq9tuve0jn22oi7ojxc.png)
After selecting these 3 options, we get this query:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s5tmbxhrslica7j3c7ag.png)
You can then save that one and create.
Moreover, you can also manually add people and if that person also follows the group rules, then you can see the tick option.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tt4kggl87ds8s499zclg.png)
Now, users who follow this rule will automatically get added to this group.

But if you add someone and that person does not follow group rules, you will see a cross .

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h4nmov7mu2zg5h5shac0.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s6mmtiib8psq3ck0penh.png)


3)Dynamic device : Devices depending on operating system or others will automatically get into this group. So, you need to share metrics etc here.
While creating a group, you can again check this assigned options:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ywm0tvf16huiscfteqvj.png)

**Azure AD Join**

While connecting your device with Azure AD, you can get these features:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h6ali013vfkkqoe4sb6s.png)

**Self service Password generation**
Basically users will be prompted to set a new password once they login.
This is the features and process we need to go through: 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/poi8w6bwdz4u1bbena46.png)

For the admin users, they will be able to set password by default.
But for the others, you need to go to the users or Password reset and then select.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/90541bh2x36u5k1twa6c.png)
When you choose the selected options,you can choose users to reset their password.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9lq4i7pkuwytnxzshmv0.png)
Moreover, you can set the number of authentication the users can set.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lwv0r13jiw3phdpxrh7d.png)


**Multi tenant/directory environment**

No tenant or directory is dependent on other tenant. Check out the features:
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/docfwjpzxtmoav6mk6my.png)

So, after going to the Azure AD, you can go to the manage tenants

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4dgmwyomr71y0x05c82f.png)
If we want to create a new one, we can follow this process:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tp6xqz1wa4us8nidrtp2.png)
in the configuration page, you can see that we will always have `.onmicrosoft.com` while creating a new organization's domain.

Then we can create a tenant . 

Moreover, we can customize our new tenant with a custom domain name if we wish to.
Finally, we can switch between different tenants by this one.
After pressing this icon, we can see how many tenants we have and which tenants we want to switch.

As we have just one for now, we can see switch options . But it might look like this.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a1z0lzi26tahlgpamqg5.png)


**Azure Subscriptions**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/49bxrpkhwdig51ezykzh.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oeep9o0q6cr5pom257rg.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4c115qccffvc9o5ulsqu.png)


**Role based access control (RBAC)**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ng9oe0qx7xm6769rrna0.png)
Here you need to know about security/service principal, role definition (how much a role can access or perform), scope (role's power boundary), role assignment(adding role definition to a service principal at a certain scope)

So, what is role definition?
By default we have certain roles created (Contributor, owner) but if we need to create new roles, we can do that too. It's called Custom roles.

Here you can see the json code for Contributor role.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rkctwg7ocsw7v3e2f9is.png)

Sp, what is scope?
It actually means boundary. For example, if we set a role to "Management group" level, even Subscription, resource group and resources will have access to that role.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nbxfk9xm92nzfe9bnx2j.png)


Again , if we just provide a role access to just the resource group, resource group and resources will have that access.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jj7a0ipibtc82bdbmz02.png)
So, this is how this tree comes in to play.
Moreover, these are the difference between RBAC and AD roles.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6nrxy6yy49qm0ou3vx85.png)
You can refer to this picture.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vtfpiucvzazqkiwmqi7c.png)

Custom roles :
Roles that we create for our own use.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/algvm2zjxisyts4h8xs6.png)


So, in the Azure portal, you have to go to your subscription and then IAM(Access control)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2x7aofdwa16xfd9l57zw.png)
Here you can see all of the things we have mentioned by far.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cjylwhawgz97bqztgvbb.png)
 Moreover, when we go to the Management group, you can see that my root management group has been provided a subscription key.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wdlzzloqx5jxxfnqqued.png)

Here you can see that, under root management group, all the management groups reside and surely we can assign each management group a different subscription.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2fjw48dkuvu9b0paeud3.png)

Here, all of the management groups under our root management group can now access this subscription key due to the concept Scope we discussed earlier.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wjs514ts36z9blef25je.png)

Moreover, we can move our subscription from one management group to another.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5ti2lra8zkz4ys26s9qh.png)
Just we need to go to the level-1 management group and add subscription. Then we can add it and now level-1 will get access to the subscription, not the root management group.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lw4b636gyhygocbxnl05.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rr5ykslazhetxia7wwhl.png)
So, what is the difference?
Actually now not all the management group under root management group can access to the subscription except the level-1 management group.
To check out the roles, we need to go to the management group and go to IAM.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j0vgqy9rv5sds85xq0pq.png)
You can see a lots of roles here.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/df287y1xxsgav6j8v0gb.png)
Moreover, if we want to assign some roles to some people, just go to role assignment and then +add

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2yi505987emtx4ir12fb.png)
Select people.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qqz6j8te8jn2sj7ispav.png)
We have given 3 users the reading access of this resource ( meaning the Level-1 management group)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wszwown9kx9py8s9y9fg.png)
To create a custom role, we have to follow this process.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b26fguav5iogyooebdbq.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m9nermr8c15xgwf3pp8y.png)
Select permissions

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9p4ov19jc0nusym6drai.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9y8hvs41sncm4q5phkf7.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ap1o1b2ktpcy3lkeqhjk.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/719q0eursq6lfkjnutau.png)
Now you can filter our your custom role from the roles.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/townv2yqd0qlmrz42qhn.png)

**Azure Tags**
Tags are used to track and filter a lot of things and they are in name:value pair. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bwza0qlbsxaa8gbfr04b.png)
If you go to your resources and choose one, here you will find tags.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pf3yq34ti9tlrl7gkwyb.png)
Add your tags (name: value)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i23jxo34f5z00cyg4umq.png)

Note: The tags that you create on Resources level will be part of billing . So, if you create tag on resource group level,it won't be a part of billing.

**Resources Lock**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2u6yqqi4dxvbkzp1dlsl.png)
You can add them to subscription , resource and resource group level.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/myothjdw7p4z0yvregyw.png)
Here we have went to the resources group and choosed a resource group, and you can see the lock here.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/drm2drzfzg7lsmsu4tge.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lqn4z1d5kctwxlqsb9ls.png)

Now if you check out this resource under the resource group you created a lock, you will see the resource also inherits this.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/df7oyrmn56rjpq1bq1lf.png)
The reason in simple. As we have assigned the lock on resource group level, the resources also got that as assigned.
If you now try to delete this resource which has already a lock (that lock won't let you delete this resource), 


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j18g4u2neu6u5t93c9ic.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/owjv9pjy990u5hucpipl.png)
You can see that then.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7su5654cwvuyeigu7k13.png)
**Analyze costs**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ykfua77g9cr4xi983y83.png)
These are some ways to minimize cost 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2j0ubv9ue95eobc1q3qp.png)
**Azure Policies**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/adbvvzlamnyzgkantsiq.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tx4fsqvlq72gvnr82bsr.png)
 You can also chain policies together to create an Azure Initiative.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4f2f84goks2unctc809t.png)
In azure portal , you can see this:
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/egmcuw8gob7t6k30zvkw.png)
In the definitions, you can find all of the built in policies.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/who5kq9yllhwv1107v9w.png)
Moreover, this is how you can create initiatives by adding Azure policy definitions.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wudndspvseesj36lbrg5.png)

To learn more about identity and authentication, you can checkout [Auth0 website](https://auth0.com/docs)

<img src="https://media0.giphy.com/media/Nfs5y1kzJKfu/giphy.gif?cid=ecf05e472d3w835ptrri5m1p6ifnwl9mi7ope9pifvhpcxf6&rid=giphy.gif&ct=g">