Azure Active Directory (Entra ID) Concepts for AZ-500 and AZ-104

What is this page about?

A guide to the Entra ID (formerly Azure Active Directory) identity concepts shared between the AZ-104 and AZ-500 exams and how each tests them at different depths. It covers Entra editions, tenants and subscriptions and the trust boundary, the identity types Entra manages, hybrid identity, authentication methods, conditional access (the heart of both exams), Privileged Identity Management, and the RBAC-versus-Entra-roles distinction, noting AZ-104 expects basic configuration while AZ-500 goes security-deep into risk policies, identity protection, and PIM approval workflows.

What has been corrected on this page?

Every accepted correction to this page is recorded with the exact change, so readers can see how the page improved over time.

1. 11 July 2026 · corrected by Melik Can Sariyer

   3 flagged claims verified: an unverified Heineken '300 privileged users' specific statistic was generalized; a quote attributed to Alex Simons had no locatable source and was de-attributed; a claim attributed to John Lambert was generalized after confirming his real title (Microsoft CVP and Security Fellow) but not the specific quote.

   Before

   The Heineken security team's publicly described Entra ID hardening project moved over three hundred privileged users into eligible-only assignments in 2022, with average activation time under three minutes. / "The tenant is the security boundary that most teams underestimate..." -- Alex Simons, Corporate VP of Identity Program Management at Microsoft / The Microsoft Defender for Identity team and security researcher John Lambert have published detection patterns that align directly with these signals.

   After

   Organizations that have publicly described Entra ID hardening projects, including large enterprises like Heineken, have reported moving groups of privileged users from permanent to eligible-only assignments as part of zero-standing-privilege initiatives (unsourced specific figure generalized). / The tenant is the security boundary that many teams underestimate; subscriptions, resource groups, and management groups are management constructs, and the tenant is where identity actually lives (unattributed prose). / Microsoft security researchers, including John Lambert (Microsoft CVP and Security Fellow), have published detection guidance around identity risk signals that align with the concepts tested here (generalized, specific quote removed).

   Why: An unverified Heineken '300 privileged users' specific statistic was generalized since the precise figure could not be verified. A quote attributed to Alex Simons had no locatable source and was de-attributed. A claim attributed to John Lambert was generalized after confirming his real title (Microsoft CVP and Security Fellow) but not the specific quote/claim.

   View the full record →

Who checked this page?

1 contributor has checked "Azure Active Directory (Entra ID) Concepts for AZ-500 and AZ-104" on Pass4Sure. Each name below links to that person's public CitePep profile, where every contribution they have made is listed with the exact change they proposed.