Design Identity, Governance, and Monitoring
Architects design how identities authenticate and authorize, how resources are governed at scale, and how the estate is monitored. This domain applies Microsoft Entra ID, RBAC, Azure Policy, and Azure Monitor to design requirements.
Authentication and authorization design
Design identity with Microsoft Entra ID, choosing single sign-on, multifactor authentication, and Conditional Access to meet security and usability goals. Use managed identities so Azure resources authenticate to services without stored credentials, and app registrations plus service principals for applications. For business-to-consumer scenarios, Azure AD B2C or External ID handles customer identities.
Authorization with RBAC and PIM
Design least-privilege access using role-based access control assigned at the appropriate scope, preferring built-in roles and custom roles only when needed. Privileged Identity Management provides just-in-time, time-bound elevation with approval and auditing for administrative roles, reducing standing privilege.
Governance at scale
Structure management groups, subscriptions, and resource groups to apply governance consistently. Azure Policy enforces and audits configuration such as allowed SKUs and required tags, and initiatives group policies. Azure Blueprints and landing zones (the Cloud Adoption Framework) provide repeatable, compliant environments.
Monitoring and observability design
Design monitoring with Azure Monitor, sending platform and resource logs to a Log Analytics workspace and querying with KQL. Application Insights instruments applications for performance and failures, and alerts plus action groups drive response. Centralizing logs supports security and operational analysis.