An identity is a unique representation of a user or application in Azure. It carries attributes such as a username and credentials, letting the entity authenticate and then perform permitted actions on resources. Because cloud services are reachable from many locations and devices, identities form the primary security perimeter. section 2.1.2 section 2.1.3 section 1.8
Protecting an identity is not a single control. A stolen username and password can let an attacker authenticate as the user, so MFA adds a second authentication factor. Suspicious sign-ins can trigger MFA, potentially compromised privileged identities can require password changes, and phishing or lateral movement calls for detection and response beyond the initial sign-in. section 2.2.1 section 1.8.1
Use identity controls as a layered access practice:
- Authenticate users through Microsoft Entra ID (formerly Azure AD) before they access Azure resources. section 2.2.1
- Harden sign-in with MFA and use Conditional Access for granular control of authentication. section 2.14
- Authorize only needed actions with Azure RBAC roles and custom roles, following least privilege. section 2.14
- Continuously govern privileged access with PIM and access reviews, removing access when it is no longer needed. section 2.14
- Prefer managed identities where supported to avoid managing service credentials; otherwise secure service-principal credentials. section 2.14
Creating a user identity
A user identity can be created with Azure CLI by supplying a display name, a unique user principal name from a verified tenant domain, and a complex password. Requiring a password change at the next sign-in limits continued use of the initial password. Azure Cloud Shell provides a browser-based Bash environment with Azure CLI available for this workflow. section 2.1.3
Listing 2.1 Creating a user identity in Azure AD
az ad user create --display-name "Bob Miller" #1 --password dQ76bmz7rMVs9gSP #2 --user-principal-name bob@contoso.com #3 --force-change-password-next-sign-in true #4 #1 Displays the name of the user identity #2 The password used to sign in. The user can change it the next time they sign in. #3 The username of the new user, which must contain one of the verified domains for your Azure tenant #4 Requires the user to change their password the next time they sign in
The CLI listing shows the required identity fields and the force-change-password-next-sign-in option for creating an Azure AD user. section 2.1.3
Identity security spans the full security posture: secure workloads before compromise, monitor and detect suspicious activity, then investigate and respond. This matters because an attacker may begin with an already compromised identity and use it to reach additional resources. section 1.8 section 1.8.1
