Azure identity & access summary: Entra ID, MFA, RBAC

The identity vocabulary AZ-900 tests, in one pass — Microsoft Entra ID, authentication versus authorization, MFA, Conditional Access, SSO and RBAC. Six questions, 2026 edition.

Try 6 free identity questions in the exam's own style — Entra ID, MFA and RBAC — every answer explained, no sign-up.

Straight to the 6 free questions ↓

Identity is where Azure Management & Governance quietly begins, and AZ-900 tests it as vocabulary, not architecture. You do not need to design a sign-in system — you need to know which service does what, and to keep two words apart: authentication and authorization. Get those straight and most identity questions answer themselves. The diagram above lays out the whole flow in one line, from a user to Azure resources.

The one service to anchor everything: Microsoft Entra ID

Microsoft Entra ID is Azure’s cloud identity and directory service — it stores your users and groups and handles their sign-in. It was formerly called Azure Active Directory, and the exam may still use that name; treat the two as identical. Entra ID is the front door: everything about proving who you are runs through it.

Authentication vs authorization

This is the single most useful distinction on the identity side.

Authentication (AuthN) — proving who you are. The sign-in. Handled by Entra ID.
Authorization (AuthZ) — deciding what you are allowed to do. Handled by RBAC.

The shortcut: AuthN = who, AuthZ = what. Every distractor that swaps these two is wrong.

The identity toolkit, in one pass

Term	What it does	One-line tell
Microsoft Entra ID	Cloud identity & directory service	”stores users and groups, handles sign-in”
MFA	Second verification on top of the password	”protects against a stolen password”
Conditional Access	Grant / block / challenge a sign-in by conditions	”block by location, require MFA when risky”
SSO	One sign-in reaches many apps	”sign in once, no re-entering credentials”
RBAC	Authorization: role + principal + scope	”give this user this permission, here only”

Multi-factor authentication (MFA) adds a second factor — a phone code or fingerprint — so a stolen password alone cannot get in. Conditional Access sits at the sign-in and decides, from signals like location and device risk, whether to allow, block, or demand MFA. Single sign-on (SSO) lets one authenticated session carry across many apps, shrinking the number of passwords in play.

RBAC: the authorization mechanism

Once Entra ID has confirmed who you are, role-based access control (RBAC) decides what you can touch. An RBAC assignment is always three things: a role (the permissions), a principal (the user, group, or app), and a scope (management group, subscription, resource group, or single resource). Grant a person the right role at the smallest scope that works — that is least privilege in practice, and it is where identity feeds directly into governance.

How this ties into governance

Identity is the who of governance. RBAC controls who may act; Azure Policy controls what any resource is allowed to be, regardless of who created it. The two are complementary, and the exam likes to test the seam — see the Azure Policy vs RBAC comparison for that. For the wider control plane — management groups, subscriptions, Cost Management, Azure Monitor — see the Management & Governance domain page, and the AZ-900 cheat sheet for the fast recap.

How to use the questions below

Answer each before revealing the explanation, and when you miss, read past the correct option to why each distractor fails — the wrong answers here are usually the right term for the wrong job (RBAC offered where MFA belongs, Conditional Access offered where RBAC belongs). Getting the reason right is what carries into the exam.

An identity flow reading left to right: a user signs in to Microsoft Entra ID, Azure's cloud identity and directory service, which authenticates them and enforces multi-factor authentication and Conditional Access policies; once the sign-in is trusted, role-based access control (RBAC) authorizes what the user may do; the request then reaches Azure resources. The diagram separates authentication (Entra ID, proving who you are) from authorization (RBAC, deciding what you may do).

6 free AZ-900 practice questions

Answers and explanations — no email wall

AZ-900 Question 1 of 6

Which Azure service is the cloud-based identity and directory service that stores users and groups and handles sign-in?

Answer: A — Microsoft Entra ID (formerly Azure Active Directory)

Microsoft Entra ID is Azure's cloud identity and directory service — it holds the user and group accounts and authenticates sign-ins. Why not the others: Azure Policy governs resource configuration, not identity; Azure Monitor collects telemetry and metrics; Defender for Cloud is a security-posture and threat-protection tool. Pro tip: Entra ID was renamed from Azure Active Directory — the exam may use either name for the same service.

AZ-900 Question 2 of 6

What is the difference between authentication and authorization?

Answer: A — Authentication proves who you are; authorization decides what you are allowed to do

Authentication (AuthN) verifies identity — the sign-in that proves who you are. Authorization (AuthZ) is the separate step that grants or denies access to a resource once you are signed in. Why not the others: the second option reverses the two; they are not the same step; and authorization is not limited to devices. Pro tip: remember AuthN = who, AuthZ = what.

AZ-900 Question 3 of 6

Which security feature requires a second verification, such as a code from a phone app, in addition to a password?

Answer: A — Multi-factor authentication (MFA)

Multi-factor authentication asks for a second factor — something you have (a phone code) or are (a fingerprint) — on top of the password, so a stolen password alone cannot sign in. Why not the others: RBAC controls what an identity may do, not how it proves itself; SSO reduces the number of sign-ins rather than adding a factor; a resource lock prevents accidental deletion or changes to a resource. MFA mainly protects against stolen or guessed passwords.

AZ-900 Question 4 of 6

A company wants to block sign-ins from outside its country and require MFA only when the risk is high. Which Microsoft Entra feature enforces access based on such conditions?

Answer: A — Conditional Access

Conditional Access evaluates signals — location, device, user, risk — and then grants, blocks, or challenges the sign-in (for example demanding MFA). Why not the others: Azure Policy governs resource settings, not sign-in conditions; management groups organise subscriptions for governance; Azure Advisor gives best-practice recommendations. Pro tip: 'grant or block a sign-in based on conditions like location or device' is the Conditional Access giveaway.

AZ-900 Question 5 of 6

A user signs in once and then reaches several Microsoft cloud apps without re-entering credentials. Which capability makes this possible?

Answer: A — Single sign-on (SSO)

Single sign-on lets one authenticated session carry across multiple applications, so the user signs in once instead of once per app. Why not the others: MFA adds a verification step rather than removing sign-ins; an NSG filters network traffic to and from resources; Azure Cost Management tracks and controls spending. SSO improves both convenience and security by shrinking the number of passwords in play.

AZ-900 Question 6 of 6

In Azure, how do you give a user permission to manage virtual machines in one resource group but nothing else?

Answer: A — Assign an RBAC role scoped to that resource group

Role-based access control (RBAC) is Azure's authorization mechanism: you assign a role (the permissions) to a security principal (the user) at a scope (the resource group), granting exactly that access and no more. Why not the others: Conditional Access governs the sign-in, not resource permissions; MFA strengthens the sign-in but grants no rights; Azure Policy enforces configuration rules on resources rather than granting a person access. Pro tip: RBAC = role + principal + scope.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 6 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 300 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

300 questions in 6 full tests, AZ-900 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

What is the difference between authentication and authorization on the exam?

Authentication proves who you are — the sign-in handled by Microsoft Entra ID, often reinforced with MFA. Authorization decides what you may do once signed in, and in Azure that is RBAC. AZ-900 tests that you can keep the two ideas apart: who versus what.

Is Microsoft Entra ID the same as Azure Active Directory?

Yes. Microsoft Entra ID is the current name for the service that used to be called Azure Active Directory; it is the same cloud identity and directory service. The exam may use either name, so recognise both and treat them as one thing.

Are these real AZ-900 exam questions?

No. They are our own questions, written in the style and difficulty of the exam to teach the identity vocabulary it tests. We never reproduce real exam items — doing so breaches Microsoft's certification agreement and teaches nothing about the question you have not seen.

Updated for AZ-900 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.