The "identity, access, and security" area of the AZ-900 skills outline covers more than the frequently discussed topics like MFA and Conditional Access. It also lists four concepts that rarely show up in practice question sets but are clearly written into the official outline: the defense-in-depth model, passwordless authentication, external identities, and Microsoft Entra Domain Services.
This post is the security supplement to our AZ-900 deep-dive series. Learn the fundamentals first, such as authentication versus authorization, MFA, RBAC, and Zero Trust, in Identity, Access, and Security. Here we fill in the four items that post only touched on, up to the level the exam expects.
---
The Four Exam Objectives Covered Here
All four items belong to domain 2 (Describe Azure architecture and services) in the official skills outline revised on July 20, 2026. It is the most heavily weighted domain, so even one or two questions on these topics can move you across the passing line.
| Item | Official objective wording | One-line summary | |------|------|------| | Defense in depth | Describe the purpose of the defense-in-depth model | Stack security in layers so that if one layer is breached, the next one holds | | Passwordless authentication | Describe authentication methods in Azure, including ... passwordless | Sign in with a trusted device plus a biometric or PIN instead of a password | | External identities | Describe external identities in Azure | Let partners and customers into your apps with their own accounts | | Microsoft Entra Domain Services | Describe directory services in Azure, including ... Microsoft Entra Domain Services | A managed domain you use without running domain controllers yourself |
---
Defense in Depth
A medieval castle was never defended by a single wall. Past the moat there was a wall, past the wall there were guards at the gate, and deep inside there was a vault. Even when attackers broke through one layer, the next one bought time, and the alarm went up in the meantime. Defense in depth carries exactly that idea into cloud security.
Microsoft Learn describes it as a structure with the data you need to protect at the center, surrounded by seven layers from the outside in.
| Layer (outside → inside) | What it protects | Typical measures | |------|------|------| | 1. Physical security | Datacenter buildings and hardware | Access control at Microsoft datacenters | | 2. Identity and access | Access to infrastructure and change control | Microsoft Entra ID, SSO, MFA, auditing of sign-ins and changes | | 3. Perimeter | Large-scale network attacks | Azure DDoS Protection, perimeter firewalls | | 4. Network | Communication between resources | Network security groups (NSGs), deny by default, restricted inbound access | | 5. Compute | Access to virtual machines | Restricted VM access, patching and endpoint protection | | 6. Application | Security vulnerabilities in apps | Secure development, secrets stored in Azure Key Vault | | 7. Data | Business data and customer data | Encryption at rest and in transit, key management with Key Vault |
!The seven layers of defense in depth
Why Stack Multiple Layers?
If you rely on a single layer, everything is exposed the moment that layer falls. With several layers, an attack slows down, and the alerts raised at each layer give the security team time to respond, automatically or manually. What attackers are ultimately after is the data at the center, so every outer layer exists to stretch the time it takes to reach it.
Defense in Depth vs Zero Trust
These two concepts tend to appear together, so it pays to know the difference.
| Category | Defense in depth | Zero Trust | |------|------|------| | Core idea | Stack protections in multiple layers | Trust nothing by default and verify every time | | Focus | Where to place which controls (structure) | How to decide whether to allow access (principles) | | Typical wording | "If one layer is breached, the next one stops the attack" | "Verify explicitly, use least privilege, assume breach" |
Exam tip: "The layer that filters out DDoS attacks" → perimeter. "Allow only the communication needed between subnets" → network. "The innermost layer" → data. As long as you firmly remember that physical security is the outermost layer and data the innermost, you can infer the rest from their names.
---
Passwordless Authentication
MFA makes sign-in safer by adding a factor to the password, but the password itself is still there. It can still be forgotten or leaked. Passwordless authentication removes the password altogether and signs you in with a trusted device combined with a biometric signal or a PIN. Think of skipping the door code at your apartment building and instead tapping a registered phone and scanning your fingerprint.
The Three Authentication Factors of MFA
To understand passwordless sign-in, first recall the three categories of authentication factors.
| Category | Meaning | Examples | |------|------|------| | Something you know | Information the user remembers | A password, a security question | | Something you have | A device the user carries | A code sent to a phone, a security key | | Something you are | The user's biometric signal | A fingerprint, face recognition |
Passwordless authentication combines "something you have" (a registered device) with "something you are" (a biometric) or a PIN that works only on that device. After the initial registration, the user never types a password.
The Three Options Microsoft Entra ID Supports
| Method | How you sign in | Best fit | |------|------|------| | Windows Hello for Business | A biometric or PIN tied to that PC | Information workers with their own dedicated Windows PC | | Microsoft Authenticator app | Match the number on screen in a phone notification, then confirm with a biometric or PIN | Users with an iOS or Android phone | | FIDO2 security keys | A USB, NFC, or Bluetooth hardware key | Accounts that need phishing-resistant sign-in, environments where personal phones are hard to use |
FIDO2 is an open standard built on the Web Authentication (WebAuthn) specification. Recent Microsoft documentation also calls FIDO2-based credentials passkeys, so treat the two terms as members of the same family.
Exam tip: "Eliminate password entry entirely" → passwordless authentication. "Add phone approval to the password" → MFA. Questions also like to point out that Windows Hello for Business credentials are tied to that PC, so no one else can use them from another device.
---
External Identities
Creating a company account for every outside person piles up endless accounts and passwords to manage. External identities let outside users get into your apps with accounts they already have: a work account at another company, a government-issued digital identity, or a social account such as Google or Facebook. It is like checking a visitor's own ID and handing out a visitor badge instead of printing them a new employee badge.
The roles are split. The external identity provider handles sign-in (authentication), and you manage what they can do in your apps (authorization) with Microsoft Entra ID.
| Capability | Who it is for | How it appears in your directory | Typical scenario | |------|------|------|------| | B2B collaboration | Partners and outside collaborators | Usually as guest users | A supplier's employees reach your app with their own company accounts | | B2B direct connect | Another Microsoft Entra tenant | Not represented in your directory | Establish two-way trust and collaborate in Teams shared channels | | Microsoft Entra External ID for customers | Consumers and customers | A separate external tenant, apart from your workforce | Sign up for a shopping app with a Google account (the role Azure AD B2C used to fill) |
Keep Managing Guest Access Over Time
Once guests are invited, cleanup matters. With access reviews in Microsoft Entra ID, the guests themselves or a decision maker can confirm whether access is still needed, and you can remove access for guests who no longer need it.
Exam tip: External identities are easy to confuse with SSO. SSO means signing in once to use several apps; external identities mean outside people crossing a tenant boundary with their own accounts. "External users sign in with their own credentials" → external identities (B2B collaboration).
---
Microsoft Entra Domain Services
Many older business apps cannot use modern authentication and depend on domain join or Kerberos authentication from an on-premises Active Directory. Moving those apps to Azure means you need domain controllers in the cloud too, and building, patching, and backing up those servers yourself is a burden. Microsoft Entra Domain Services lets you rent those domain capabilities as a managed service. It is like leasing an office that comes with building management instead of putting servers in your own server room.
It provides domain join, group policy, LDAP, and Kerberos/NTLM authentication, with no domain controllers for you to deploy or manage.
How Does It Work?
When you create a managed domain and choose a unique domain name, two Windows Server domain controllers are deployed into the Azure region you select. These two are called a replica set, and the Azure platform handles their configuration, updates, backups, and encryption at rest with Azure Disk Encryption.
Synchronization runs in one direction. Users and groups in Microsoft Entra ID sync to the managed domain, while resources you create directly in the managed domain do not flow back to Entra ID. In a hybrid environment with on-premises AD DS, Microsoft Entra Connect syncs on-premises information to Entra ID, and that information then continues to the managed domain.
| Category | Microsoft Entra ID | Microsoft Entra Domain Services | Self-managed AD DS | |------|------|------|------| | What it is | Cloud identity and access management | A