Microsoft Entra ID is a cloud-based identity and access management (IAM) service. Its primary function is to serve as an identity provider (IdP). It manages user identities and facilitates secure access to resources by handling authentication (verifying a user's identity, typically through sign-in) and authorization (granting the verified user appropriate permissions). The other options represent different categories of services: Microsoft Sentinel is a SIEM, Microsoft Defender XDR is an XDR system, and management groups are an Azure resource hierarchy construct.

Microsoft Entra documentation: "Microsoft Entra ID is a cloud-based identity and access management (IAM) solution... Microsoft Entra ID enables your employees to securely access both external and internal resources. It is the central point for managing identities and access control."

Source: Microsoft. (2024). What is Microsoft Entra ID?. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/entra/fundamentals/whatis (Introduction section).

Microsoft Entra documentation on federation: "Microsoft Entra ID can act as the identity provider (IdP) for applications."

Source: Microsoft. (2023). Federation with a SAML/WS-Fed identity provider (IdP) for B2B. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/entra/external-id/direct-federation (Overview section).

Microsoft Sentinel documentation: "Microsoft Sentinel is a scalable, cloud-native solution that provides security information and event management (SIEM) and security orchestration, automation, and response (SOAR)."

Source: Microsoft. (2024). What is Microsoft Sentinel?. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/azure/sentinel/overview (Introduction section).

Yes. Microsoft Defender for Cloud includes Microsoft Defender for Storage, a specific plan designed to detect anomalous activities and potential threats against Azure Storage accounts, such as malware uploads or access from suspicious IP addresses.

Yes. Foundational Cloud Security Posture Management (CSPM) capabilities are enabled by default and are free for all Azure subscriptions. These features provide a Secure Score and basic security recommendations to help strengthen cloud security posture.

Yes. Microsoft Defender for Cloud (formerly Azure Security Center) can extend its security posture management and threat protection to on-premises and other cloud environments. This is achieved by onboarding these non-Azure machines using Azure Arc.

Microsoft Corporation. (2024). Overview of Microsoft Defender for Storage. Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction. (This document confirms that Defender for Storage "detects unusual and potentially harmful attempts to access or exploit your storage accounts.")

Microsoft Corporation. (2024). Cloud Security Posture Management (CSPM). Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management. (This source states, "The foundational CSPM capabilities in Defender for Cloud are free.")

Microsoft Corporation. (2024). Connect your non-Azure machines to Microsoft Defender for Cloud. Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/azure/defender-for-cloud/connect-on-premises-machines. (This article details the process of using Azure Arc to onboard on-premises servers for security evaluation by Defender for Cloud.)

Microsoft Intune is a cloud-based unified endpoint management (UEM) solution for managing both corporate-owned and personally-owned devices and applications. The primary administrative interface for configuring and managing Intune is the Microsoft Endpoint Manager admin center. This web-based console unifies the management experience for Intune and Configuration Manager, providing a single place to create policies and manage devices. While Intune integrates heavily with Azure Active Directory for identity and access management, its specific device and application management functions are performed within the Endpoint Manager portal. The security and compliance centers serve different purposes related to threat protection and data governance, respectively.

Microsoft Intune Documentation: "The Microsoft Endpoint Manager admin center is a one-stop shop where you can manage all your endpoints. It brings together the functionality of Microsoft Intune and Configuration Manager."

Source: Microsoft Docs, "Walkthrough the Microsoft Endpoint Manager admin center," Get Started section.

Microsoft Intune Documentation: "Microsoft Intune is a cloud-based service that focuses on mobile device management (MDM) and mobile application management (MAM). You control how your organization’s devices are used... You connect to Intune using the Microsoft Endpoint Manager admin center."

Source: Microsoft Docs, "What is Microsoft Intune?," How to get Intune section.

The Microsoft Cloud Adoption Framework for Azure (CAF) is a collection of documentation, implementation guidance, best practices, and tools designed to help organizations accelerate their cloud adoption journey. It is based on the experiences and best practices from Microsoft employees, partners, and customers. The framework provides a structured approach to cloud adoption, covering strategy, planning, readiness, migration, and governance.

• Azure Blueprints is a service for deploying and updating cloud environments in a repeatable manner using composable artifacts like resource groups, policies, and role assignments.
• Azure Policy is a service for creating, assigning, and managing policies to enforce organizational standards and assess compliance.
• A resource lock is a feature that prevents accidental deletion or modification of Azure resources.

Microsoft Learn. (n.d.). What is the Microsoft Cloud Adoption Framework for Azure?. Retrieved from https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/overview.

Reference Point: The overview section states, "The Microsoft Cloud Adoption Framework for Azure is proven guidance that's designed to help you create and implement the business and technology strategies necessary for your organization to succeed in the cloud. It provides best practices, documentation, and tools that cloud architects, IT professionals, and business decision makers need to successfully achieve their short- and long-term objectives."

Microsoft Learn. (n.d.). What is Azure Blueprints?. Retrieved from https://learn.microsoft.com/en-us/azure/governance/blueprints/overview.

Reference Point: The documentation explains that Azure Blueprints enables cloud architects to define a repeatable set of Azure resources that implements and adheres to an organization's standards, patterns, and requirements.

Microsoft Learn. (n.d.). Lock resources to prevent unexpected changes. Retrieved from https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources.

Reference Point: The documentation states, "As an administrator, you may need to lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources."

Statement 1: No. Azure Active Directory (now Microsoft Entra ID) is available in several editions: Free, Microsoft 365 Apps, Premium P1, and Premium P2. Each subsequent edition includes more advanced features. For example, features like Conditional Access and Privileged Identity Management (PIM) are only available in the Premium editions.

Statement 2: Yes. The Azure portal is a primary web-based user interface for creating, managing, and monitoring Azure resources, which includes the components of an Azure AD tenant like users, groups, and application registrations.

Statement 3: No. Azure Active Directory is a fully managed, multi-tenant cloud service (Identity as a Service - IDaaS) provided by Microsoft. Microsoft is responsible for hosting and managing the underlying infrastructure. Customers consume the service and do not need to deploy or maintain any virtual machines to run the Azure AD tenant itself. This is a fundamental difference from traditional on-premises Active Directory Domain Services (AD DS).

Microsoft Entra pricing page: This official Microsoft documentation provides a detailed comparison table showing the different features available across the Free, Premium P1, and Premium P2 editions of Microsoft Entra ID (formerly Azure AD).

Source: Microsoft, "Microsoft Entra pricing," Microsoft Security, Accessed October 13, 2025.

What is Azure Active Directory?: This fundamental documentation explains that Azure AD is a cloud-based identity service and mentions the Azure portal as a tool for management.

Source: Microsoft Learn, "What is Azure Active Directory?," Azure Active Directory Fundamentals, Last reviewed May 23, 2023. See the section "How can I get started with Azure AD?".

Compare Active Directory to Azure Active Directory: This document explicitly clarifies the architectural differences, stating that Azure AD is a managed cloud service, contrasting it with the server-based infrastructure required for on-premises AD DS.

Source: Microsoft Learn, "Compare Active Directory to Azure Active Directory," Azure Architecture Center, Last updated February 28, 2023. See the section "Architectural differences."

Microsoft Cloud App Security (now part of Microsoft Defender for Cloud Apps) integrates with Azure AD Conditional Access to enable real-time monitoring and control over user sessions in cloud applications. This feature, called Conditional Access App Control, acts as a reverse proxy. When a user session is routed through it, administrators can enforce granular policies, such as blocking file downloads, protecting files on download with sensitivity labels, or monitoring specific user activities within the app. This provides a powerful way to prevent data leakage and enforce security compliance in real time for sanctioned applications.

Microsoft Learn. "Deploy Conditional Access App Control for featured apps." Microsoft Defender for Cloud Apps Documentation. States, "Session controls in Microsoft Defender for Cloud Apps work with Azure AD Conditional Access to monitor and control user app sessions in real time, based on access and session policies."

Microsoft Learn. "Conditional Access - Session." Azure Active Directory Documentation. Under the "Use Conditional Access App Control" section, it explains, "Conditional Access App Control uses signals from Microsoft Defender for Cloud Apps to apply access controls on an organization's cloud apps."

Microsoft Learn. "What is a session policy?" Microsoft Defender for Cloud Apps Documentation. Describes the capability: "Defender for Cloud Apps session policies enable real-time session-level monitoring, granting you granular visibility into cloud apps and the ability to control different actions depending on the user, location, device, and app."

Azure DDoS Protection Standard is configured at the virtual network (VNet) level. When a DDoS protection plan is associated with a VNet, all resources within that VNet that have a public IP address are automatically protected. This includes resources such as virtual machines, load balancers, and application gateways. The protection is not applied to logical management containers like resource groups or identity services such as Azure Active Directory users or applications.

Microsoft Learn, Azure DDoS Protection Documentation: In the "Overview of Azure DDoS Protection" section, it states, "You can enable DDoS protection on any new or existing virtual network, and it requires no application or resource changes. It has several advantages over the Basic service, including telemetry, alerting, and tuning through machine learning algorithms." This confirms that the service is enabled on virtual networks.

Source: Microsoft Corporation. (2024). What is Azure DDoS Protection? Retrieved from Microsoft Learn. (See Section: "Azure DDoS Protection tiers")

Microsoft Learn, Quickstart: Create and configure Azure DDoS Protection Standard: The tutorial steps explicitly demonstrate this process. Step 2 is "Create a DDoS protection plan," and Step 4 is "Enable DDoS protection for a virtual network." The procedure involves associating the created plan directly with a VNet.

Source: Microsoft Corporation. (2024). Quickstart: Create and configure Azure DDoS Protection Standard using the Azure portal. Retrieved from Microsoft Learn. (See Section: "Enable DDoS protection for a virtual network")

Encrypting is the process of converting plaintext data into a scrambled, unreadable format called ciphertext. This transformation is done using a cryptographic algorithm and a specific 'key'. The primary purpose of encryption is to ensure confidentiality. The data remains unreadable and unusable to anyone who does not possess the corresponding key to decrypt it back into its original, readable form. The other options are incorrect; compressing reduces file size, archiving is for long-term storage, and deduplicating eliminates redundant data to save space.

Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. In Chapter 2, Section 2.1, "Symmetric Encryption Principles," the text defines encryption as the process where "the original message, referred to as plaintext, is converted into a random-looking ciphertext. The encryption process consists of an algorithm and a key... The key is a value independent of the plaintext... A corresponding key and algorithm are used to decrypt the ciphertext and recover the original plaintext."

Katz, J., & Lindell, Y. (2021). Introduction to modern cryptography (3rd ed.). CRC Press. Chapter 2, "Perfectly Secret Encryption," formally defines an encryption scheme as involving a key-generation algorithm, an encryption algorithm that takes a key and a message (plaintext) to produce a ciphertext, and a decryption algorithm that takes the key and a ciphertext to output the original message. DOI: https://doi.org/10.1201/9781351137322

Azure AD Connect can be used to implement hybrid identity. (Yes) Azure AD Connect is the specific Microsoft tool designed to meet and accomplish hybrid identity goals. It facilitates the synchronization of identity data between an on-premises Active Directory Domain Services (AD DS) environment and Azure Active Directory (Azure AD), which is the core mechanism of a hybrid identity solution.

Hybrid identity requires the implementation of two Microsoft 365 tenants. (No) A standard hybrid identity implementation involves connecting a single on-premises AD DS forest to a single Azure AD tenant. While more complex multi-tenant configurations are possible, they are not a requirement for establishing a hybrid identity. The fundamental model is one on-premises directory linked to one cloud directory.

Hybrid identity refers to the synchronization of Active Directory Domain Services (AD DS) and Azure Active Directory (Azure AD). (Yes) This statement provides the fundamental definition of hybrid identity. It is the practice of creating a common user identity by connecting and synchronizing an on-premises directory (AD DS) with a cloud-based directory (Azure AD). This allows users to use a single set of credentials to access resources in both environments.

Microsoft Entra documentation, "What is hybrid identity with Azure Active Directory?," Microsoft Learn. Retrieved October 13, 2025.

Reference for Statements 1 & 3: Under the section "What is Azure AD Connect?", it states, "Azure AD Connect is the Microsoft tool designed to meet and accomplish your hybrid identity goals... The tool provides the following features: ... Password hash synchronization ... Pass-through authentication ... Federation integration ... Synchronization." This confirms Azure AD Connect as the implementation tool and synchronization as the core concept.

Microsoft Entra documentation, "Topologies for Azure AD Connect," Microsoft Learn. Retrieved October 13, 2025.

Reference for Statement 2: The section "Single forest, single Azure AD tenant" describes the most common and simplest topology: "The most common topology is a single on-premises forest, with one or multiple domains, and a single Azure AD tenant." This explicitly contradicts the notion that two tenants are required.

Authorization is the security process that determines a user's level of access or the permissions they have to specific system resources. This process occurs after a user's identity has been successfully verified through authentication. The question specifies a "signed-in user," indicating authentication has already been completed. Therefore, the subsequent step of checking whether that user can access a particular resource is authorization.

• Authentication answers the question, "Who are you?".
• Authorization answers the question, "What are you allowed to do?".
• Federation and Single sign-on (SSO) are mechanisms related to authentication across different systems, not the process of granting access to a specific resource within a system.

Microsoft Official Documentation: "Authorization is the process of giving a user permission to access a resource. For example, after a user authenticates to a web application, the application would authorize the user to access a specific set of pages or perform certain actions like creating, reading, editing, or deleting data."

Source: Microsoft identity platform documentation, "Authentication vs. authorization". Retrieved from https://learn.microsoft.com/en-us/entra/identity-platform/authentication-vs-authorization, Section: "Authorization".

NIST Glossary: "Authorization: The process of verifying that a requested action or service is approved for a specific entity."

Source: National Institute of Standards and Technology (NIST) Computer Security Resource Center, Glossary. Retrieved from https://csrc.nist.gov/glossary/term/authorization.

IEEE Xplore Digital Library: "Authentication is a mechanism by which a system verifies the identity of a user. Once a user is authenticated, the system uses an authorization mechanism to decide whether the user will be granted access to a resource."

Source: Al-Sinani, M., & Al-Washahi, M. (2020). A Review of Authentication and Authorization Techniques in Online Social Networks. 2020 3rd International Conference on Computer Applications & Information Security (ICCAIS). IEEE. https://doi.org/10.1109/ICCAIS48893.2020.9096839, Section III-A.