Conditional Access, RBAC and Zero Trust

Once you know who someone is, you have to decide what they can do, and under what conditions.

Conditional Access

Conditional Access is a feature of Microsoft Entra ID that grants or blocks access based on signals:

• who the user is and which group they belong to,
• where they are signing in from (location, IP address),
• which device they use and whether it is compliant,
• which application they want,
• the sign-in risk Microsoft detects.

It then makes a decision: allow, block, or allow only if extra steps are met, such as requiring MFA.

Examples:

• require MFA when an administrator signs in,
• require MFA only when users sign in from outside the office,
• block sign-ins from countries where you do not operate,
• allow access to sensitive apps only from company-managed devices.

Azure role-based access control (RBAC)

Azure RBAC controls access to Azure resources. Instead of giving people permissions one by one, you assign roles:

• A role is a collection of permissions. Built-in examples: Owner (full access, including giving others access), Contributor (create and manage resources, but cannot grant access), Reader (view only).
• A scope is where the role applies: a management group, subscription, resource group or single resource.
• A role assignment connects a user, group or app to a role at a scope.

Permissions are inherited by lower scopes: Reader on a subscription means Reader on every resource group and resource in it. RBAC follows the principle of least privilege: give people only the access they need.

More rules worth knowing:

• RBAC is an allow model and it is additive: if one assignment gives you Reader and another gives you Contributor at the same scope, you have both sets of permissions.
• It is enforced by Azure Resource Manager, so it applies however the request arrives: portal, CLI, PowerShell or a template.
• User Access Administrator is the built-in role that can manage access (role assignments) without managing the resources themselves.
• Assign roles to groups rather than individuals where you can; joining or leaving the group then grants or removes access.

Zero Trust

Zero Trust is a security model that assumes the worst: never trust, always verify. Instead of trusting everything inside the corporate network, every request is checked as though it came from an open network.

Its three principles:

1. Verify explicitly: authenticate and authorise using all available signals (identity, location, device, service).
2. Use least-privilege access: just-in-time and just-enough access.
3. Assume breach: minimise the "blast radius", segment access, encrypt everything, and use analytics to detect threats.