Season 4: One Company, Two Clouds · Episode 3 of 8
Who Gave Them Access?
You play: AI Engineering Intern
Included with Core programme and Certification prep
The situation
During the campaign, someone granted the creator-support service account (`svc-creator-support`) broad access so it could 'just get things done'. Lydia's quarterly access review flagged it: the account can read the finance resource group, and at one point it was made an Owner of the whole subscription. It only ever needs the creator uploads and a place to write support notes.
What you'll learn
- AZ-900 identity, access and security: identities vs roles vs scope, authentication vs authorisation, multi-factor authentication, role-based access control (RBAC), least privilege, Zero Trust, defence in depth, and using positive and negative access tests to prove a change.
- Microsoft Entra ID versus Entra Domain Services, single sign-on, multifactor and passwordless authentication, external identities, Conditional Access, Defender for Cloud and defense in depth.
Who you work with
Lydia Roe
Security Engineer
Priya Naidoo
Cloud Architect
Scenes
- 1.The access review
- 2.Identity, role, scope
- 3.Narrow the role
- 4.The Owner grant
- 5.A custom role, not Owner
- 6.Identity check
What you leave with
The simulator removes broad support assignments and checks the required upload-read and notes-write work alongside denied management and finance requests. The policy task scopes custom actions to the creator group. Real Azure review must distinguish management/data planes, additional grants and built-in roles with broader actions than the training labels.