Identity & Directory Services

Who is who, and who may do what: the directories, protocols and cloud services that sign people and machines in, decide what they can reach, and keep that safe from the first working day to the last.

18 pages 122 glossary terms SC-900 SC-300

How to use this topic

The first three pages explain the ideas: identities and accounts, directories and LDAP, and how authorization decisions are made. The next five pages are about Active Directory, which still runs most organizations: its structure, its dependence on DNS, users and groups, Group Policy and Kerberos. Then come the cloud and modern sign-in: Microsoft Entra ID, single sign-on and federation, MFA and passwordless, and conditional access. The last six pages cover running identity safely: privileged access, the identity lifecycle, identities for applications and machines, Linux, attacks on identity and troubleshooting.

Several basics already appear in other topics — passwords and MFA in Security, identity and access management in Cloud, and local users and permissions in Operating Systems. These pages link there and go deeper. Attacks are explained so that you can recognize and prevent them; nothing here is a guide to attacking systems you do not own.

Pages are tagged with the certifications they help with: SC-900 (Microsoft Security, Compliance, and Identity Fundamentals) and SC-300 (Microsoft Identity and Access Administrator).

Learning path

  1. 01What Is Identity Management?Why identity sits at the center of IT and security: identities and accounts, authentication, authorization and accounting, identity and access management, identity governance, and the systems that hold identities.BeginnerSC-900
  2. 02Directory Services and LDAPHow directories store people, groups and devices: the directory tree, distinguished names, object classes and attributes, the schema, and how applications query a directory with LDAP.Beginner
  3. 03Authorization ModelsHow systems decide what an authenticated identity may do: access control lists, role-based and attribute-based access control, entitlements, least privilege and separation of duties.BeginnerSC-900
  4. 04Active Directory FundamentalsThe structure of Microsoft's on-premises directory: domains, trees and forests, domain controllers, organizational units, sites and replication, the global catalog and the FSMO roles.Intermediate
  5. 05DNS and Active DirectoryWhy Active Directory cannot work without DNS: SRV records that locate domain controllers, AD-integrated zones, the domain name design, and the DNS problems behind many login failures.Intermediate
  6. 06Users, Groups and ComputersManaging the objects in Active Directory: user and computer accounts, group types and scopes, nesting with AGDLP, service accounts and managed service accounts, and PowerShell for bulk work.Intermediate
  7. 07Group PolicyConfiguring thousands of Windows machines from one place: Group Policy Objects, linking and the LSDOU processing order, inheritance, enforcement and filtering, refresh, and troubleshooting with gpresult.Intermediate
  8. 08Kerberos and NTLMHow Windows domains prove who you are: the Kerberos ticket exchange with the key distribution center, service principal names, time synchronization, delegation, and the older NTLM protocol that is being phased out.Advanced
  9. 09Microsoft Entra IDMicrosoft's cloud identity service: tenants, users and groups, app registrations and enterprise applications, roles, and hybrid identity that connects Active Directory with the cloud.IntermediateSC-900SC-300
  10. 10Single Sign-On and FederationSigning in once for many applications: identity providers and service providers, SAML assertions, OAuth 2.0 authorization flows, OpenID Connect and ID tokens, and what a JSON Web Token contains.IntermediateSC-900SC-300
  11. 11MFA and PasswordlessMaking sign-in hard to steal: authentication factors and methods, why SMS and push codes are weaker, phishing-resistant MFA with FIDO2 and passkeys, Windows Hello for Business, and password guidance that works.IntermediateSC-900SC-300
  12. 12Conditional Access and Zero TrustDeciding access per request instead of per network: zero trust principles, signals such as user, device, location and risk, conditional access policies, device compliance, and rolling policies out safely.IntermediateSC-900SC-300
  13. 13Privileged Access ManagementProtecting the accounts that can do the most damage: the tiering model, separate admin accounts, just-in-time access, privileged access workstations, local administrator passwords and break-glass accounts.AdvancedSC-900SC-300
  14. 14The Identity LifecycleFrom first day to last: joiners, movers and leavers, HR-driven provisioning, SCIM, access requests and approvals, access reviews and recertification, and orphaned accounts.BeginnerSC-900SC-300
  15. 15Identity for Applications and MachinesIdentities that are not people: service accounts, service principals and managed identities, workload identity federation, certificates versus secrets and API keys, and avoiding secrets altogether.IntermediateSC-900SC-300
  16. 16Linux and IdentityBringing Linux into a central identity system: SSSD and realmd to join Active Directory, Kerberos and LDAP on Linux, sudo rules from the directory, FreeIPA, and SSH with central accounts.Intermediate
  17. 17Attacks on IdentityHow attackers go after identities and how to stop them: password spraying, credential stuffing, MFA fatigue and token theft, pass-the-hash, Kerberoasting and golden tickets, explained to recognize and defend.Advanced
  18. 18Monitoring and Troubleshooting IdentityKeeping identity healthy and finding out what went wrong: sign-in and audit logs, important Windows security events, account lockouts, clock skew, replication and trust problems, and a troubleshooting routine.IntermediateSC-300

Identity & Directory Services glossary

Short definitions of the terms used in this topic. The full glossary covers every topic.