AZ-500 Domain 1: Secure identity and access (15-20%) - Complete Study Guide 2026

Domain 1 Overview: What "Secure Identity and Access" Actually Covers

Domain 1 of the AZ-500 exam, Secure identity and access, accounts for 15-20% of your total score based on the current skills outline dated January 22, 2026. It's the smallest of the four domains - compare it to the 30-35% weight given to Domain 4: Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel - but identity is the backbone that the other three domains lean on. You can't secure networking, compute, or monitoring pipelines without first understanding who has access to what, and how that access is granted, reviewed, and revoked.

In practice, this domain tests your hands-on familiarity with Microsoft Entra ID (formerly Azure AD), privileged access controls, authentication mechanisms, and the identity layer that connects on-premises Active Directory to Azure. If you've spent real time administering an Azure tenant - creating users, assigning roles, configuring Conditional Access policies - this domain will feel like an extension of your daily work rather than abstract theory.

Microsoft Entra ID Fundamentals You Must Know Cold

Every Domain 1 study plan should start with Microsoft Entra ID because nearly every other topic in this section builds on it. You need working knowledge of:

• User and group lifecycle management, including dynamic groups and administrative units
• Built-in Entra ID roles versus custom roles, and when each is appropriate
• External identities - B2B collaboration and guest user access governance
• Self-service password reset (SSPR) configuration and password protection policies
• Identity Protection risk policies for sign-in risk and user risk

These aren't checkbox topics - the exam expects you to reason about scenarios. For example, you might be shown a case study describing a company with contractors who need temporary access to specific resource groups, and asked to identify the correct combination of administrative units, custom roles, and access reviews to satisfy least-privilege requirements.

Privileged Identity Management, RBAC, and Access Reviews

Privileged Identity Management (PIM) is one of the highest-yield topics in Domain 1. Expect scenario questions that require you to configure just-in-time (JIT) role activation, set approval workflows, and define maximum activation duration for eligible role assignments. You should understand:

• The difference between eligible and active role assignments in PIM
• How to require multi-factor authentication or justification before role activation
• Configuring PIM for both Entra ID roles and Azure resource roles
• Setting up recurring access reviews for privileged roles and guest accounts
• Alert configuration for suspicious PIM activity

Layered on top of PIM is standard Azure RBAC design: assigning the least-privileged built-in role, writing custom role definitions with precise actions and notActions, and understanding how role assignments are inherited down the resource hierarchy. Expect at least one question that asks you to troubleshoot why a user has more (or less) access than intended by tracing inherited assignments across scopes.

Conditional Access and Authentication Methods

Conditional Access policies are the enforcement layer of Entra ID security, and this exam will test your ability to design policies that balance security with usability. Core skills include:

• Building Conditional Access policies based on user, location, device state, and application
• Requiring compliant or hybrid-joined devices as access conditions
• Configuring session controls, including sign-in frequency and persistent browser sessions
• Deploying and enforcing multi-factor authentication (MFA) through Conditional Access rather than legacy per-user MFA
• Understanding authentication methods policy, including passwordless options like FIDO2 security keys and Microsoft Authenticator
• Blocking legacy authentication protocols that bypass Conditional Access

A common exam pattern presents a partially built policy - perhaps missing a grant control or targeting the wrong assignment - and asks what change achieves a stated security outcome. Read these carefully; the difference between "require MFA" and "require MFA and compliant device" changes the correct answer.

App Registrations, Managed Identities, and Service Principals

This subtopic trips up candidates who have strong infrastructure experience but limited application identity exposure. You need to distinguish between:

• App registrations and the resulting service principal objects used for delegated or application permissions
• System-assigned managed identities, tied to the lifecycle of a single resource
• User-assigned managed identities, which can be shared across multiple resources
• Granting API permissions and understanding admin consent versus user consent workflows
• Securing app secrets and certificates, and why managed identities are preferred over stored credentials

Expect scenarios where an application needs to access a key vault or storage account without embedding credentials in code - the correct answer is almost always a managed identity paired with an appropriately scoped RBAC role, not a client secret.

Hybrid Identity: Connect, Sync, and Federation

Many organizations running the AZ-500 curriculum still operate hybrid environments, and Microsoft continues to test this reality. You should be comfortable with:

• Microsoft Entra Connect Sync configuration, including filtering and attribute mapping
• Password hash synchronization versus pass-through authentication versus federation
• Seamless single sign-on (SSO) configuration for hybrid users
• Entra Connect Health monitoring and troubleshooting sync errors
• Password writeback and self-service password reset in a hybrid context

Hybrid identity questions tend to be scenario-driven: a company has an on-premises AD forest, wants minimal infrastructure footprint, and needs SSO - you need to recommend password hash sync with seamless SSO over a federation server, and explain the trade-off in the answer choice.

How Domain 1 Questions Are Actually Asked

Understanding format matters as much as content. The AZ-500 exam does not publish a fixed scored/unscored split, but candidates should expect somewhere between 40 and 60 total items delivered in 100 minutes, whether taken online proctored or at a Pearson VUE test center. Domain 1 questions typically show up in three formats:

• Standalone multiple-choice - direct questions about a single Entra ID feature or PIM setting
• Case studies - a multi-paragraph scenario describing an organization's identity requirements, followed by several questions that reference the same background information
• Interactive/lab-style tasks - simulated configuration screens where you select settings in something resembling the actual Azure portal

One detail that surprises first-time candidates: the exam interface gives you split-pane access to Microsoft Learn documentation during the test. This won't save you if you don't already understand the concepts - there isn't time to research from scratch under a 100-minute clock - but it's useful for confirming a specific PIM setting name or Conditional Access condition you're second-guessing. If you're unsure how difficult this exam experience feels overall, the complete difficulty guide breaks down what to expect beyond just the domain content.

Scheduling Domain 1 Inside Your Broader Study Plan

Because Domain 1 underpins concepts tested elsewhere, most successful candidates study it early rather than saving it for last. A practical sequencing approach:

This sequencing matters because Domain 1 concepts reappear when you move into Domain 2: Secure networking (private endpoints and RBAC on network resources) and Domain 3: Secure compute, storage, and databases (managed identities accessing storage and databases). Getting identity solid first makes the later domains click faster instead of forcing you to relearn RBAC scoping mid-way through networking material. For a broader week-by-week framework covering all four domains together, see the full AZ-500 Study Guide 2026.

Once you've worked through the material, run timed practice questions specifically tagged to identity topics on our AZ-500 practice test platform before moving on - isolating Domain 1 in practice mode helps surface gaps that generic full-length exams can blur together.

Frequently Asked Questions