In Azure, what handles authentication versus authorization?
What they are really testing: Whether you cleanly separate Entra ID (proves identity) from Azure RBAC (grants access to resources), and ideally know Entra roles and Azure RBAC roles are different systems. A frequent point of confusion.
A real interview question
In Azure, what handles authentication versus authorization?
What most people say
drag me
“Entra ID handles both logging in and permissions for everything in Azure.”
It collapses two systems. Entra authenticates and manages directory roles, but access to Azure resources is governed by Azure RBAC, a separate authorization system. Missing that distinction causes real permissions confusion.
The follow-ups they ask next
What is the difference between an Entra directory role and an Azure RBAC role?
Directory roles (Global Admin, User Admin) manage the identity/directory plane (users, apps). Azure RBAC roles (Owner, Contributor, Reader) manage access to Azure resources. Separate systems, separate scopes.
Does being Global Administrator give you control over all Azure resources?
Not automatically, it is a directory role. Resource access is Azure RBAC; a Global Admin can elevate to gain it, but by default the two planes are distinct.
What the interviewer is listening for
- Entra = authN, Azure RBAC = authZ
- Knows directory roles vs RBAC roles are separate
- Describes token-then-RBAC flow
What sinks the answer
- Thinks Entra does both
- Conflates Global Admin with resource access
- No notion of RBAC scopes
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“[Entra ID authenticates: proves who you are, issues a token]. [Azure RBAC authorizes resource access: what you can do on which resources, scoped]. Two role systems: [Entra directory roles (Global Admin) for the directory vs Azure RBAC roles (Contributor) for resources, separate]. Flow: [authenticate to Entra, then Azure checks RBAC at the resource scope].”
Keep going with azure
Foundation
What is Microsoft Entra ID (formerly Azure AD), and how does authentication work in Azure?
Foundation
Explain the Azure resource hierarchy: tenant, management group, subscription, resource group.
Junior
How does Azure RBAC work? Explain roles, scopes, and assignments.
Junior
What happens when a user signs in to an Azure/Entra-protected application?
Junior
What is the difference between a service principal and a managed identity, and why prefer managed identities?
Junior
What is Azure Key Vault, and how should an application access a secret from it securely?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free