Identity and authorization boundary
The request sequence
Authentication establishes which principal is acting. Microsoft Entra ID issues or validates the identity token. Authorization then checks what that principal may do: an Azure RBAC role assignment grants an action at a scope such as a subscription, resource group, or resource. The service finally evaluates its data-plane permission when the request reads or changes data.
Authentication is therefore not authorization. A valid sign-in can still receive 403 Forbidden because it lacks the required role; a
role assignment cannot repair a missing, expired, or incorrectly targeted token.
Related identity systems
Microsoft Entra roles authorize directory operations such as managing users or app registrations. Azure RBAC roles authorize Azure resource operations. They may name similar actions but apply in different planes. A service principal is an application identity whose credential lifecycle is owned by the application team. A managed identity is an Azure-managed service principal attached to a resource. Workload identity federation lets an external workload exchange a trusted token without storing a long-lived client secret. A service account is a generic term for a non-human identity; it is not automatically a service principal or a managed identity.
Scope, tenant, and pipeline boundaries
A tenant contains directory identities. A subscription trusts a tenant and contains resources, billing, and quota boundaries. A role assignment binds principal + role + scope. The assignment inherits downward where the authorization system supports inheritance, so a role at a resource group can affect its resources but does not grant control over a sibling group.
An Azure DevOps or GitHub service connection is a delivery-system credential/configuration that authenticates a pipeline to a target. It is not an Azure service endpoint, which is a networking path/control, and it is not a private endpoint, which gives a supported service a private address in a VNet. Confusing these boundaries can produce a pipeline that authenticates successfully but cannot reach or authorize the target resource.
Worked failure diagnosis
If a pipeline receives a token but deployment is denied, inspect the service connection’s identity, its Azure RBAC role, the assignment scope, and any Policy denial. If a storage read is denied after RBAC succeeds, inspect the storage data-plane authorization and network firewall. If a user can manage an app registration but cannot resize a VM, the user may have an Entra directory role without the needed Azure RBAC role.
Route and sources
Learn the identity vocabulary in AZ-900 identity and governance, apply scope in AZ-104 identity, use workload identities in the retired AZ-204 security foundation, and connect pipeline authentication in AZ-400 secure delivery.
- Microsoft Entra overview, checked 2026-08-31.
- Azure RBAC overview, checked 2026-08-31.
- Managed identities overview, checked 2026-08-31.
Re-audit when Entra token, Azure RBAC, managed identity, federation, or pipeline service-connection behavior changes.
Related
entraid · azure-ad-roles · rbac · role-assignment · scope · tenant · subscription · service-principal · managed-identity · service-connection · service-endpoint · private-endpoint