Azure AZ-305 Auth and Secrets Guide

AZ-305 identity questions become simpler when you separate three things: who is the principal, what is it trying to access, and how can you avoid long-lived secrets. If you blur authentication, authorization, and secret storage together, the distractors become much harder to eliminate.

Managed identity: Azure-managed workload identity that lets a service authenticate to other Azure services without storing credentials in code or configuration.

Start with the access pattern

Authentication vs authorization

The exam often tempts you to solve an authorization problem with an authentication product name, or vice versa. Keep the boundary clean.

On-premises access logic

When the requirement includes on-premises resources, the design question is usually about how Azure identities and existing enterprise identity systems meet. The right answer often preserves enterprise identity constraints instead of pretending everything is cloud-native already.

Secretless design is usually stronger

If a workload on Azure needs to reach another Azure service and managed identity is supported, the stronger architect answer is usually:

• remove stored secrets
• assign the right identity
• authorize it with the correct scope

That is cleaner to operate and harder to mishandle than client secrets scattered across apps and pipelines.

What strong answers usually do

• choose managed identity before stored secrets when supported
• use RBAC for authorization and Key Vault for secrets instead of mixing those responsibilities
• separate workload identity from human privileged access patterns
• preserve enterprise identity constraints when the scenario includes on-premises access

Decision order that usually wins

1. Decide whether the stem is about authentication, authorization, hybrid identity, or service-to-service access.
2. Separate Microsoft Entra sign-in from Azure RBAC resource authorization.
3. Use managed identities when the problem is service access without secret sprawl.
4. Read Conditional Access and MFA as sign-in policy controls, not resource-permission controls.
5. Fix the narrowest identity boundary that explains the requirement.

Quiz