Break Free from Legacy Identity with Azure Files

Identity is the new perimeter — and this week, I had the opportunity to put that principle into practice. I successfully architected and implemented a Zero Sign-In SSO policy across two major cloud platforms, using Microsoft Azure Entra ID as the central identity provider: 🔐 Azure Entra ID → AWS IAM Identity Center 🔐 Azure Entra ID → Google Workspace The objective was clear: eliminate credential sprawl, enforce consistent access governance, and deliver a seamless authentication experience across the organization — without compromising on security. Here's what the implementation involved: → Establishing SAML 2.0 federation between Entra ID and each platform → Configuring SCIM-based automated user & group provisioning → Mapping Azure AD security groups to AWS permission sets and GCP roles → Integrating Conditional Access policies to enforce MFA and device compliance across all platforms → Authoring detailed SOPs to ensure long-term maintainability and team independence The result: users authenticate once through Microsoft Entra and gain seamless, policy-compliant access to both AWS and Google Workspace — with zero additional sign-ins and fully automated lifecycle management. Building this end-to-end reinforced something I believe deeply: robust identity architecture isn't just a security control — it's a business enabler. Happy to discuss the technical nuances or lessons learned with anyone navigating similar implementations. #CloudSecurity #IdentityAndAccessManagement #ZeroTrust #SSO #AzureEntraID #AWS #GoogleWorkspace #IAM #EnterpriseArchitecture #CloudEngineering

Entra ID (Microsoft Identity/permission system) and Azure Subscription and services This is a very broad topic: so, I will not go deep in this, but just summary level and conclusion level posting only. Entra Tenant: some terms like Tenant, Domain(esp. windows people are familiar with), Entity, AAD(former name), Directory confusingly used. Entra Tenant is simply an organization. A separate 'instance' within Entra system that represents your organization. Azure subscription: It's like a house that keeps all Azure services inside. Storage, Database, Application, network, etc. Each service: As an example, you make one Azure storage account - how/who accesses this? Some permission management system is needed. Other than manual setting (which you can very much do), Entra ID system is natural integrated IAM system. Entra and Azure subscription have natural trust relationship (a setup has to happen by Global admin and/or Subscription owner (yes, these two are/could be really different), but very easy) Now, this is the core part of today posting. What is a relationship between EntraID and Azure subscription(s)? Can one subscription be tied to multiple EntraIDs so that different organizations (like merge case) gain access to a subscription? The answer is No. Entra - Azure subcription is one to one or one to many(Azure subscriptions part is many), NOT many to one (look at this very simple diagram from Microsoft: https://lnkd.in/gWahRxKP) * Then, some will wonder what happens when two organizations merge and become one (but still keep old tenants without migrating to other - because that's a lot more work) or 'Enterprise' architecture (many organizations under). For many years this has been a headache, but now, Entra has an answer: Multi-tenant organization architecture (or cross-tenant structure by Entra system), but I will not go deeper in this as this post is not about that. As below shows, one organization can have 'naturally' many subscriptions (let's say, 'bigger' organization typical setting environment, Develop/Test/Production subscriptions), and entire organization permission system is applied to different subscriptions (which is called RBAC - Role Based Access Control)

Organizations eyeing cloud-native identity to reduce their Active Directory footprint continue to get new enablement tools! Recently, it was Source of Authority conversion; today, it's Azure Files Entra-Only Identities. https://lnkd.in/ezx4UCey Before Azure Files Entra-Only Identities, organizations migrating traditional file server shares to Azure Files still needed "Active Directory plumbing" to support access. Not anymore. With this announcement, orgs can leverage cloud-native identity without sync and *still* support workloads that require legacy SMB/CIFS interfaces for file access. Native support for system managed identity to reduce secret/credential sprawl, Azure portal-based NTFS permissions management, and no AD domain controllers.

𝗗𝗲𝘀𝗶𝗴𝗻𝗶𝗻𝗴 𝗮𝗻𝗱 𝗜𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁𝗶𝗻𝗴 𝗮 𝗥𝗲𝗮𝗹-𝗪𝗼𝗿𝗹𝗱 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗔𝘇𝘂𝗿𝗲 𝗪𝗲𝗯 𝗔𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗔𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲 — 𝗣𝗮𝗿𝘁 𝟯 In the previous post, we applied the Azure Cloud Adoption Framework (CAF) to our web application deployment. Now let’s start building the foundation for our application using: 𝗔𝘇𝘂𝗿𝗲 𝗟𝗮𝗻𝗱𝗶𝗻𝗴 𝗭𝗼𝗻𝗲𝘀. Our goal is to deploy a production-style web application in Azure with: 𝘞𝘦𝘣, 𝘈𝘱𝘱𝘭𝘪𝘤𝘢𝘵𝘪𝘰𝘯 𝘢𝘯𝘥 𝘋𝘢𝘵𝘢𝘣𝘢𝘴𝘦 𝘵𝘪𝘦𝘳𝘴 𝘏𝘪𝘨𝘩 𝘢𝘷𝘢𝘪𝘭𝘢𝘣𝘪𝘭𝘪𝘵𝘺 𝘔𝘰𝘯𝘪𝘵𝘰𝘳𝘪𝘯𝘨 Before deploying the application, we first need a properly designed cloud environment. This is what the 𝗔𝘇𝘂𝗿𝗲 𝗟𝗮𝗻𝗱𝗶𝗻𝗴 𝗭𝗼𝗻𝗲 provides. Landing Zone becomes the enterprise foundation where the application runs securely and consistently. 𝗦𝘁𝗲𝗽 1 — 𝗢𝗿𝗴𝗮𝗻𝗶𝘇𝗲 𝘁𝗵𝗲 𝗘𝗻𝘃𝗶𝗿𝗼𝗻𝗺𝗲𝗻𝘁 First, we organize the Azure hierarchy properly. Management Groups 𝘗𝘳𝘰𝘥𝘶𝘤𝘵𝘪𝘰𝘯 𝘕𝘰𝘯-𝘗𝘳𝘰𝘥𝘶𝘤𝘵𝘪𝘰𝘯 𝘗𝘭𝘢𝘵𝘧𝘰𝘳𝘮 𝘚𝘦𝘳𝘷𝘪𝘤𝘦𝘴 - ( Shared Networking, Monitoring, Identity Integrations ) Why? Because production and non-production environments should never be mixed. This helps with: Governance, Security, Cost control, Operational separation 𝗦𝘁𝗲𝗽 2 — 𝗗𝗲𝗳𝗶𝗻𝗲 𝗦𝘂𝗯𝘀𝗰𝗿𝗶𝗽𝘁𝗶𝗼𝗻𝘀 Now we separate workloads into subscriptions. For our web application: 𝘗𝘳𝘰𝘥-𝘊𝘰𝘯𝘯𝘦𝘤𝘵𝘪𝘷𝘪𝘵𝘺-𝘚𝘶𝘣 𝘗𝘳𝘰𝘥-𝘈𝘱𝘱𝘭𝘪𝘤𝘢𝘵𝘪𝘰𝘯-𝘚𝘶𝘣 The Connectivity subscription contains: Azure Firewall, Bastion, Shared networking The Application subscription contains: Web, Application servers and Database resources 𝙏𝙝𝙞𝙨 𝙘𝙧𝙚𝙖𝙩𝙚𝙨 𝙖𝙙𝙢𝙞𝙣𝙞𝙨𝙩𝙧𝙖𝙩𝙞𝙫𝙚 𝙖𝙣𝙙 𝙗𝙞𝙡𝙡𝙞𝙣𝙜 𝙗𝙤𝙪𝙣𝙙𝙖𝙧𝙞𝙚𝙨. 𝗦𝘁𝗲𝗽 3 — 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆 & 𝗔𝗰𝗰𝗲𝘀𝘀 Now we configure identities using Microsoft Entra ID. Example groups: Azure-Network-Team Azure-App-Team Azure-Security-Team Azure-DB-Team Then assign RBAC permissions based on responsibility. Network Team → Networking resources App Team → Application resources DB Team → Database resources 𝙏𝙝𝙞𝙨 𝙛𝙤𝙡𝙡𝙤𝙬𝙨 𝙡𝙚𝙖𝙨𝙩 𝙥𝙧𝙞𝙫𝙞𝙡𝙚𝙜𝙚 𝙖𝙘𝙘𝙚𝙨𝙨. We’ll move into Networking and Governance in upcoming posts. With a Landing Zone, organizations build secure, scalable, and manageable platforms. #𝗔𝘇𝘂𝗿𝗲 #𝗔𝘇𝘂𝗿𝗲𝗟𝗮𝗻𝗱𝗶𝗻𝗴𝗭𝗼𝗻𝗲 #𝗖𝗹𝗼𝘂𝗱𝗔𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲 #𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁𝗔𝘇𝘂𝗿𝗲 Microsoft Microsoft Azure

As an #AWSLearner, the biggest hurdle I found wasn't just launching services; it was realizing I had absolutely no structure. Every time I looked up security or setup, these four names kept popping up like a complicated puzzle: 1 IAM 2 IAM Identity Center 3 AWS Organizations 4 AWS Control Tower Honestly? They all sounded like the same thing to me at first. But after a few deep dives (and a lot of Hot Chocolates), I finally saw how they actually work together to stop "Cloud Chaos" before it starts. I put together a quick "When to Use" breakdown based on my own lightbulb moments: 1) IAM: Think of this as the "Inside Man." It’s for things inside a single account like giving a Lambda function or an EC2 instance the right permissions. Pro-tip from my mistakes: Try to avoid creating IAM Users for actual people! 2) Organizations: This is the "Blueprint." If you’re managing more than one account, you need this to group them into OUs and set hard "no-go" zones using SCPs. 3) IAM Identity Center (SSO): This is the "Front Door." (Mostly used for corporate-level environments). This is where the humans go. One login gives you access to all your assigned accounts without managing a dozen different passwords. 4) Control Tower: The "Orchestrator." It’s basically the "easy button" that sets up your entire compliant environment (the Landing Zone) for you using the other three services. Getting this foundation right felt like a massive win. It’s the difference between building a house on sand versus a solid slab. To my fellow cloud explorers: Which of these services made your head spin the most when you first started? #AWS #CloudComputing #LearningInPublic #AWSStudy #CloudGovernance

Most people think “login not working” is a simple issue. In reality, it’s often a chain reaction across identity systems. Recently worked around a hybrid identity setup using Microsoft Entra ID + on-prem Active Directory, and it changed how I look at authentication completely. Because what users call “login” is actually: - Directory synchronization decisions - Token issuance and validation - Policy enforcement across cloud + on-prem - Trust relationships between systems - And timing differences you only notice when something breaks The interesting part is this: when identity is designed correctly, nobody notices it. When it’s not everything breaks loudly. That gap between “invisible when correct” and “painfully visible when wrong” is what makes identity engineering one of the most critical layers in modern IT infrastructure. Still learning how deep this layer really goes. 🔐☁️ #EntraID #AzureAD #ActiveDirectory #HybridIdentity #IdentityManagement #ITInfrastructure #CloudComputing #SysAdmin

Recently I spent time federating my AWS environment with Microsoft Entra ID using AWS IAM Identity Center, and honestly, I would not go back. Originally, I was just using the built-in IAM Identity Center directory for my personal AWS environment across multiple accounts. While it worked, I kept running into a frustrating user experience issue: I would authenticate into the main Identity Center portal successfully, but eventually still get prompted again when accessing individual sub-accounts after role sessions expired. Technically, this makes sense because AWS still relies on temporary STS role credentials and per-account role assumptions underneath the hood. But from a user perspective, it felt like it defeated the purpose of “single sign-on.” So I decided to properly federate AWS Identity Center through Microsoft Entra ID using: - SAML federation - SCIM provisioning - centralized MFA - AWS Organizations account assignments After getting everything configured properly, the difference in user experience was night and day. Now I can: - authenticate directly with my Microsoft account - use centralized MFA - seamlessly access multiple AWS accounts - avoid the repeated login friction I was experiencing before What I appreciated most about the process was seeing how much smoother the overall authentication flow becomes once identity is centralized properly through a federated provider. It also gave me a deeper appreciation for how enterprise identity federation works behind the scenes. For anyone working with multiple AWS accounts — even in personal lab environments — I highly recommend exploring federated identity providers properly instead of relying only on local Identity Center users. And for business environments, it becomes very easy to see why centralized identity federation is considered the standard approach.

If you have a mission critical application requiring continuous operation, don't be lulled to sleep because it's hosted in a major cloud provider. Basic business continuity and disaster recovery concepts still apply. Last night, AWS experienced an hours long outage in one of the US-EAST-1 region availability zones due to an overheating issue that affected some customer's EC2 and EBS services to the point of a total outage (e.g., Coinbase). AWS recommended for immediate recovery, "customers restore from EBS snapshots and/or replace affected resources by launching new replacement resources in one of the unaffected zones," which means those redundancy measures need to be implemented. https://lnkd.in/eNPMYwzp BTW, Azure experienced an hours long outage last week affecting all availability zones in East US. Microsoft recommends "zonal, zone-redundant, and/or always-available configuration" and a "multi-region geodiversity strategy" for mission critical systems. https://lnkd.in/eaEz2-sn

Last night I built something I've been wanting to document properly for a while. I configured a full end-to-end SAML 2.0 SSO integration between Microsoft Entra ID and Amazon Web Services — and tested it live. The problem it solves is simple: most organizations that run Microsoft 365 AND use AWS end up with engineers managing two separate sets of credentials. That's a security risk. When someone leaves, IT has to remember to remove them from both platforms. If they forget — that's an open door. The solution: federate AWS access through Entra ID. Engineers log in once with their Microsoft credentials. AWS trusts Entra ID to vouch for them. No separate passwords. No orphaned accounts. Full audit trail in one place. Here's what I built: 🔷 Entra ID side — Enterprise Application configured with SAML 2.0, Entity ID set to urn:amazon:webservices, ACS Reply URL, user attribute mapping including Role ARN, and token signing certificate management 🟠 AWS side — Registered Entra ID as a trusted SAML Identity Provider in AWS IAM, created an IAM Role with a SAML 2.0 federation trust policy ✅ Result — Authenticated through Entra ID and landed directly in the AWS Console assuming the EntraID-ReadOnly role. Zero separate AWS credentials used. This is Zero Trust in practice. Identity is the perimeter. Full walkthrough with 19 clean screenshots on GitHub 👇 https://lnkd.in/gfWSHBBM #ZeroTrust #EntraID #AzureAD #AWS #SAML #SSO #CloudSecurity #Microsoft365 #IdentityManagement #DevOps #CloudComputing