What this guide covers
The breach rarely starts with a misconfigured Conditional Access policy. It starts with a three-year-old client secret sitting in a public repo, attached to an app nobody remembers registering. Workload identities, the identities your software uses to authenticate, cannot perform MFA, usually have no lifecycle owner, and have to keep a credential somewhere. That is the whole problem, and it is why they have become one of the surfaces attackers reach for when they want quiet, durable access to a tenant.
Microsoft Learn documents every piece of the answer, but it scatters them across dozens of pages and never connects them. This book is the account I wanted the first time I had to explain, in a real tenant, why deleting an app registration also kills its service principal, which controls require Workload ID Premium (a standalone add-on license, separate from any Microsoft 365 or Microsoft Entra ID P2 plan you already own) and which the Free edition already covers, and why a one-character typo in a federated credential subject fails with no error at all. It walks application objects, service principals, and managed identities as one system, names the silent failure modes before you hit them, and draws the license line clearly so you know what you are paying for.
Every limit, license boundary, and portal path is grounded against current Microsoft Learn and validated in a live Microsoft 365 E5 lab. You do not need production Azure infrastructure to follow along; a trial tenant and a single test resource are enough.
Chapter map
- The Workload Identity Model: Concepts, Stack, and Exam Scope
- Licensing and Prerequisites: Free vs. Workload ID Premium
- Choosing a Workload Identity: Managed Identities, Service Principals, and Service Accounts
- Managed Identities in Practice: Enabling, Assigning, and Using Them
- Application Objects and Service Principals: The Registration Model
- App Authentication: Secrets, Certificates, and Federated Identity Credentials
- API Permissions: Delegated, Application, Admin Consent, and the Consent Framework
- App Roles: Defining, Assigning, and Consuming Authorization in Tokens
- Enterprise Applications: SSO Modes, User Assignment, and App Visibility
- User and Group Provisioning: SCIM, Automatic Provisioning, and Lifecycle Management
- On-Premises App Publishing with Application Proxy
- Conditional Access App Control and Defender for Cloud Apps Session Policies
- Securing Workload Identities: Conditional Access, ID Protection, Credential Governance, and the Production Checklist
Appendices: PowerShell and Graph Quick Reference; Build a Lab Tenant; Production Readiness Checklist.
Who it is for
This book is for the administrators and engineers who own app registrations, enterprise applications, and managed identities in a Microsoft Entra tenant, for developers whose applications have to authenticate against it, and for anyone preparing for SC-300 (Microsoft Identity and Access Administrator) who wants the workload-identity material at a depth the exam objectives only hint at.
