CodeCV · Support Training · Module 1

Active Directory → Microsoft Entra ID

Study the bridge, then answer each question in your own words. Try first — only then open the model answer. When you're done, submit for your coach's review.
IAM PathWeek 1Interview drill

1The bridge — what you already know

You are not learning identity from zero. You are re-labelling five years of Active Directory work into cloud language.
On-prem Active DirectoryMicrosoft Entra ID (cloud)
Domain / ForestTenant
Domain ControllerMicrosoft-managed cloud service
OUsAdministrative Units + groups
Group Policy (GPO)Conditional Access + Intune
Kerberos / LDAPOAuth 2.0 / OIDC / SAML
Manual account creationLifecycle management + SCIM

2Your answers

Write your answer first. The model answer stays hidden until you open it — no peeking.

A · Identity fundamentals

1. What is the difference between authentication and authorization?

See model answer
Authentication proves who you are (login + MFA). Authorization decides what you're allowed to do once authenticated. Passport at the gate vs boarding pass for one seat.
Your angle: at Desktop S.A. you verified identity (MFA) and set AD permissions under least privilege.

2. What is Single Sign-On (SSO), and why do organisations want it?

See model answer
Authenticate once with a trusted IdP, then reach many apps via tokens (SAML/OIDC). Better UX and security: fewer passwords, smaller attack surface, central revocation.

3. What is Multi-Factor Authentication (MFA) and what problem does it solve?

See model answer
Two+ factors from different categories (know / have / are). A leaked password alone won't get an attacker in. In Entra it's enforced via Conditional Access.

4. Explain the Principle of Least Privilege and how you'd implement it.

See model answer
Minimum access needed. Grant by role (RBAC), run access reviews to remove drift, use just-in-time elevation (Entra PIM) instead of standing admin rights.
Your angle: you applied this managing AD group memberships and account lifecycle.

5. What is RBAC, and how does it differ from ABAC?

See model answer
RBAC grants permissions by role; ABAC grants by attributes/context (department, device, location, risk) — more dynamic. Conditional Access is condition-based on top of RBAC.
B · Active Directory

6. What is Active Directory, and what is a Domain Controller?

See model answer
AD DS is Microsoft's on-prem directory service for authn/authz in a Windows domain (users, groups, computers). A Domain Controller runs AD DS, authenticates via Kerberos, holds a directory replica.
Your angle: your strongest ground — speak from five years hands-on, don't recite.

7. What is the difference between an OU and a security group?

See model answer
OU = admin container for organising objects, applying GPO, delegating admin. Security group = collection of users to assign permissions. OUs for management/policy, groups for access.

8. What are Group Policy Objects (GPOs) used for?

See model answer
Centrally enforce config/security across the domain (password policy, baselines, drive mappings). Cloud equivalents: Conditional Access + Intune.

9. What is the role of LDAP and Kerberos in Active Directory?

See model answer
LDAP queries/reads the directory. Kerberos is AD's default auth protocol (time-limited tickets). Contrast: Entra uses OAuth/OIDC/SAML built for the internet.
C · Microsoft Entra ID

10. What is Microsoft Entra ID, and how is it different from on-prem AD?

See model answer
Cloud IAM / identity provider for M365, Azure and SaaS. Cloud-hosted, internet-facing, token protocols (OAuth/OIDC/SAML), no OUs/GPOs — groups + Conditional Access + Intune. Not a lift-and-shift of AD.
Your angle: "Coming from AD, the shift was Kerberos+GPO → tokens+Conditional Access." Never say "AD in the cloud."

11. What is a tenant in Entra ID?

See model answer
A dedicated, isolated instance of Entra ID for one organisation — its own directory of users, groups, apps and policies.

12. What is Conditional Access?

See model answer
Entra's policy engine: evaluates signals (user, device, location, risk) and applies a control — allow, block, require MFA, require compliant device. Backbone of Zero Trust.

13. What is Entra Connect (hybrid identity), and what are PHS, PTA and Federation?

See model answer
Entra Connect syncs on-prem AD to Entra (hybrid). PHS = password hash synced to cloud (simplest, most resilient); PTA = validated on-prem by an agent; Federation = external IdP (ADFS). PHS is the default unless regulation requires otherwise.
Your angle: you've lived the on-prem side, so hybrid is intuitive for you.
D · Lifecycle & scenarios

14. Explain the identity lifecycle (Joiner–Mover–Leaver).

See model answer
Joiner: provision access on hire. Mover: adjust on role change — grant new, remove old. Leaver: deprovision promptly. Automating JML from HR data is the core of IGA.
Your angle: you ran joiner/leaver manually at Desktop S.A. — now learning to automate it.

15. Scenario: a user moved from Sales to Finance. Walk me through what you'd do.

See model answer
Mover event: review current access → remove Sales entitlements (access creep!) → grant Finance role-based access → ensure requested/approved and logged → verify with manager. Ideally HR-triggered and confirmed in the next access review.

16. Scenario: how would you handle offboarding an employee leaving today?

See model answer
Speed matters. Disable (don't delete — audit), revoke sessions/tokens, remove group/app/license assignments, reassign/preserve data, document. In Entra: disable user + revoke sign-in sessions cuts access immediately.
Ao enviar, suas respostas vão direto para o seu coach avaliar. Você recebe o feedback depois.
CodeCV · Support Training Module 1 — IAM Path · Active Directory → Microsoft Entra ID