Authentication context

In the Ultra Transcenders books

SC-900SC-300SC-401

Each book explains Authentication context in context, with comparison tables and the common traps.

Terms in this definition

• Conditional Access

  Policy engine in Microsoft Entra ID P1 that, depending on signals such as risk or named locations, allows access subject to controls like MFA or a compliant device, or blocks it.

• Tag

  Key-value label on compute (for cost tracking) or on a Unity Catalog securable or column, applied with SET TAG or SET TAGS and requiring APPLY TAG. Governed tags restrict allowed keys, values and assigners across the account.

• App protection policy

  A set of Intune rules on managed apps that safeguards organisational data, for example by demanding a PIN or preventing copy-paste and save-as into personal apps. It works whether or not the device is enrolled.

• LSDOU

  The sequence in which Group Policy is processed: the local policy first, followed by site, domain and organisational unit policies. The nearest, last-processed setting takes effect unless Enforced or Block Inheritance alters that.

• Privileged Identity Management

  Capability in Microsoft Entra ID P2 that activates privileged roles just in time and for limited periods, with approval, justification and an audit trail.

• Role

  How an actor normally or expectedly behaves, or the part a person takes in a process. A single actor may hold more than one role.

• APPLY

  Evaluates a table-valued expression for every row on its left, inside FROM. Think of OUTER APPLY as a left outer join and CROSS APPLY as an inner join.

Related terms

• Protected actions

  Sensitive Microsoft Entra operations, such as permanent deletion or changes to Conditional Access, tied to an authentication context so Conditional Access is checked at the moment the action happens instead of at sign-in. It needs P1.