# Shared responsibility: Entra is the new perimeter Source: https://ai.techclick.in/blog_azure_shared_responsibility_entra Markdown: https://ai.techclick.in/blog_azure_shared_responsibility_entra.md Publisher: Techclick Infosec Pvt Ltd Microsoft secures the fabric. You secure identity, data, and config. Entra tenant is not a subscription. Dummy techclick-lab.in. ## The ticket Priya cannot open the pay-api portal. Junior reboots the spoke VM. The VM is healthy. The sign-in log says the token was issued for the wrong tenant. You patched compute. The perimeter is Entra. Quick interview answer Microsoft’s shared-responsibility model: for every cloud type you still own data, identities, accounts, and access . IaaS adds OS and network controls on you; PaaS/SaaS move more of the stack to Microsoft. The Entra tenant is the identity boundary (users, apps, Conditional Access). A subscription is a billing + RBAC container that trusts a tenant. One tenant, many subscriptions. Compromised identity beats a perfect NSG. Hero · two planes Green fabric, red token. Different owners. Lab data · dummy only Tenant techclick-lab.in · MG tc-root / tc-landing / tc-workloads · subs sub-hub sub-spoke-app · hub VNet 10.40.0.0/16 · spoke 10.41.0.0/16 · Azure Firewall 10.40.0.4 · VPN GW public 203.0.113.50 · on-prem FortiGate WAN 203.0.113.10 . Not a live tenant. ## Mental model Plane Who owns it This lab If it breaks Physical DC / host / hypervisor Microsoft You cannot SSH the host Azure status — rare on a student ticket Subscription + RBAC You sub-hub , sub-spoke-app Cannot deploy / wrong Owner Entra directory You Tenant techclick-lab.in Nobody signs in, or the wrong people do Data + app config You pay-api, kv-tc-lab Leak or outage with a healthy VM Tenant is not a subscription - Entra tenant techclick-lab.in sub-hub · 10.40.0.0/16 sub-spoke-app · pay-api Delete a subscription and the tenant remains. Compromise the tenant and every sub is in play. ## How to choose Symptom First plane Not first Sign-in failed / wrong tenant Entra Reboot pay-api Deploy denied RBAC on the subscription Open NSG any-any Host unreachable everywhere Azure status + region Reset Entra passwords https://portal.azure.com Training mock · not live Azure portal Home Microsoft Entra ID Virtual networks Azure Firewall Microsoft Entra ID → Overview ### techclick-lab.in Tenant name techclick-lab.in Tenant type Workforce · dummy lab Subscriptions trusting this tenant sub-hub, sub-spoke-app Signed-in user priya@techclick-lab.in Cancel Save Entra Overview is the directory, not the bill. Training mock. ## Runbook #### Side A — who am I Portal top-right: tenant name + email. If it says a personal MSA tenant, you are not in techclick-lab.in . - #### Side B — which sub Directory + subscription filter. sub-spoke-app for pay-api. sub-hub for Firewall and the VPN gateway. - #### Side C — prove az account show then Entra sign-in logs for Priya. A healthy VM is not a healthy identity. az · dummy az account show --query "[name, id, tenantId]" -o tsv # sub-spoke-app # 11111111-1111-1111-1111-111111111111 # 22222222-2222-2222-2222-222222222222 # Portal top-right directory must read techclick-lab.in az ad signed-in-user show --query userPrincipalName -o tsv # priya@techclick-lab.in ## Four failures ### 1 · “Microsoft will patch our Owner” They will not. Owner, Guest invites, and CA are yours on every SKU. ### 2 · Tenant ≠ subscription Junior deleted sub-spoke-app to “reset Azure AD.” Users and app registrations stayed. Billing died. ### 3 · Guest in the wrong directory Priya’s work account is a guest of a partner tenant. Tokens look valid. Resources are not here. ### 4 · Status page as a close code Regional green does not mean CA, RBAC, or a secret is healthy. ## How to prove it Close the ticket only when 1) You named tenant vs subscription. 2) az account show matches the portal directory. 3) You said who owns identity. 4) You did not reboot pay-api as a ritual. ## Traps Heard in chat Truth Wrong fix Azure is down Which plane — fabric, sub, or Entra? Redeploy the hub VNet Give her Owner on the tenant Owner is a subscription/MG role Global Admin “for a minute” IaaS means Microsoft patches Windows You patch the guest OS Wait for a host update ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 In every Azure deployment type you still own… The physical host Data, identities, accounts, and access The datacenter cameras The hypervisor Correct: b . Shared responsibility — always yours. Q2 techclick-lab.in is… A subscription An Entra tenant / directory A VNet An NSG Correct: b . Tenant ≠ sub. Q3 sub-hub and sub-spoke-app both trust… Different Entra tenants by default The same dummy tenant techclick-lab.in On-prem FortiGate Microsoft’s billing tenant only Correct: b . One tenant, many subs. Q4 Priya’s token is for the wrong tenant. First move? Reboot pay-api Confirm directory + az account show, then sign-in logs Delete the hub VNet Disable Azure Firewall Correct: b . Identity plane. Q5 IaaS guest OS patching is… Always Microsoft Yours Entra’s job Only on SaaS Correct: b . IaaS: you own the OS. Q6 A green Azure status page proves… CA and RBAC are healthy The fabric Microsoft owns is not in a published incident pay-api secrets are safe The tenant cannot be phished Correct: b . Failure 4. Check answers Reset Azure security class series: Shared + Entra · Landing zone · NSG vs Firewall vs WAF · Conditional Access · Key Vault + MI · Private Link · Defender + Sentinel · Hub-spoke · Identity path · Interview ## Sources - Microsoft Learn — Shared responsibility in the cloud . Related: Azure session factory · Migration series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt