User Input Yes/No Prompt in Batch Scripting

Many Batch Scripts require user confirmation before performing an action. For example, a script may ask whether you want to continue, delete a file, or restart a system.

In such cases, we can use a **Yes/No Prompt** to collect user input and execute different actions based on the response.
In this tutorial, we'll learn how to create a simple Yes/No prompt in Batch Scripting.

Example Script

  
  
@echo off

:start
cls
set /p user_input=Do you want to continue? (yes/no)?:
if not defined user_input goto start
::echo %user_input%
if /i %user_input%==y goto Yes
if /i %user_input%==n (goto No) else (goto InvalidInput)

:: /i for upercase, lowercase, or mixed case letters. It makes the comparison case-insensitive.

:Yes
echo user has entered yes
pause
goto start

:No
echo user has entered no
pause
goto start

:invalidInput
echo %user_input% is an Invalid input. Please enter 'y' or 'n'.` 
set user_input=
pause
goto start
  

How the Script Works

#Step 1: Ask for User Input

set /p user_input=Do you want to continue? (yes/no)?:


The user's response is stored in the variable:
user_input

Example:

y
OR
n




#Step 2: Check for Empty Input

if not defined user_input goto start

If the user presses Enter without typing anything, the script returns to the beginning and asks again.



#Step 3: Handle "Yes"

if /i %user_input%==y goto Yes

If the user enters:
y


The script jumps to:
:Yes



Output:

user has entered yes




#Step 4: Handle "No"

if /i %user_input%==n (goto No)
If the user enters:
n


The script jumps to:
:No


Output:
user has entered no



#Step 5: Handle Invalid Input

If the user enters something else:

abc


The script jumps to:
:InvalidInput

Output:

abc is an Invalid input. Please enter 'y' or 'n'.
The variable is cleared and the user is asked again.

What Does /I Mean?

The `/i` option makes comparisons case-insensitive.

Example:

The following inputs will all be treated as valid:
y
Y

Without `/i`, Batch would treat uppercase and lowercase letters differently.

Sample Output

#User Enters Yes

Do you want to continue? (yes/no)? y
user has entered yes


#User Enters No

Do you want to continue? (yes/no)? n
user has entered no


#User Enters Invalid Value
Do you want to continue? (yes/no)? hello

hello is an Invalid input. Please enter 'y' or 'n'.

Real-World Uses

System Engineers often use Yes/No prompts for:

• * Confirming software installations
• * Starting backups
• * Restarting services
• * Deleting files or folders
• * Running maintenance tasks
• * Executing administrative scripts

This helps prevent accidental actions.

Interview Questions

#What does `set /p` do?
It takes input from the user and stores it in a variable.


#What does `if not defined` do?
It checks whether a variable is empty.


#What does `/i` mean in an IF statement?
It makes the comparison case-insensitive.


#Why is input validation important?
It prevents users from entering invalid values and improves script reliability.


#What is the purpose of `goto`?
It transfers execution to a specified label.

Conclusion

A Yes/No prompt is a simple but useful feature in Batch Scripting. It allows scripts to interact with users, validate input, and perform different actions based on the response. By combining `set /p`, `if`, and `goto`, you can build more interactive and user-friendly automation scripts.

 ERRORLEVEL in Batch Scripting with Example

When running commands in Batch Scripting, it is important to know whether a command was executed successfully or failed.

This is where the **ERRORLEVEL** variable becomes useful.

`ERRORLEVEL` helps us check the result of the previously executed command and take action based on success or failure.



In this tutorial, we will learn how to use ERRORLEVEL with a practical example.

 What is ERRORLEVEL?


`ERRORLEVEL` is a special system variable in Batch Scripting.


After a command executes:

* `0` usually means **Success**
* Any non-zero value usually means **Error or Failure**

Example

text
ERRORLEVEL = 0


Means the command completed successfully.

• ERRORLEVEL = 1

Means an error occurred.

Example: Checking a Folder Path

  @echo off

set /P FolderPath=Enter the folder path:

 cd %FolderPath%

if %ERRORLEVEL% EQU 0 (
      echo You entered the Correct path: %FolderPath% and it will exists
) else (
        echo You entered the Wrong path: %FolderPath%
)


  

How the Script Works

Step 1

The script asks the user to enter a folder path.

set /P FolderPath=Enter the folder path:


Example:

C:\Users\user\Desktop


Step 2

The script attempts to change to the specified directory.


cd %FolderPath%

If the folder exists:

ERRORLEVEL = 0

If the folder does not exist:

ERRORLEVEL = 1


(or another non-zero value)


Step 3

The IF statement checks ERRORLEVEL.

if %ERRORLEVEL% EQU 0

If successful:

• You entered the Correct path

Otherwise:

• You entered the Wrong path

Example Output (Valid Path)

• C:\Users\user\Desktop

Output

You entered the Correct path: C:\Users\user\Desktop and it will exists




Example Output (Invalid Path)


Input
C:\InvalidFolder

Output
You entered the Wrong path: C:\InvalidFolder

Why is ERRORLEVEL Important?

ERRORLEVEL helps us:

• * Detect command failures
• * Validate user input
• * Handle errors automatically
• * Improve script reliability
• * Create professional automation scripts

Without ERRORLEVEL, a script may continue running even when something goes wrong.

Real-World Uses for System Engineers

System Engineers often use ERRORLEVEL for:

• * Checking backup success
• * Verifying software installation
• * Network troubleshooting
• * Validating file paths
• * Monitoring scheduled tasks
• * Automating maintenance scripts

It is one of the most commonly used error-checking techniques in Batch Scripting.

Interview Questions

What is ERRORLEVEL in Batch Scripting?
ERRORLEVEL is a system variable that stores the result of the last executed command.


What does ERRORLEVEL 0 mean?
It usually indicates that the command executed successfully.


What does a non-zero ERRORLEVEL mean?
It usually indicates an error or failure.


Why is ERRORLEVEL used?
It helps scripts detect and handle errors automatically.


Can ERRORLEVEL be used with IF statements?
Yes. It is commonly used with IF statements to check command results.

Conclusion

ERRORLEVEL is an essential feature in Batch Scripting that allows you to determine whether a command succeeded or failed. By combining ERRORLEVEL with IF ELSE statements, you can create smarter and more reliable scripts that handle errors effectively.

As a future System Engineer or SecDevOps professional, understanding ERRORLEVEL will help you build automation scripts that are easier to troubleshoot and maintain.

FOR Loop in Batch Scripting with Examples

When working with Batch Scripts, you may need to repeat the same task multiple times. Instead of writing the same command again and again, you can use a **FOR Loop**.

The FOR Loop helps automate repetitive tasks such as displaying values, creating folders, processing files, and running commands multiple times.

In this tutorial, we'll learn the basics of the FOR Loop using simple examples.

What is a FOR Loop?

A FOR Loop executes a block of code repeatedly for each item in a list.

Syntax


for %%variable in (list) do (
    command
)


Where:
 

• `%%variable` stores the current value.
• `list` contains the items to process.
• `do` specifies the command to execute.

Example 1: Display Numbers Using FOR Loop

@echo off
setlocal
for %%i in (1 2 3 4 5) do (
    echo %%i
)


Output

1
2
3
4
5

Explanation

In this example:

• `%%i` acts as the loop variable.
• The loop processes each value one by one.
• The `echo` command displays the current value.

Execution Flow:


Iteration 1 → 1
Iteration 2 → 2
Iteration 3 → 3
Iteration 4 → 4
Iteration 5 → 5

Example 2: Create Multiple Folders

@echo off
setlocal
for %%i in (1 2 3 4 5) do (
    mkdir Folder-atul-%%i
)

 

Result

The script creates the following folders:


Folder-atul-1
Folder-atul-2
Folder-atul-3
Folder-atul-4
Folder-atul-5

Explanation

For each number:

* The loop runs once.
* `mkdir` creates a new folder.
* `%%i` is appended to the folder name.

This saves time compared to manually creating multiple folders.

Why Use FOR Loops?

FOR Loops are useful when:

• * Creating multiple folders
• * Renaming files
• * Processing log files
• * Running repetitive commands
• * Automating administrative tasks

Instead of writing:

mkdir Folder1
mkdir Folder2
mkdir Folder3
mkdir Folder4
mkdir Folder5


you can use a single FOR Loop.


Real-World Uses for System Engineers

System Engineers commonly use FOR Loops for:

• Bulk folder creation
• File management
• Log collection
• Backup automation
• Software deployment tasks
• User account processing

FOR Loops are one of the most frequently used automation tools in Batch Scripting.

Interview Questions

What is a FOR Loop?
A FOR Loop is used to repeat a command for each item in a list.


What does %%i represent?
It is the loop variable that stores the current value during each iteration.


Why are FOR Loops useful?
They reduce repetitive code and automate repetitive tasks.


Which command is used to create folders?
mkdir


Can FOR Loops be used in automation scripts?
Yes. They are widely used in system administration and automation tasks.

Conclusion

The FOR Loop is one of the most powerful features of Batch Scripting. It allows you to repeat tasks efficiently and automate routine operations. Whether you're displaying values, creating folders, or processing files, mastering FOR Loops will make your scripts cleaner and more effective.

As a future System Engineer or SecDevOps professional, understanding loops is an important step toward automation and scripting mastery.
 

IF Statement and IF ELSE Statement in Batch Scripting

When writing Batch Scripts, we often need to make decisions based on conditions. This is where the IF and IF ELSE statements are used.

They allow a script to perform different actions depending on whether a condition is true or false.

In this tutorial, we will learn how to use IF and IF ELSE statements with practical examples.

What is an IF Statement?

An IF statement executes a block of code only when a specific condition is true.

Syntax

if condition (
    command
)

Example 1: Basic IF Statement

  
@echo off

goto:main
:main

set /A number=5
if %number% equ 5 (echo This is IF statement)

goto:eof

  

Output

This is IF statement

Explanation

In this example:

• A variable named number is created.
• The value of number is set to 5.
• The IF statement checks whether the value equals 5.
• Since the condition is true, the message is displayed.

The keyword:

equ
means equal to.

Example 2: Checking a User Path

  
  @echo off

goto:main

:main

set /P path= Enter path
if %path% EQU C:\Users\user\Desktop\batch-scripting (
    cd %path%
    dir

)

goto:eof 

How It Works

User enters a path.
Batch compares the entered value with the specified path.

If both match:

• The script changes to that directory.
• The contents of the folder are displayed using dir.

Sample Input
C:\Users\user\Desktop\batch-scripting


Sample Output
Directory of C:\Users\user\Desktop\batch-scripting


This type of validation is commonly used in automation scripts.

What is an IF ELSE Statement?

The IF ELSE statement allows us to execute one block of code when a condition is true and another block when the condition is false.


Syntax

if condition (
    commands
) else (
    commands
)

Example: IF ELSE Statement

  
@echo off
goto:main
:main
set /P path= Enter path
if %path% EQU C:\Users\user\Desktop\batch-scripting (
    cd %path%
    dir
)
 else (
    echo Invalid path
)
goto:eof

  

Explanation

• Changes to the directory
• Displays folder contents
• If the path is incorrect
• D:\Projects

Common Comparison Operators

Example

if %number% GTR 10 (
    echo Number is greater than 10
)

Real-World Uses of IF Statements

System Engineers and IT Administrators commonly use IF statements for:

• Checking whether a file exists
• Validating folder paths
• Verifying user input
• Monitoring services
• Automating troubleshooting tasks
• Running backup scripts

Interview Questions

What is an IF statement in Batch Scripting?
An IF statement executes commands only when a specified condition is true.


What is the purpose of ELSE?
ELSE executes an alternative block of code when the IF condition is false.


What does EQU mean?
EQU stands for "Equal To".


Which command is used to take user input?
set /P


Why are IF statements important?
They allow scripts to make decisions and automate tasks based on conditions.

Conclusion

The IF and IF ELSE statements are fundamental concepts in Batch Scripting. They help automate decision-making and make scripts more interactive. Whether you are validating user input, checking files, or automating system administration tasks, conditional statements are an essential skill for every Batch Scripting learner.

 Understanding Local Scope and Global Scope in Batch Scripting

Variables are one of the most important components of Batch Scripting. As scripts become larger, managing variables properly becomes essential. This is where the concepts of Local Scope and Global Scope come into play.

In this article, we will understand how SETLOCAL and ENDLOCAL work and how they affect variable visibility inside a Batch Script.

Learn Local Scope and Global Scope in Batch Scripting with practical examples. Understand SETLOCAL, ENDLOCAL, variable visibility, and best practices for Windows automation and System Administration.

What is Variable Scope?

Variable scope determines where a variable can be accessed within a script.

In Batch Scripting there are two common scopes:

• Global Scope
• Local Scope

Understanding the difference helps prevent unexpected behavior when writing automation scripts.

Understanding SETLOCAL

Example Script

  
  
@echo off

goto :displayname

:displayname
setlocal
set /P name=Enter your name:
echo Hello, %name%!
endlocal

goto: eof
  

Understanding ENDLOCAL

@echo off

goto :displayname

:displayname
setlocal
set /P name=Enter your name:
echo Hello, %name%!
endlocal

set /P number=Enter a number:
echo You entered: %number%

goto: eof

• setlocal
• set name=Atul
• endlocal

Step-by-Step Execution of the Script

Step 1

Execution starts here:

• goto :displayname
• Control jumps to:
• :displayname

Step 2

A local environment is created:

• setlocal

Now all variables created afterward are local.




Step 3

User enters a name:

• set /P name=Enter your name:

Example:
Enter your name: Atul



Variable value:
name = Atul



Step 4

Display the value:
echo Hello, %name%!


Output:
Hello, Atul!



Step 5

Local environment ends:
endlocal

Now the variable:
name
no longer exists.


Step 6

User enters another value:
set /P number=Enter a number:

Example:
25

Since this variable is declared outside the local block, it remains available.

Output:
You entered: 25

What is Global Scope?

A global variable is accessible throughout the entire script.


Example:

  
@echo off

set company=HackingTruth

echo %company%

goto:eof
  

Output:

HackingTruth


The variable remains available until:

• Script ends
• Variable is modified
• Variable is deleted

Example of Local Scope

  @echo off
setlocal

set username=Atul
echo %username%

endlocal
echo %username%
  

Second output:

(blank)

Because username exists only inside the local environment.

Example of Global Scope

@echo off

set username=Atul

echo %username%

echo %username%

Output:

Atul
Atul

The variable is available everywhere in the script.

Why Use Local Scope?

Local variables are useful when:

• Creating reusable functions
• Preventing accidental variable modification
• Testing code
• Building large automation scripts

Benefits:

• Better script organization
• Reduced bugs
• Cleaner variable management

Real-World Example

Suppose a System Engineer writes a backup script.

Without local scope:

• set backup=C:\Backup
• Another function may accidentally overwrite:
• set backup=D:\Temp

Result:

• Backup process fails
• Wrong directory used

Using SETLOCAL prevents such conflicts.

Preserving a Variable After ENDLOCAL

Sometimes you want to keep a variable after ENDLOCAL.

Example:

  @echo off
setlocal
set username=Atul
endlocal & set username=%username%
echo %username%
  

Local Scope vs Global Scope

Real-World Uses for System Engineers

Local Scope is useful for:

• Software deployment scripts
• Backup automation
• User provisioning scripts
• Active Directory automation
• Network troubleshooting tools
• System inventory collection

Global Scope is useful for:

• Configuration values
• Common paths
• Server names
• Shared settings

Interview Questions

What is SETLOCAL in Batch Scripting?

• SETLOCAL creates a local environment where variables exist only within that block.

What is ENDLOCAL?

• ENDLOCAL ends the local environment and removes local variables.

What is the difference between Local Scope and Global Scope?

• Local variables are available only inside a SETLOCAL block, while global variables remain available throughout the script.

Why should System Engineers use SETLOCAL?

• It prevents variables from interfering with other parts of the script and improves maintainability.

What happens to variables after ENDLOCAL?

• They are removed unless specifically preserved.

Conclusion

Understanding Local Scope and Global Scope is essential for writing professional Batch Scripts. Using SETLOCAL and ENDLOCAL allows you to create safer and more maintainable automation scripts. As your scripts grow in complexity, proper scope management becomes increasingly important.

For aspiring System Engineers and future SecDevOps professionals, mastering variable scope is a foundational skill that helps build reliable Windows automation solutions.

Batch Scripting Basics for Beginners: Variables, Comments, User Input, and Arithmetic Operations

Batch scripting is one of the easiest ways to automate tasks in Windows. A batch file contains a series of commands that are executed by the Windows Command Prompt (CMD). System Administrators, IT Support Engineers, and System Engineers often use batch files for automation, troubleshooting, software deployment, and maintenance tasks.

In this article, we will explore some fundamental concepts of batch scripting, including displaying output, using comments, working with variables, accessing environment variables, and performing arithmetic operations.

Displaying Output with ECHO

The echo command is used to display messages on the screen.

echo off
echo "Hello World from a batch file!"
echo 1234
echo Hello Atul
  

• echo off hides the execution of commands.
• echo displays text on the console.
• It is commonly used to provide status messages to users.

Understanding @ Symbol

//echo off
@echo "This is for symbol.bat file"
@vol
@ver

• @echo displays text without showing the command itself.
• vol displays volume information of the current drive.
• ver displays the Windows version.

Working with Variables

@echo off
rem set filename=echo.bat
rem echo The name of the batch file is: %filename%
set filename=dir
echo The name of the batch file is: 
%filename%

• set creates a variable.
• %filename% retrieves the stored value.
• In this example, the variable contains the value dir.

Comments in Batch Files

@echo off
rem set
::cd %SystemRoot%
::dir

echo Below is the cmd path
echo %cmdcmdline%
::%ComSpec%
echo %ComSpec%

• %cmdcmdline%
• Displays the command line that started the current CMD session.
• %ComSpec%
• Displays the path of the Command Prompt executable.

Arithmetic Operations

@echo off

set /a sum = 10+10
echo The sum of 10 and 10 is: %sum%
Output
The sum of 10 and 10 is: 20
More Arithmetic Examples

Addition

set /a result=15+5
echo %result%

Subtraction

set /a result=20-5
echo %result%

Multiplication

set /a result=5*5
echo %result%

Division

set /a result=100/10
echo %result%

Modulus (Remainder)

set /a result=10%%3
echo %result%

Taking User Input

@echo off

rem echo Enter your name
rem set /P name=

rem echo Hello %name%, welcome to batch scripting!

echo Enter the first number:
set /P numb1=

echo Enter the second number:
set /P numb2=

set /A sum = %numb1%+%numb2%

echo %sum%

• set /p accepts input from the keyboard.
• Values entered by the user are stored in variables.
• set /a performs arithmetic calculations using those variables.

This technique is commonly used in interactive administration scripts.

 

Real-World Usage for System Engineers

Batch scripting is useful for:

• Automating repetitive tasks
• Running maintenance scripts
• Gathering system information
• Managing files and folders
• Creating startup and login scripts
• Troubleshooting Windows systems
• Automating software installation

Even though modern organizations prefer PowerShell for advanced automation, understanding Batch scripting remains valuable because many legacy systems still use .bat files.

Conclusion

Batch scripting provides a simple way to automate Windows tasks. By learning commands such as echo, set, rem, environment variables, arithmetic operations, and user input handling, you build a strong foundation for Windows administration and automation.

Identity and Access Basics 

Azure is one of the most popular cloud platforms, and many learners are eager to get started. However, beginners often feel overwhelmed due to the wide range of services and concepts. If you have no prior experience in cloud computing or Azure, the best place to start is with Azure Fundamentals (AZ-900). In this blog series, we will cover both theoretical concepts and practical hands-on exercises to help you build a strong foundation in Microsoft Azure.

We will also provide a real-world, enterprise-level roadmap to guide your learning journey step by step.


For Phase 1 (Cloud Fundamentals) the topics I listed are sufficient to understand Azure basics, but if your goal is to prepare properly for Microsoft Certified: Azure Fundamentals (AZ-900) and to build a solid base for later phases, you should expand Phase 1 slightly. 

Think of Phase 1 as “cloud literacy + Azure platform orientation.
Below is a complete but still beginner-level Phase 1 syllabus.


Phase 1 — Azure Fundamentals (Expanded) - CLICK HERE 

Phase 2 — Azure global infrastructure regions availability zones  (Expanded) - CLICK HERE   

Phase 2 — Azure core services compute storage networking overview  (Expanded) - CLICK HERE    

4. Identity and Access Basics 

• Very important for your IT support role.
• Understand identity services such as:
• Azure Active Directory (Entra ID)

Topics:

• Users
• Groups
• Role Based Access Control (RBAC)
• Multi-factor authentication
• Single Sign-On (SSO)

This connects strongly with Active Directory, which you already see in your job.


In this module we will learn many things like as an Objective we will complete these modules.


1) Describe directory services in azure, including Microsoft Entra ID and Microsoft Entra Domain Services.
2) Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless.
3) Describe external identities and guest access in Azure.
4) Describe Microsoft entra conditional access.
5) Describe azure role based access control (RBAC)
6) Describe the concept of Zero trust.
7) Describe the purpose of the defense in depth model.
8) Describe encryption concepts and key management options in azure.
9) Describe the purpose of Microsoft defender for cloud.

1. Microsoft Entra ID (formerly azure ID)

Cloud-based identity & access management (IAM) system.

2. Microsoft Entra Domain Services

Managed version of traditional active directory features in the cloud.
Like - Domain Joining, Group policy, and LDAP - without the burdening of maintaining, patching and backing up physical or virtual domain controllers.

Think of it as a 3-layer identity system :

On-premises (left)

Active directory (AD DS)
Stores:
      Users and groups
      Devices
      Policies

Uses:
    Kerberos / NTLM




Sync Layer (middle)

Microsoft entra connect
Sync identities between:
     On-premises AD <--> Cloud

This gives a hybrid identity (same user works everywhere)




Cloud (right)

Microsoft Entra ID (core brain)

Hanldes:
    Authentication (login, MFA)
    Single Sign-On (SSO)
    App access
    Device policies



Microsoft Entra Domain Services

Provides:
    Domain join
    Group Policy
    LDAP
    Kerberos / NTLM


👉 But without managing domain controllers

Img src : learn.microsoft.com

Key Concepts Simplified

1. Authentication (who are you?)
Login verification
MFA, password reset, risk detection


Example: Detects login from a new country



2. Single Sign-On (SSO)

One Login --> many apps

Example: Login once --> access outlook, Teams, custom apps



3. App management

Connect SaaS + Internal apps
Use same identity everywhere



4. Device management

Register devices
Enforce rules (only company laptop allowed)

How Sync Works (Very important)

Flow:


On-prem AD  ⇄  Entra Connect  ⇄  Entra ID  →  Domain Services
               (bi-directional)   (one-way)



Details:

AD <--> Entra ID --> bi-directional Sync
Entra ID --> Domain Services --> one-way only


Meaning:

Changes in AD <--> Entra ID sync both ways
Domain Services does NOT sync back

Why use this setup ?

Benefits

1. Hybrid identity

Same user works:
   On-prem
   Cloud
   Apps

2. Better security

Detect suspicious logins
Enforce MFA
Conditional access

3. No infrastructure management

No need to manage domain controllers in azure

4. Legacy + modern support

Old apps --> use LDAP / Kerberos
New apps --> use modern auth (OAUTH, SSO)

Who uses it ?

IT Admins --> Control access & Security
Developers --> add login/SSO to apps
Users --> manage passwords, sign on
Subscriber --> Microsoft 365, Azure, etc




Simple analogy

Think of it like this:

On-premises AD = your old office ID system
Entra ID = Cloud identify hub (smart + secure)
Entra Domain Services = legacy compatibility layer in cloud

One-line Summary

Microsoft Entra ID is the cloud identity brain, Entra Connect syncs identities, and Entra Domain Services provides traditional AD features without managing servers.



Scenario: User signs in to a cloud app (e.g., Microsoft 365)



User:

Username: atul@hackingtruth.org
Account originally created in on-prem active directory
Synced to microsoft Entra ID

Step-by-step login flow

Step 1: User opens an app

Example:

Outlook / Teams / Custom SaaS app
App redirects user to Microsoft Entra ID login page



Step 2: User enters username

atul@hackingtruth.org


Microsoft entra ID checks:

Does this user exist?
Where is the identity coming from? (Cloud vs synced)



Step 3: Authentication decision

Now there are 3 possible paths depending on setup:



Option A: Cloud authentication (most common)

Password hash is synced to cloud
Login happens directly in Microsoft entra ID

👉 Flow:

User → Entra ID → Password verified → success




Option B: Pass-through authentication (PTA)


Password stays on-prem
Entra sends request to on-prem agent

👉 Flow:

User → Entra ID → On-prem agent → AD verifies → Response back




Option C: Federation (eg. ADFS)

Authentication fully handled on-prem

👉 Flow:

User → Redirect to ADFS → AD verifies → Token returned



Step 4: Security checks (VERY Important)

Before granting access, Microsoft Entra ID evaluates risk:

Is login from new country ?
Unknown device ?
Suspicious behavior?


Action

Allow
Block
Require MFA



Step 5: MFA (if required)

Example:
      Phone notification
      OTP code


Only after passing MFA --> continue




Step 6: Token issued

Entra ID generates a token (like a temporary pass)

This token contains

User identity
Permissions
Group



Step 7: Single Sign-On (SSO)

Now user can acces multiple apps without re-login

• Outlook ✅
• Teams ✅
• SharePoint ✅
• Custom apps ✅

👉 Because they trust the same identity provider

What about on-prem apps?

If user accesses an on-prem app:

With hybrid setup:
   can use:
       Kerberos / NTLM
       Or application proxy via Entra iD



Where Domain Services fits

If using Microsoft Entra DOmain Services:

Example: Legacy app in Azure VM

Flow:


User (Entra ID)
   ↓
Synced to Domain Services
   ↓
VM uses LDAP / Kerberos





Visualizing the whole flow



[User]
   ↓
[Microsoft Entra ID]  ← security + MFA + SSO
   ↓
   ├── Cloud Apps (M365, SaaS)
   ├── On-prem Apps (via proxy / federation)
   └── Domain Services (legacy apps)

Key takeaway

👉 Microsoft Entra ID is the gatekeeper

It:

Authenticates users
Applies security policies
Issues access tokens
Enables SSO across everything

Real-world analogy

Think of it like airport security:

• AD (on-prem) → your passport office
• Entra ID → airport security + boarding system
• MFA → extra identity check
• Token → boarding pass
• SSO → access to all gates without re-check

FIDO2 Security Keys

FIDO2 is an open standard for passwordless authentication built on the web authentication (WebAuthn) specification

A physical key (USB / NFC / Bluetooth) used to login in without a password

How is it works?

1. Register the key - Plug in or tap it once
   Plus in or tap it once


2. Login
   Choose "Security Key" at sign-in

3. Authentication
   Tap the key (or use fingerprint on it)



Users register a FIDO2 key and then select it at the sign-in screen as their primary authentication method. Because the hardware device handles authentication, there's no password that could be exposed or guessed.





🧠 One-line takeaway

👉 FIDO2 = plug key + tap = login (no password needed)




Describe External Identities 


External Identities (Guest user) can sound similar to single sign-on, but they're used for cross-tenant and consumer access scenarios. External users can bring their own identities, whether those are work accounts, government-issued digital identities, or socail identities such as google or facebook.

Describe Azure conditional access

Conditional access is a tool that microsoft entra ID uses to allow (or deny) access to resources based on identity signals. These signals include who the user is, where the user is, and what device the user is requesting access from.

Conditional access helps IT administrators:

Empower users to be productive wherever and whenever.
Protect critical assets.



Rule-based control for sign-ins

• It decides:
• ✅ Allow
• 🔒 Require MFA
• ❌ Block

How is it works (3 steps)

1. Collect signals

Who (user / role)
Where (location / IP)
Device (managed or not)
App being accessed




2. Make a decision

Based on rule you set:

Normal login --> allow
Risky login --> require MFA
High risk --> block




3. Enforce it

Grant access
Ask for MFA
Deny access





Real example

Example 1

Office location + known laptop
👉 Allow (no MFA)



Example 2

Login from another country 
👉 Require MFA



Example 3

Unknown device + risky sign-in
👉 Block



Example 4

Admin account login
👉 Always require MFA




What you can control


Require MFA for:
Admins
External access


Allow only:
Approved apps
Managed devices


Block:
Unknown locations
Risky sign-ins





One-line takeaway

👉 Conditional Access = “If these conditions are met → then allow / require MFA / block”




Describe Azure role-based access control


When you have multiple IT and engineering teams, how can you contorl what access they ahave to the resouces in your cloud enviornment? THe principle of least privilege says you should only grant access up to the level needed to complete a task. If you only need read access to a storage blob, then you should only be granted read access to that storage blob - not write access, and not access to other blobs. It's a good security practice to follow.

Describe Zero Trust model

Zero Trust Model 

Never trust, always verify  with dont trust users, devices, or network so always check every request.


Core idea

Even if someone is: Inside your network ❌ NOT trusted
Using company device ❌ NOT trusted

👉 Everything must be verified first

Principle 

1. Verify explicitly

Always check:
User identity
Location
Device
Risk level

👉 Example: login from new country → require MFA

2. Least privilege access

Give minimum access needed

Just-In-Time (temporary access)
Just-Enough-Access (only what’s needed)

👉 Example: admin access only for 1 hour



3. Assume breach

Act like attacker is already inside

Segment access
Monitor behavior
Detect threats early

👉 Example: limit access between systems




Old vs Zero Trust



| Old (Traditional)    | Zero Trust        |
| -------------------- | ----------------- |
| Trust inside network | Trust nothing     |
| VPN = safe           | Always verify     |
| One-time login       | Continuous checks |




Real example


User logs in from:

Public WiFi
Personal laptop



👉 System checks:

• Identity ✔️
• Device ❌
• Location ⚠️

👉 Result:

• Allow basic apps
• Require MFA
• Block sensitive access

One-line takeaway

Zero trust = verify every user, every device, every time === no exception.

Describe defense-in-depth

Multiple layers of security to protect data

Not relying on one defense
If one layer fails --> others still protect

Like protect data by slowing down and stopping attackers




Layers (outer --> inner)

1. Physical 

Physical Building, servers
--> Locks, cameras

2. Identity & Access

Control who can access
MFA, SSO, Permissions

3, Perimeter

Protect network edge
Firewalls, DDoS protection

4. Network

Control internal traffic
Segmentation, deny-by-default

5. Compute

Secure machines (VMs)
Patching, antivirus

6. Application

Secure apps
Fix vulnerabilities, secure code

7. Data (Core)

Protect actual data
Encryption, access control

Example

Attacker tries to access data:

Pass firewall ❌
Gets blocked by MFA ❌
Even if inside → data is encrypted ❌

👉 Attack fails

One-line takeaway

👉 Defense-in-Depth = multiple security layers protecting data, not just one

Describe encryption and key management in Azure

Encryption helps protect data confidentiality by making data unreadable to unauthorized users.



Encryption at rest and in transit

• In Azure, encryption is commonly discussed in two forms:
• Encryption at rest protects data when it is stored, such as in database, disks, and storage accounts.
• Encryption in transit protects data while it moves between services, applications, and users.

🔑 Key Management (Azure Key Vault)

Central place to store and manage sensitive stuff


Stores:

Secrets (passwords, connection strings)
Encryption keys
Certificates (SSL / TLS)

Why use key Vault ?

• No hardcoding secrets in code
• Control access (who can use keys)
• Rotate keys regularly
• Track usage (audit logs)

Example

App uses:

Azure SQL (data stored)
Azure Storage



👉 Data is:

Encrypted at rest ✔️
Encrypted in transit ✔️


👉 Keys stored in:

Azure Key Vault




Extra security features

• 🔄 Key rotation (auto update keys)
• 👤 Access control (RBAC)
• 📊 Auditing (who used what)

🧠 One-line takeaway

👉 Encryption protects data, and Azure Key Vault securely manages the keys and secrets used for that encryption





Microsoft Defender for Cloud (Simple Explanation)


Microsoft defender for cloud is a security service that monitors, protects, and improves the security of your cloud and on-premises resources.

Core Idea

It does 3 main things :

1. Assess (Find problems)
2. Secure (Fix problems)
3. Defend (stop attacks)


This is the most important memory trick.

What does it Protect ?

Azure
On-premises
Hybrid
Other clouds (AWS GCP)

Means one dashboard for everything 



1. Assess (Know Your Security Status)

Finds:

Weak passwords
Open ports
Vulnerabilities


Gives:

Recommendations
Secure Score

2. Secure (Improve Protection)

Helps you.

Apply security policies
Follow best practices


Example:

Close unused ports
Enable encryption



3. Defend (Detect & Respond)

Detects:

Attacks
Suspicious activity

Gives:

Alerts
Fix suggestions




Key Features (Compressed Version)

 

• Security recommendations
• Secure score
• Threat alerts
• Vulnerabilites scanning
• Multi-cloud supports

Real-Life example

You create a VM with open ports

 

• Defender for cloud:
• Detecs risk
• Suggest fix
• Alerts if attack happens

Important Concepts Made Easy



Secure Score

👉 A number showing how secure you are

Higher score = better security ✅
Lower score = more risk ❌

Azure Arc

👉 Helps connect:

On-premises servers
Other cloud resources

👉 So Defender can monitor them too



CSPM (Don’t Overthink)

👉 Just remember:

CSPM = checks your cloud security posture

Exam Ready Answer

👉
Microsoft Defender for Cloud is a security management and threat protection service that helps assess, secure, and defend resources across Azure, hybrid, and multi-cloud environments.

Memory Trick (Very Powerful)

Defender = Security Guard 🛡️

• - Checks your system (Assess)
• - Fixes weaknesses (Secure)
• - Stops attacks (Defend)

Final One-Line Summary

👉 Defender for Cloud continuously monitors your environment, improves security posture, and protects against threats.

Azure is one of the most popular cloud platforms, and many learners are eager to get started. However, beginners often feel overwhelmed due to the wide range of services and concepts. If you have no prior experience in cloud computing or Azure, the best place to start is with Azure Fundamentals (AZ-900). In this blog series, we will cover both theoretical concepts and practical hands-on exercises to help you build a strong foundation in Microsoft Azure.

We will also provide a real-world, enterprise-level roadmap to guide your learning journey step by step.


For Phase 1 (Cloud Fundamentals) the topics I listed are sufficient to understand Azure basics, but if your goal is to prepare properly for Microsoft Certified: Azure Fundamentals (AZ-900) and to build a solid base for later phases, you should expand Phase 1 slightly. 

Think of Phase 1 as “cloud literacy + Azure platform orientation.
Below is a complete but still beginner-level Phase 1 syllabus.


Phase 1 — Azure Fundamentals (Expanded) - CLICK HERE 

Phase 2 — Azure global infrastructure regions availability zones  (Expanded) - CLICK HERE  

Azure Core Services Overview

 
You do not need deep knowledge yet — just understand what these services do.

Compute

• Example services:
• Azure Virtual Machines
• App Services
• Containers

Purpose: running applications and servers.

------------------------------------

Storage

• Learn basic storage services:
• Azure Blob Storage
• File storage
• Disk storage
• Archive storage

Purpose: storing data.


------------------------------------

Networking

• Basic networking concepts in Azure:
• Virtual Network (VNet)
• Subnet
• Public IP
• Load balancer
• VPN gateway

You don’t need deep configuration yet — just understand the purpose.



An easy way to differentiate between VMs and containers is - virtual machine virtualize the hardware and container is virtualize the operating system.
 

The operating system level virtualization of containers is one reason why the container approach is more efficient than a full virtual machine.

It allows you to run multiple lightweight containers on a single host without sacrificing the isolation that the virtual machine originally offered.

Azure supports several container variations, the most popular being Docker.


you can easily deploy and manage multiple containerized applications without worrying about which server will host each container.

The decision of whether to use a VM or a container depends on how much flexibility you need


If you need to completely control the environment, then you might choose a VM.

If then the probability, performance characteristics and management capabilities of containers might be the better choice.




In Microsoft azure, everything you build falls into 3 main categories.

Compute -> Storage -> Networking

1. Compute (Run application)

A compute is the set of cloud services used to run applications, virtual machines, and workloads.


Azure Virtual Machines (VMs)

Azure virtual machines are on-demand, scalable computing resources that provide full control over the operating system and applications.

Example - Run a windows/Linux Server



App Services 

Azure app services is a platform for building, deploying, and hosting web application without managing the underlying infrastructure.

Example - Host a website or API



Containers

A containers are lightweight, portable units that package an application and its dependencies to run consistently across environment.

Example - Run apps using docker

2. Storage (Store data)

Storage services in azure are used to store, manage, and retrieve data in a secure and scalable way.


Blob Storage 

Azure blob storage is an object storage service used to store large amounts of unstructured data such as an images, videos and documents.


File Storage 

Azure file storage provides fully managed file shares in the cloud that can be accessed via standard file protocol.


Disk Storage

Azure disk storage provides persistent block level storage volumes for use with virtual machine.


Archive Storage 

Azure Archive storage is a low-cost storage tier designed for long-term retention of infrequently accessed data.

3. Networking 

A networking services in azure enable communications between resources, users, and on-premises environment.



Virtual Network (VNet)

A virtual network is a logically isolated network in azure that allows resources to securely communicate with each other.



Subnet

A subnet is a segmented portion of a virtual network used to organize and manage resource efficiently.



Public IP

A public IP address is an internet routable IP address that allows azure resources to be accessed from outside the network.

Load Balancer

Azure load balancer distributes incoming network traffic across multiple resources to ensure high availability and reliability.

VPN Gateway

A VPN gateway enables secure communication between azure virtual networks and on-premises networks over the internet.

Describe Azure virtual networking

Virtual Network (VNet) = Your private network in Microsoft Azure
Everything else is just features of that network.

Remember does 6 things :

VNet does 6 things:

 

1. Isolate (Separate network)
2. Connect (Azure resources)
3. Internet Access
4. Connect to on-premises
5. Control traffic (routing)
6. Secure traffic (filtering)


That's it. That entire page = these 6 points.



1. Isolation

You can create multiple private networks. (like different departments)


2. Communication

Resources inside azure can talk to each other.

3. Internet Access

Add public IP -> accessible from internet.

 

4. On-premises connection

Connect your office network to azure.

 

5. Routing 

Decide where traffic should go.

 

6. Security (Filtering)

Allow or block traffic using rules.


 

Visual Memory

Azure Virtual Private Network (VPN) 

VPN - Secure tunnel over the internet

A VPN securely connects networks or devices over the public internet using encryption.


Your Network <-- Encrypted Tunnel <-- Azure VNet

Even though data goes over the internet.
It is encrypted and safe.

VPN Gateway 

A VPN gateway is an azure service that enables secure communication between networks using VPN.


Like

1. Site-to-Site (S2S) -> office <-> Azure
2. Point-to-Point (P2P) -> Laptop <-> Azure
3. VNet-to-VNet -> Azure <-> Azure

Types of VPN 

1. Policy-Based

Uses fixed rules (IP-based)
Less flexible


2. Route-Based 

Uses routing tables
More flexible & preferred

Always remember 

Route-based VPN = Recommended in Azure




High Availability 

Azure makes VPN reliable using:

1. Active / Standby (default)

Active VPN -> Working
Standby VPN -> Backup


If active fails -> standby takes over


2. Active / Active

Both gateways work at the same time
High performance + redundancy


3. ExpressRoute Failover

If private connection fails -> VPN acts as backup


4. Zone-Redundant Gateway

Gateway spread across availability zones
protects from data center failure

How to remember this easily

VPN = Secure Connection

Gateway does 3 things:

- Connect networks
- Encrypt data
- Provide high availability

Final One-Line Summary

Azure VPN securely connects networks and users to azure using encrypted tunnels, managed by VPN gateway with high availability support.


Azure DNS is a hosting service that provides domain name resolution using Azure infrastructure, allowing you to manage DNS records with high availability, security and performance.

Azure DNS - Simple understanding 

Azure DNS is a service that translates domain name (like google.com) into IP addresses using Azure infrastructure.



Human use names:
www.google.com

Computers use IP:
142.250.x.x

DNS = translator 

What is Azure DNS ?

Azure DNS lets you host and manage your domain's DNS record using Azure.

means

You control domain records
Using azure tools


Benefits 

Instead of remembering all text, remember this:

1. Fast (global network)
2. Secure (RBAC + logs)
3. Easy (same Azure tools)
4. Private domains (VNet support)
5. Smart mapping (alias records)



1. Reliability & performance

Uses global azure servers
closest server answers -> faster

Keywords: Anycast (closest server responds)



2. Security 

controlled using: 
RBAC Role based access control (who can access)
Logs (who did what)
Locks (prevent deletion)


3. Ease of Use

Same tools as Azure:

Portal
CLI
PowerShell

No need to learn new system.



4. Private DNS (very important)

Use custom names inside your network

Example 
Instead of:
vm123.internal.cloud

You use:
myserver.local




5. Alias Records (Smart Features)

Point domain to Azure resources.

Example 

Domain -> Public IP
Domain -> CDN

If IP changes -> auto update

Important Note

Azure DNS does NOT sell domain name

You must buy from 

Domain register
Then connect to Azure

Memory Trick

DNS = Name -> IP
Azure DNS = Manage DNS in Azure

Benefits:
Fast + Secure + Easy + Private + Smart

Please share and thank you for your support.