Overview

I'm summarizing what I understood and researched from reading "Azure Active Directory at a Glance, 3rd Edition."

The main topics I studied are:

Azure AD Connect

Azure AD Connect can synchronize on-premises AD IDs and passwords to Azure AD.
This means you only need to manage accounts on the on-premises Active Directory side.
You need to download AzureADConnect.msi and install it on a Windows Server joined to the on-premises domain. This server is called the Azure AD Connect server.
On the Azure AD Connect server, the Azure AD Connect sync service starts and performs directory synchronization.
Directory synchronization is performed over HTTPS. By default, synchronization from on-premises AD to Azure AD occurs every 30 minutes.
The data store for Azure AD Connect uses a local or remote SQL Server.
Directory synchronization requires three accounts:
- On-premises AD: AD DS connector account
- Azure AD Connect server: ADSync service account
- Azure AD: Azure AD connector account
The following four filters can be applied to synchronization from on-premises AD to Azure AD:
- Group-based filter
- Domain-based filter
- Organizational unit (OU)-based filter
- Attribute-based filter

Azure AD identities and passwords can be synchronized to Azure AD Domain Service.
Domain join, Group Policy, LDAP, Kerberos authentication, and NTLM authentication are available.

Targets Windows 10 devices.
When a Windows 10 device joins Azure AD, users can sign in using an Azure AD user account.
A device can only join either on-premises Active Directory or Azure AD — not both.

By deploying Intune into Azure AD and enrolling devices in Intune, policies can be applied to enrolled devices, enabling device management based on organizational policy.
One of Intune's policies is the compliance policy, which determines whether a device meets the organization's security and compliance standards.

PIM allows time-limited and approval-based temporary role assignments.
An administrator first assigns the eligibility to activate a role.
The procedure is: first configure the role, maximum activation time, and approvers to create an eligibility, then assign the created eligibility to target users.
Users with an assigned eligibility can request activation, and upon approval, the role becomes usable.
It is also possible to make an immediate time-limited role assignment without an approver (active role assignment with expiration).

By connecting an application to Azure AD, users authenticated by Azure AD can access the app via SSO.
In addition to authentication, access control can also be managed in Azure AD.
The following types of Azure AD integration are available for applications:
- App Service
- On-premises web apps
- Third-party SaaS apps (Salesforce, Twitter, etc.)
- App registrations

Using Azure's Application Proxy reverse proxy feature, on-premises web apps can be integrated with Azure AD.
Via Azure's Application Proxy, users can securely access on-premises web apps with SSO from the internet.
Installing the Application Proxy Connector on an on-premises Windows server enables the Application Proxy feature in Azure AD.
After enabling it, add the on-premises web app to Azure AD and assign access permissions to the users who will use the app.
Since access permissions are assigned to Azure AD users synchronized from on-premises AD, it is a prerequisite that directory synchronization via Azure AD Connect is in place.

This isn't covered in the book, but I was curious about how to log into a Windows VM using Azure AD and looked it up.

As shown in the link below, it is possible to apply Azure AD authentication for VM login.