Choose the subject first
An identity is not necessarily a person. A human identity represents a person, a workload identity represents software such as a service or script, and a device identity represents a device. The question is which subject is being identified, not whether a person owns it or a computer runs it. A software service, its host and its human operator can each be different subjects in the same story. The categories here are selected foundations, not a claim to enumerate every current Entra identity type.
Avoid ownership shortcuts
Suppose an employee owns a scheduled application. Calling the application’s identity human because an employee manages it changes the subject of the question. Calling it device because it runs on a machine makes the same mistake. Conversely, reviewing the identity information of a tablet is a device question even when an employee uses the tablet for work. Re-state the subject before selecting a category, and keep the action permission separate: being a workload or device identity does not itself describe what that identity may do.
Hybrid identity has a different axis
Hybrid identity spans on-premises and cloud identity environments through a common identity approach. Provisioning concerns creating an object under lifecycle conditions, maintaining it and deleting it when conditions no longer apply. Synchronization concerns keeping corresponding on-premises and cloud user/group information matched. These are not competing labels for a person-versus-software category. A user can be human and part of a hybrid identity arrangement; one answers what the subject is, and the other concerns how identity information spans environments.
Worked example
Fictional teaching case: a surveying institute has an employee, an unattended map-indexing service and a managed workstation. Its design review asks which identity should represent the indexing service’s own actions. First identify the actor: the software service, not the employee who maintains it or the workstation that hosts it. A workload identity matches that subject. Next list a separate question about the employee’s on-premises/cloud information: matching the corresponding employee attributes is synchronization. The resulting answer uses two distinct axes rather than choosing one vague identity label for every component.
Transfer check
Try this changed case: an employee joins a fictional institute, and its lifecycle rules require a cloud user object to be created and kept current while employment conditions apply. The question asks about object lifecycle, not a mismatch between two existing records. Which concept applies? Check basis: provisioning is the closer description. If the problem instead said two corresponding records already existed but their attributes needed alignment, synchronization would be the closer description. Neither statement establishes a resource-action permission without additional authorization evidence.
Verify the explanation
Check that your answer names both the subject and the relevant operation. Workload identifies software; device identifies the machine; human identifies the person. Provisioning identifies lifecycle work; synchronization identifies alignment. A shared username or successful sign-in is not enough to infer every one of these relationships. This is conceptual classification, without real directories, scripts, accounts or synchronization settings.
Directory concepts and cloud service contracts
A directory organizes identity objects and associated information. Windows Server Active Directory and Microsoft Entra ID share concepts such as users and groups, while serving different application and administration contracts. Entra ID is a cloud identity and access-management service; Entra Domain Services is separately described for managed domain capabilities such as LDAP and Kerberos/NTLM. Do not collapse those product names into an interchangeable login endpoint. A fictional organization may have on-premises identities and cloud apps, but the existence of one local user does not prove a matching cloud object has already been provisioned or synchronized. A worked review lists the identity source, required authentication methods, actual object lifecycle and relevant access policies for each app. For transfer, consider a domain-dependent app: shared user names are insufficient evidence that it will run unchanged under a different service contract. The retained comparison provides a foundation, not a complete migration design.
Try it, then explain it.
Complete a short set without looking at the example. After each answer, explain which evidence or rule supports your decision and why the alternatives do not fit.
Sources & authorship
Original OpenExam explanations and examples. References support the concepts; they are not the source of copied questions. Independent educator review is pending.
Authentication vs. authorization - Microsoft identity platform | Microsoft LearnWhat is hybrid identity with Microsoft Entra ID? - Microsoft Entra ID | Microsoft LearnIdentity and Access Management (IAM): Core Concepts and Benefits - Microsoft Entra | Microsoft LearnMicrosoft Learn: rd-sc-entraMicrosoft Learn: rd-sc-directory