Identity & access management
AWS Identity and Access Management (IAM) vs Microsoft Entra ID / Azure role-based access control (Azure RBAC)
AWS IAM maps to two Azure services.
Microsoft Entra ID holds the identities (users, groups, apps, managed identities), and Azure RBAC grants them roles on resources. AWS IAM does both jobs inside each account.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | AWS Identity and Access Management (IAM) | Microsoft Entra ID Azure role-based access control (Azure RBAC) |
| Lifecycle | Generally available | Generally available Generally available |
| What it is | Users, groups, roles, and JSON policies that authorize every AWS API call, with identity-based and resource-based policies, permissions boundaries, and conditions. | Microsoft's cloud identity provider for users, groups, apps, and devices, with SSO (SAML, OIDC), MFA, Conditional Access, app registrations, and hybrid sync from on-premises AD. Authorizes access to Azure resources by assigning built-in or custom roles to Entra principals at management group, subscription, resource group, or resource scope, with deny assignments and ABAC conditions. |
| Pricing model | IAM is free. | Azure RBAC is free. Entra ID has Free, P1, and P2 tiers (and suites), with Conditional Access and PIM in paid tiers. |
| Docs | AWS Identity and Access Management (IAM) docs | Microsoft Entra ID docs Azure role-based access control (Azure RBAC) docs |
| Pricing page | AWS Identity and Access Management (IAM) pricing | Microsoft Entra ID pricing Azure role-based access control (Azure RBAC) pricing |
| Exams | CLF-C02 SAA-C03 SCS-C03 | AZ-900 AZ-104 SC-300 SC-500 |
Key differences
- Where identities live. IAM users and roles live in each AWS account (workforce users usually come through Identity Center). Entra ID is one tenant-wide directory shared by Azure, Microsoft 365, and your apps.
- Policy model. IAM uses JSON policies attached to identities or resources, with explicit deny, conditions, and permissions boundaries. Azure RBAC assigns roles (sets of actions) at a scope that inherits downward, with deny assignments and attribute-based conditions in limited cases.
- Data plane. Some Azure services use separate data-plane roles (for example, Storage Blob Data Reader or Key Vault Secrets User). IAM actions cover both management and data APIs.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- IAM is free. AWS Identity and Access Management (IAM) pricing →
- Azure
- Azure RBAC is free. Entra ID has Free, P1, and P2 tiers (and suites), with Conditional Access and PIM in paid tiers. Microsoft Entra ID pricing → Azure role-based access control (Azure RBAC) pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Cloud Practitioner CLF-C02 | AWS | Foundational | current Italian and German versions retire after Dec 31, 2026. |
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| Microsoft Certified – Azure Fundamentals AZ-900 | Azure | Fundamentals | current |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
| Microsoft Certified – Identity and Access Administrator Associate SC-300 | Azure | Associate | current English version will be updated on Oct 28, 2026. |
| Microsoft Certified – Cloud and AI Security Engineer Associate SC-500 | Azure | Associate | current New certification. A practice assessment isn't available yet, which the page says usually means the exam recently left (or is in) beta. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of AWS Identity and Access Management (IAM)?
AWS IAM maps to two Azure services. Microsoft Entra ID holds the identities (users, groups, apps, managed identities), and Azure RBAC grants them roles on resources. AWS IAM does both jobs inside each account.
How does pricing compare between AWS Identity and Access Management (IAM) and Microsoft Entra ID and Azure role-based access control (Azure RBAC)?
AWS: IAM is free. Azure: Azure RBAC is free. Entra ID has Free, P1, and P2 tiers (and suites), with Conditional Access and PIM in paid tiers. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Cloud Practitioner (CLF-C02); AWS Certified Solutions Architect – Associate (SAA-C03); AWS Certified Security – Specialty (SCS-C03); Microsoft Certified – Azure Fundamentals (AZ-900); Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Identity and Access Administrator Associate (SC-300); Microsoft Certified – Cloud and AI Security Engineer Associate (SC-500).
Is Azure RBAC the same as IAM policies?
They play the same role, but Azure RBAC grants roles at a scope (management group, subscription, resource group, or resource), and those roles inherit downward. IAM attaches JSON policy documents to identities and resources within an account.