Azure's access control model validates identity at the token boundary, not at the execution boundary. When Microsoft Entra ID issues a JWT, it encodes role membership, resource permissions, and the conditions of the authentication event into a signed, time-bounded assertion. Every downstream Azure service - Blob Storage, Key Vault, Azure Resource Manager, Azure SQL - accepts that assertion as auth