What Is Microsoft Entra ID?

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. It is the identity backbone of Azure and Microsoft 365, handling authentication and authorisation for millions of users and applications worldwide. Every Azure subscription is associated with one Entra ID tenant that stores user identities and manages access to resources.

Traditional on-premises Active Directory Domain Services (AD DS) manages identities using Kerberos and LDAP protocols, suited for domain-joined Windows machines in a corporate network. Entra ID is cloud-native and uses modern protocols — OAuth 2.0, OpenID Connect, and SAML — to authenticate users to web apps, SaaS services, and APIs from any device, anywhere. The two can coexist via Microsoft Entra Connect, which synchronises on-premises identities to the cloud.

A tenant is a dedicated instance of Entra ID that an organisation receives when it signs up for Azure or Microsoft 365. It has its own directory of users, groups, and applications. Your tenant has a domain name like yourcompany.onmicrosoft.com, and you can add custom domains like yourcompany.com. Each Azure subscription trusts exactly one tenant for authentication.

An Azure subscription is a billing and resource boundary — it holds Azure resources like VMs, databases, and storage accounts. A subscription trusts one Entra ID tenant, meaning only identities from that tenant (or federated identities) can be granted access to resources in the subscription. Multiple subscriptions can trust the same tenant, which is how large enterprises manage many environments under one identity store.

Understanding the distinction is fundamental. Authentication (AuthN) is the process of proving who you are — Entra ID verifies your username and password (or MFA token). Authorisation (AuthZ) is the process of determining what you are allowed to do — Azure RBAC checks your role assignments to decide which operations your identity can perform on Azure resources after authentication succeeds.

Entra ID comes in three main editions. Free (included with any Azure subscription) provides basic user and group management, SSO for up to 10 apps, and basic security reports. P1 adds conditional access, hybrid identity with on-premises AD, and self-service group management. P2 adds identity protection with risk-based conditional access and Privileged Identity Management (PIM) for just-in-time role activation.

Entra ID supports cloud-only users (created directly in the directory) and synchronised users (synced from on-premises AD via Entra Connect). You can create users through the Azure portal, Microsoft 365 admin centre, Azure CLI, or PowerShell. Each user object stores attributes like display name, email, job title, department, and manager, plus authentication credentials.

Entra ID supports two group types. Security groups are used to assign permissions — add a user to a security group and grant the group an RBAC role to avoid managing individual assignments. Microsoft 365 groups bundle a shared mailbox, calendar, SharePoint site, and Teams workspace for collaboration. Groups can be assigned memberships dynamically based on user attributes, reducing manual management.

When you want to allow an application to authenticate users via Entra ID, you create an App Registration. This represents your application in the directory and gives it a client ID. You then configure the allowed redirect URIs, API permissions, and (for confidential clients) generate a client secret or upload a certificate. The app uses OAuth 2.0 / OIDC flows to obtain access tokens on behalf of users.

A managed identity is an automatically managed identity in Entra ID assigned to an Azure resource such as a VM or App Service. The resource can obtain tokens from Entra ID without any stored credentials or rotation management. System-assigned managed identities live and die with the resource; user-assigned managed identities are standalone objects that can be attached to multiple resources.

Self-Service Password Reset (SSPR) lets users reset their own Entra ID passwords without calling the IT helpdesk, using verification methods like authenticator app, phone, email, or security questions. SSPR dramatically reduces helpdesk tickets and allows users to unblock themselves outside business hours. It is available in Entra ID P1 and P2, and can write passwords back to on-premises AD for hybrid environments.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: Entra ID is Azure's cloud-native identity service using OAuth 2.0 and OpenID Connect, tenants are dedicated directory instances that subscriptions trust for authentication, and managed identities allow Azure resources to authenticate without stored credentials. Next up we explore users, groups, and RBAC role assignments in Entra ID.