Start with the idea, then the name.

Identity means a digital record that proves who a person, a device, or a program is. Microsoft Entra ID is a cloud service that stores these identities and checks them whenever someone tries to sign in. It is what is called an identity and access management service, or IAM. The word identity covers the “who,” and the word access covers the “what are they allowed to do.”

When you sign in to Outlook on the web, open Teams, or log in to the Azure Portal, Entra ID is usually the service doing the checking behind the scenes. Many non-Microsoft apps, such as Salesforce, Slack, Zoom, and thousands of others, can also use it for sign-in.

Imagine life without a shared identity system.

Suppose a company uses twenty different applications. Without a central identity service, every application keeps its own list of users and passwords. An employee must remember twenty passwords, reuse them, or write them on sticky notes. When the employee leaves, someone must remember to delete the account in all twenty places, and if one is forgotten, a former employee may still have access.

A central identity service fixes this. People have one account, applications trust that central service, and turning off the account in one place shuts the doors everywhere. Security rules, like requiring a second proof of identity, can also be applied in one spot instead of twenty.

Where this service came from explains many of its terms.

Long before the cloud, most companies used Active Directory Domain Services, usually written as AD DS, which was introduced with Windows 2000. It ran on servers inside the company building and managed Windows computers and users on the office network. It used protocols called Kerberos and NTLM for sign-in, and a directory language called LDAP for lookups.

When companies began using web applications and cloud services, the old design did not fit well. Web apps live on the internet, not inside one office network, and they need different protocols. Microsoft built a new cloud directory to support Microsoft 365 and Azure, first known as Windows Azure Active Directory, later Azure Active Directory, and finally Microsoft Entra ID.

Learn these words once and every Entra ID conversation becomes easier.

Tenant

A tenant is a dedicated, private instance of Entra ID that belongs to one organization. It holds that organization’s users, groups, applications, and settings. When a company signs up for Microsoft 365 or Azure, a tenant is created. Each tenant has a unique ID and a default domain name that ends with onmicrosoft.com, and companies add their own domain names, such as their company website name.

Directory

You will often hear “directory” used as another word for tenant. Think of it as the phone book of the organization, with much more information than names and numbers.

Users

A user is an identity for a person. It has a sign-in name, a password or other way to prove identity, and properties such as department and job title. Users can be members, who belong to the organization, or guests, who are outside people invited to collaborate.

Groups

A group is a collection of users, and sometimes devices or other groups, so that you can give access to many people at once. There are two main kinds. A security group is used to give access to resources. A Microsoft 365 group is used for collaboration and comes with a shared mailbox, calendar, and files. Groups can have members assigned by hand, or dynamic membership, where rules add and remove people automatically, such as “everyone whose department is Sales.”

Applications and service principals

Programs also need identities. An application registration is the definition of an app in Entra ID, like a birth certificate. A service principal is the actual identity of that app inside a particular tenant, like an employee badge issued to the app. The part of the portal named Enterprise applications shows these in-tenant identities.

Managed identities

A managed identity is a special identity that Azure creates and manages for an Azure resource, such as a virtual machine or a web app. The resource can then prove who it is to other services without any stored password. Azure handles the secrets and rotates them automatically.

Devices

Devices can have identities too. A device can be registered, which is common for personal phones, joined, which is common for company-owned computers that sign in directly with work accounts, or hybrid joined, for computers that belong to both the old office directory and the cloud one. Knowing the device lets you apply rules such as “only company-managed laptops may open sensitive data.”

flowchart TD
    T["Tenant - one organization's Entra ID"] --> U["Users - members and guests"]
    T --> G["Groups - security and Microsoft 365"]
    T --> A["Application registrations and service principals"]
    T --> MI["Managed identities for Azure resources"]
    T --> D["Devices - registered, joined, hybrid joined"]
    T --> R["Roles and policies"]
    G --> U
    

Two words that sound alike but mean different things.

Authentication, sometimes shortened to AuthN, answers “Who are you?” It is the process of proving identity, for example with a password, a code sent to your phone, a fingerprint, or a security key. Authorization, sometimes shortened to AuthZ, answers “What are you allowed to do?” It decides whether the proven identity may read a file, delete a database, or approve a payment.

Where each is handled

What actually happens between typing your name and seeing your inbox?

Modern sign-in uses open standards. The most common are OpenID Connect, which handles proving who a user is, OAuth 2.0, which handles giving an app limited permission to act, and SAML, an older but still popular standard for single sign-on in business apps. You do not need to memorize the details, but the idea behind them is simple: the application never sees your password. It trusts Entra ID, and Entra ID hands the application a signed proof, called a token.

sequenceDiagram
    participant U as User in browser
    participant A as Application
    participant E as Microsoft Entra ID
    U->>A: Open the application
    A-->>U: Redirect to Entra ID to sign in
    U->>E: Enter name, password, and second proof
    E->>E: Check identity, risk, and conditional access rules
    E-->>U: Send back a signed token
    U->>A: Present the token
    A->>A: Check the signature and the permissions in the token
    A-->>U: Show the application
    

Understanding tokens

A token is a small, digitally signed piece of data that says who you are and what you may do. Applications check the signature to make sure that Entra ID really issued it and that nobody changed it. Tokens last for a limited time, often around an hour, which limits the damage if one is stolen. There are different kinds, such as an ID token, which says who the user is, an access token, which allows calling a particular service, and a refresh token, which lets the app quietly get new tokens without asking the user to sign in again.

Single sign-on

Single sign-on, or SSO, means signing in once and then reaching many apps without typing credentials again. Entra ID keeps a session in your browser, so when a second app asks for proof, Entra ID can answer from the existing session. This improves comfort and security, because fewer passwords are typed and stored.

Passwords alone are weak. Stronger methods exist.

Passwords are often reused, guessed, or stolen by fake websites. Multi-factor authentication, called MFA, asks for two or more kinds of proof from different groups: something you know, such as a password, something you have, such as a phone, and something you are, such as a fingerprint.

Passwordless sign-in

The long-term goal is to remove passwords entirely. A user unlocks a passkey with a fingerprint, face, or PIN on their own device, and the device proves identity to Entra ID with cryptography. Nothing secret travels across the internet that an attacker could steal and reuse, which is why this approach is considered much safer.

Self-service password reset

Self-service password reset, or SSPR, lets users fix a forgotten password themselves after proving their identity another way. This reduces calls to the help desk and speeds up work.

Not every sign-in deserves the same trust.

Conditional Access is the rule engine of Entra ID. It works like a series of “if this, then that” statements. If a user, an app, a device, a location, and a risk level match a certain pattern, then Entra ID can allow the sign-in, require extra proof, or block it.

flowchart TD
    S["Sign-in attempt"] --> C1{"Who is the user and which app?"}
    C1 --> C2{"Is the device managed and healthy?"}
    C2 --> C3{"Is the location or network trusted?"}
    C3 --> C4{"Is the sign-in risk low?"}
    C4 -- "Low risk" --> ALLOW["Allow, maybe with MFA"]
    C4 -- "Medium risk" --> MFA["Require extra proof such as MFA"]
    C4 -- "High risk" --> BLOCK["Block or force password change"]
    C2 -- "Unmanaged device" --> LIMIT["Allow limited web access only"]
    

Common example rules

• Require MFA for administrators. Powerful accounts always need a second proof.
• Block legacy authentication. Old protocols that cannot do MFA are a favorite entry point for attackers.
• Require a compliant device for sensitive apps, so company data stays on managed, secured machines.
• Block sign-ins from countries where the company has no staff.
• Require stronger proof when a sign-in looks unusual, such as a new location or an impossible travel pattern.

Security defaults

For small organizations or beginners, Microsoft offers security defaults, a ready-made package of basic protections such as requiring MFA registration and blocking old authentication methods. Larger organizations replace this with their own Conditional Access rules. Check which licenses are needed for the features you want, because some require paid editions.

Most real companies live in both worlds at once.

Many organizations still run Active Directory Domain Services on their own servers because old applications and Windows computers depend on it. At the same time, they want Microsoft 365 and cloud apps. The solution is hybrid identity, where the office directory and Entra ID are connected, so the same person has one identity in both places.

A tool named Microsoft Entra Connect, along with a lighter option called Cloud Sync, copies users, groups, and sometimes password information from the office directory to the cloud. People then use one username and password for both worlds.

flowchart LR
    ADDS["On-premises Active Directory - office servers"] --> SYNC["Entra Connect or Cloud Sync"]
    SYNC --> ENTRA["Microsoft Entra ID - cloud"]
    ENTRA --> M365["Microsoft 365"]
    ENTRA --> AZ["Azure resources"]
    ENTRA --> SAAS["Third-party cloud apps"]
    ENTRA --> PROXY["Application Proxy - safe access to internal web apps"]
    PROXY --> INTERNAL["Internal company web apps"]
    

Sign-in methods for hybrid

Entra ID versus Active Directory Domain Services

Business rarely stays inside one organization.

B2B collaboration

Business-to-business collaboration, or B2B, lets you invite people from other companies as guest users. A guest uses their own work account to sign in, and you control what they can open. You do not need to create and manage another password for them. When the project ends, remove the guest, and their access ends.

Customer identity

When you build a public app for customers, you need sign-up and sign-in for people who are not employees. Microsoft provides external identity offerings for this, including the older Azure AD B2C service and the newer Microsoft Entra External ID. Product names and capabilities in this area have been changing, so check the current Microsoft documentation before you plan a new project.

The more power an account has, the more carefully it must be guarded.

Entra roles control who may manage the directory itself. The best-known is Global Administrator, which can do almost anything in the tenant. Other roles are narrower, such as User Administrator, who manages users, or Helpdesk Administrator, who can reset certain passwords. The guiding principle is least privilege, giving each person only the smallest role that lets them do their job.

Privileged Identity Management

Privileged Identity Management, called PIM, makes powerful roles eligible instead of permanent. A person must activate the role when needed, for a limited time, perhaps with approval and a written reason. After the time ends, the power disappears. This follows the idea of just-in-time access, like borrowing a key for one hour instead of keeping a copy forever. This feature usually needs a higher paid license.

Access reviews

Access reviews are scheduled checks where managers or owners confirm whether people still need their access. They help remove “permission creep,” which is the slow build-up of access that people no longer need, especially after they change jobs.

Attackers target identities more than anything else, so protection is built in.

Common attacks and defenses

If you cannot see sign-ins, you cannot protect them.

Entra ID records two main kinds of logs. Sign-in logs show who signed in, to which app, from where, with which device, whether MFA was used, and whether it succeeded. Audit logs show changes made to the directory, such as users created, roles assigned, or policies edited.

These logs can be sent to Azure Monitor and a Log Analytics workspace, where you can search them, keep them for longer, build dashboards, and set alerts. Security teams often connect them to a SIEM, short for security information and event management system, such as Microsoft Sentinel, which correlates signals from many systems to spot attacks.

What to watch

• Sudden spikes in failed sign-ins, which may mean a password spray.
• Sign-ins from unusual countries or at odd hours for a given user.
• New administrator role assignments, especially outside business hours.
• Use of break-glass accounts, which should almost never happen.
• New applications granted broad permissions.
• Conditional Access policy changes.

Features depend on the plan, so know the rough levels.

Entra ID is offered in several levels. Names, bundles, and prices change often, so use this table only as a rough map and confirm on Microsoft’s current pages.

An honest look at both sides.

The central trade-off

Security and convenience pull in different directions. Stricter rules reduce risk but can annoy users and create support tickets. The skill lies in applying stronger controls where the risk is highest, such as administrators and sensitive data, and keeping everyday access smooth, for example through passkeys and single sign-on.

These mistakes appear again and again.

A path from a fresh tenant to a well-run one.

How different organizations rely on Entra ID.