Microsoft cloud
Microsoft Entra ID
Microsoft Entra ID is Microsoft's cloud-based identity and access management service, formerly branded Azure Active Directory until its 2023 rename. It is the directory and authentication backbone underneath virtually every other Microsoft cloud service.
Why Microsoft Entra ID matters in a Microsoft estate
Microsoft Entra ID matters because Microsoft 365, Azure, Windows 365, Teams, and related services are usually managed as one estate. The term connects to planning, cost, configuration, security, and day-two operational decisions across that estate.
How Microsoft Entra ID shows up in practice
Microsoft 365, Azure, Windows 365, Dynamics 365, and any third-party application configured for single sign-on all authenticate users against an organisation's Entra ID tenant. At its core, it stores and manages identity objects: users, groups, devices, and registered applications. It also issues the tokens that prove a user's identity and group memberships to every connected application, using open standards including OAuth 2.0, OpenID Connect, and SAML. Its licensing structure follows a Free, P1, and P2 tier model that materially gates which security capabilities are available. The free tier covers basic authentication and a limited set of Conditional Access controls. P1 adds full Conditional Access policy support, dynamic group membership, and self-service password reset.
P2 adds Identity Protection's risk-based sign-in and user-risk detection along with Privileged Identity Management for just-in-time elevation of administrative roles. This means an organisation's actual security posture on paper can be significantly overstated if P2 features are assumed to be active when the licensed tier only supports P1. Conditional Access is the policy engine most administrators interact with most directly, letting access be gated on conditions such as user or group, device compliance state, network location, sign-in risk level, and application being accessed. Misconfigured or overly permissive Conditional Access policies are a recurring source of both security exposure and user friction, since a single badly scoped policy can either fail to block a genuinely risky sign-in or lock out an entire department. Hybrid identity is another area with real operational weight.
Many organisations still run on-premises Active Directory alongside Entra ID, synchronised via Microsoft Entra Connect (formerly Azure AD Connect), with authentication handled either through password hash synchronisation, pass-through authentication, or federation. The choice between these affects both resilience if on-premises infrastructure goes down and the attack surface exposed by each method. For licence and cost governance, Entra ID sits at a slightly awkward position: P1 and P2 are sold both as standalone SKUs and bundled inside EMS and the higher Microsoft 365 tiers. This means the same entitlement can be paid for multiple times across an estate if licence assignment is not actively reconciled against what a user is actually entitled to through their other Microsoft 365 licence.