Microsoft Entra ID

What Microsoft Entra ID means in practice

Entra ID is the front door to everything in a Microsoft environment. Every sign-in to Outlook, Teams, SharePoint, the Azure portal and any connected SaaS application passes through it, which makes it both the most useful control point and the most valuable target in the tenant.

The rename from Azure Active Directory in 2023 caused lasting confusion, because Entra ID is not a cloud version of on-premises Active Directory. Active Directory is a directory service using Kerberos, LDAP and Group Policy, designed for domain-joined machines on a corporate network. Entra ID is an identity provider using modern protocols — OAuth 2.0, OpenID Connect and SAML — designed for internet-facing access. Many organisations run both, synchronised with Entra Connect, which is a hybrid identity model rather than a migration.

The capabilities that matter operationally are conditional access as the policy engine, Entra ID Protection for risk-based detections such as leaked credentials and impossible travel, Privileged Identity Management for just-in-time elevation into administrative roles, access reviews for periodic recertification of group and role membership, and entitlement management for packaging access to resources for guests and contractors.

Licensing tiers determine what is available. The free tier included with Microsoft 365 provides basic directory services and security defaults. Entra ID P1, included in Business Premium, E3 and Microsoft 365 F3, adds conditional access, group-based licensing and self-service password reset with writeback. P2, included in E5, adds risk-based conditional access, Privileged Identity Management and access reviews.

The most common weaknesses we find are unmanaged: standing global administrator rights held by more people than anyone can justify, guest accounts from projects that finished years ago, service principals with excessive application permissions granted by a consent prompt nobody reviewed, and legacy authentication still enabled for a single application that was never decommissioned.