What is Microsoft Entra ID?

Microsoft Entra ID is Microsoft's cloud identity and access management service — the directory of users, groups, and devices that every Microsoft 365 sign-in goes through, and the system that decides who can access which apps and data. It sits at the centre of the Microsoft cloud: every Microsoft 365 licence assignment, every Copilot data grounding decision, every Conditional Access policy, every Teams external-user story starts with an Entra ID identity.

If you administer any part of Microsoft 365, you administer Entra ID whether or not you know it. The user objects, the group memberships, the sign-in policies, the licence entitlements — all of it lives in Entra.

What Entra ID provides

Identity directory. Accounts for employees (member users), guests (B2B invitees), service principals (applications registered in the tenant), and managed identities (Azure-side identity for cloud services). Groups (security groups, Microsoft 365 groups, dynamic groups). Devices (registered, joined, hybrid-joined). Administrative units (a slice of the directory delegated to a subset of admins).

Single sign-on. To Microsoft 365 itself and to thousands of third-party SaaS apps via SAML and OIDC. Enterprise app gallery holds pre-configured templates for common SaaS products; custom apps register through app registrations. The seamless SSO experience across a Microsoft 365 tenant plus a portfolio of SaaS apps is often the primary value proposition of Entra ID for the CIO.

Multi-factor authentication (MFA). Verifier app (Microsoft Authenticator, or third-party TOTP apps), FIDO2 keys, Windows Hello for Business, passkeys, phone-based methods (voice call, SMS — increasingly deprecated). Authentication methods policy controls which methods are available to which users, with a modern policy replacing the legacy per-tenant defaults.

Conditional Access. Policies that allow, block, or step up authentication based on user, device, location, app, and risk signals. This is the primary policy surface for Zero Trust — every access decision runs through CA before it reaches the target app.

Identity Protection. Real-time risk detection for compromised credentials, atypical travel, anonymous IP, malware-linked IP, unfamiliar sign-in patterns, plus cumulative user-risk scoring. Feeds CA to enforce step-up or block automatically. Requires Entra ID P2.

Privileged Identity Management (PIM). Just-in-time, approval-gated activation of admin roles — a Global Admin who has to activate for one hour with justification is much narrower than a permanent Global Admin. Requires P2.

B2B and External ID. Bring external partners in as guests (B2B), or run an Entra ID tenant for your own customers (External ID, formerly B2C). Two related but distinct capabilities covered in more detail in their own guides.

Lifecycle Workflows. Automate joiner / mover / leaver processes — new employee onboarding, role changes, offboarding. Requires Entra ID Governance (P2 or Entra Suite).

Where it came from

Entra ID was previously called Azure Active Directory (Azure AD); Microsoft renamed it in 2023 as part of the larger Entra portfolio rebrand. The product itself is unchanged — same APIs, same admin tools — but the branding and a handful of feature names changed. "Azure AD Connect" became "Microsoft Entra Connect". "Azure AD B2C" became "Microsoft Entra External ID". The Graph API endpoint names still carry azure in some places, and older documentation still uses "Azure AD" — the rename is not fully propagated across all Microsoft surfaces.

For historical context: Entra ID started as an internal identity service built inside Microsoft to run Office 365 back in the early 2010s. Its lineage traces back to Windows Server's Active Directory and the identity work that grew out of Live ID / MSN Passport. The clean-break "modern" identity provider you see today is the result of a decade of iterative rebuilds.

Entra ID vs Active Directory

Despite the name similarity, Entra ID is not a cloud version of on-premises Active Directory Domain Services (AD DS). They're different products with overlapping concepts and a bidirectional sync in most enterprises.

AD DS is the traditional on-prem directory: domain controllers, Kerberos tickets, LDAP queries, Group Policy Objects (GPOs), NTLM authentication, file-server ACLs anchored to domain SIDs. It was built for on-prem workstations and file servers in a corporate LAN.

Entra ID is a cloud identity provider: HTTPS APIs, OAuth 2.0 / OpenID Connect, SAML for legacy SaaS, modern device management protocols (MDM, MAM), cloud-first Conditional Access. It was built for Microsoft 365, Azure, SaaS SSO, and mobile / cloud devices.

Most enterprises run both in hybrid identity: AD DS on-premises for legacy workstations and servers, synced to Entra ID with Entra Connect Sync or Entra Cloud Sync, so the same user account works for both worlds. Microsoft is steadily building features that make AD DS less necessary — cloud-native Windows endpoints, Entra domain join, Kerberos SSO to Azure Files — and pushing toward a future where AD DS retires. That is a decade-long transition, not a next-quarter one. On-prem AD DS still hosts identity for a very large fraction of enterprise Windows fleets.

If a Microsoft 365 admin talks about "users," "groups," or "tenants," they're almost always talking about Entra ID objects. If a Windows admin talks about "OUs" or "domain controllers", they're talking about AD DS.

The licensing tiers

Entra ID comes in four tiers, and the feature set changes materially between them.

Entra ID Free — included with every Microsoft 365 subscription. Basic directory, user management, group management, SSO to Microsoft 365 and to a limited number of SaaS apps, basic MFA (security defaults). No Conditional Access, no group-based licensing, no self-service password reset for cloud accounts, no PIM, no Identity Protection. Adequate only for tenants that need Microsoft 365 without any serious identity policy.

Entra ID P1 — the working baseline for most enterprises. Adds Conditional Access, group-based licensing, self-service password reset for cloud accounts, Entra Connect health monitoring, unlimited SSO to SaaS apps, dynamic groups, hybrid identity. Included with Microsoft 365 Business Premium, E3, F3, A3, and as a standalone licence. If you plan to use Conditional Access — which you should — you need at least P1.

Entra ID P2 — enterprise tier. Adds Identity Protection (risk-based CA), PIM (JIT admin activation), access reviews (a subset — Entra ID Governance has the full version), and per-user MFA reporting. Included with Microsoft 365 E5, A5, and as a standalone licence. Required for the risk-adaptive CA policies that turn "Zero Trust theatre" into actual risk-adaptive access.

Entra Suite — an add-on on top of P1 or P2 that bundles Internet Access, Private Access, Verified ID (premium), ID Governance, and Identity Protection. Covered in its own guide. Not the same as E5 — E5 includes P2 but not the Suite.

Common Entra ID operations

Three that cover most of the day-to-day admin work:

User and group management. Create users, manage attributes, assign licences, add and remove group members. Most orgs automate this through HR-driven identity governance (workday, SAP SuccessFactors) or through Lifecycle Workflows (Entra ID Governance).

Conditional Access policy design. The big lever. Covered in its own design guide.

App integration. Register a SaaS app for SSO. Configure claims mapping. Assign users. Monitor sign-in logs. The enterprise app gallery covers most common SaaS products with pre-configured templates; custom apps use SAML or OIDC.

What Entra ID does not do

Endpoint management. Intune does that. Entra ID knows which devices are registered, joined, or compliant, but the policy that decides configuration on the endpoint sits in Intune.

Data classification and DLP. Purview does that. Entra ID gates access; Purview classifies content and enforces information-protection policies on it.

Threat detection on identities. Defender for Identity does that on-prem (with AD DS signals) and Entra ID Protection does the cloud side. Both feed the Defender XDR portal.

Deep policy on identity workflows. Lifecycle Workflows and Entra ID Governance handle the automated JML story; standalone IGA products (SailPoint, Saviynt) still lead for very complex governance scenarios.

The short version

Entra ID is the identity centre of Microsoft 365. It authenticates every user, gates access with Conditional Access, and integrates with the rest of the Microsoft security and compliance stack. Comes in four tiers (Free, P1, P2, Suite) that gate the important features; P1 is the working baseline for anyone taking identity seriously, P2 adds the risk-based CA and PIM, the Suite adds the wider identity-and-access bundle.

Related but distinct from on-prem Active Directory, which most enterprises still run in parallel through hybrid identity. Microsoft is slowly making AD DS less necessary but it will not disappear this decade.