One badge for every door

Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. It stores users, groups and app registrations; signs people in to Microsoft 365, the Azure portal and thousands of software as a service (SaaS) apps; and protects those sign-ins. Microsoft runs it worldwide, so there are no servers for you to manage. Each organization gets its own instance, called a tenant, and every Azure subscription trusts one tenant.

What Entra ID does

Four jobs to know:

• Authentication: verifies identity to grant access, with features like self-service password reset (SSPR), multifactor authentication and smart lockout
• Single sign-on: one identity and one sign-in for many apps
• Application management: register and manage cloud and on-premises apps, plus the My Apps portal for users
• Device management: register devices so tools like Microsoft Intune can manage them and access can depend on device health

Priya: Self-service password reset alone would cut that 41% way down.

Hybrid identity

Many companies, Kibble & Co. included, still run Active Directory Domain Services (AD DS) on their own servers. Microsoft Entra Connect synchronizes users and groups from on-premises AD DS to Entra ID, so people use one identity for both on-premises and cloud apps. Change a password or disable a user on premises, and it flows to the cloud.

Microsoft Entra Domain Services

Some older apps can't use modern cloud sign-in. They expect a classic Windows domain: domain join, Group Policy, Lightweight Directory Access Protocol (LDAP) lookups and Kerberos or NT LAN Manager (NTLM) authentication. Microsoft Entra Domain Services provides these as a managed domain: Microsoft deploys, patches and backs up the domain controllers, and you just use them. Users and groups sync one way from Entra ID into the managed domain, so people keep the same credentials.

Sam: Pawsome's ancient inventory app wants LDAP. With Domain Services, I don't babysit domain controllers.

Exam tip Entra ID alone doesn't do domain join, Group Policy, LDAP or Kerberos for old apps. Need those without running domain controllers? Entra Domain Services.

Authentication vs authorization

Authentication (AuthN) proves who you are. Authorization (AuthZ) decides what you're allowed to do once you're in. Entra ID handles authentication; tools like Azure role-based access control (RBAC), coming tomorrow, handle authorization in Azure.

Exam tip Mnemonic: authentication = identity card at the door; authorization = which rooms your card opens.

Single sign-on

Single sign-on (SSO) lets a user sign in once and use many apps with one identity. Fewer passwords mean fewer forgotten passwords and reset tickets, and IT has one account to disable when someone leaves. The catch: SSO is only as strong as that one sign-in, so pair it with a strong authentication method.

Multifactor authentication

Multifactor authentication (MFA) asks for two or more different kinds of proof: something you know (a password or personal identification number, PIN), something you have (a phone or security key) and something you are (a fingerprint or face). A stolen password alone is no longer enough. Microsoft Entra multifactor authentication supports methods such as Microsoft Authenticator app approvals, codes by text or voice call, and hardware tokens.

Exam tip Two passwords is NOT MFA: both are something you know. The factors must be different kinds.

Passwordless

Passwordless sign-in removes the password and uses something you have plus something you are or know. It's more secure and easier for users. Three options Microsoft highlights:

• Windows Hello for Business: a face, fingerprint or PIN tied to the user's own PC
• Microsoft Authenticator app: approve the sign-in on your phone with your face, fingerprint or PIN
• FIDO2 security keys (passkeys): a USB or near-field communication (NFC) key built on the Fast Identity Online 2 (FIDO2) standard

Ranger: boops the laptop's fingerprint reader with his nose

You: Sorry, Ranger. Your nose isn't enrolled.

Who counts as external

External identities are people, devices or services outside your organization: partners, vendors, suppliers and customers. Microsoft Entra External ID lets them sign in with identities they already have, such as their own work account, a Google or Facebook account, or a one-time passcode sent by email, so you don't create and look after passwords for them.

Priya: No more vendor passwords on sticky notes. I may cry.

Ranger: licks Priya's hand, supportively

Partner and customer scenarios

The main ways to work with external identities:

• Business-to-business (B2B) collaboration: invite partners as guest users in your directory. They sign in with their own credentials, and you control what they can reach
• B2B direct connect: a two-way trust with another Microsoft Entra organization, used for Microsoft Teams shared channels; no guest account is created
• Customer sign-in: sign-up and sign-in for customers of your own apps, run from a separate external tenant. (The older Azure Active Directory B2C isn't sold to new customers since May 2025.)

Exam tip Partner uses their own account to reach your apps = B2B collaboration (guest user). Your customers signing in to your app = External ID in an external tenant.

If this, then that

Conditional Access is the policy engine in Entra ID. After the first sign-in step, it gathers signals about the attempt, makes a decision and enforces it. Policies read like if-then statements: if a user in Finance signs in from an unfamiliar country, then require MFA. Conditional Access needs a Microsoft Entra ID P1 or P2 license.

• Signals: the user and their groups, location (internet protocol, or IP, address), device and whether it's compliant, the app being opened, and real-time sign-in risk
• Decisions: allow access, block it, or allow it only after a requirement such as MFA or a compliant device

When it helps

Conditional Access lets you add friction only where risk is higher. Typical policies: require MFA only outside the office network, allow some apps only from managed, compliant devices, block sign-ins from countries you never operate in, and block legacy sign-in methods that can't do MFA. On the exam, 'based on location, device, app or risk' points to Conditional Access.

Mr. Barkley: So at the office I just sign in, and at the beach my phone asks me to approve?

Priya: Exactly. Same you, different conditions.