Microsoft Identity Insight
Microsoft Entra ID Explained: What Is It and Why Is It Important?
Learn what Microsoft Entra ID is, how authentication and access control work, how it differs from Active Directory and why identity security matters.
Microsoft Entra ID is the identity control plane for Microsoft 365 and many connected applications. It verifies users and devices, enforces access policies and provides the foundation for MFA, Conditional Access, single sign-on and identity governance.
What Is Microsoft Entra ID?
Microsoft Entra ID is Microsoft's cloud-based identity and access management service. It manages users, groups, devices, applications and permissions and helps decide who can access a resource and under which conditions.
It is the foundational identity service used by Microsoft 365 and can also provide sign-in and access control for thousands of third-party and custom applications.
Is Microsoft Entra ID the New Name for Azure AD?
Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID. The rename did not require a migration and did not change existing deployments, configurations, licences or service-level commitments.
The new name also helps distinguish the cloud service from Windows Server Active Directory, which uses different architecture and management concepts.
How Microsoft Entra ID Works
When a user signs in, Entra ID validates the authentication request and issues tokens that applications use to grant access. Policies can evaluate the user, application, device, location, authentication method and risk before access is allowed.
- A user or workload requests access to an application.
- Entra ID verifies the identity using an approved authentication method.
- Conditional Access and other policies evaluate the request.
- The service issues an access token when requirements are satisfied.
- The application uses claims in the token to authorise permitted actions.
Core Microsoft Entra ID Capabilities
| Capability | What it does | Business value |
|---|---|---|
| Users and groups | Organises identities, licences and access assignments. | Central administration and repeatable access. |
| Single sign-on | Lets users access connected applications with one work identity. | Fewer passwords and simpler access. |
| Multifactor authentication | Requires additional proof beyond a password. | Reduces the impact of stolen credentials. |
| Conditional Access | Applies access controls using user, device, app, location and risk signals. | Context-aware Zero Trust access. |
| Role-based access control | Assigns administrative permissions by role. | Supports least privilege. |
| Device identity | Registers or joins devices and provides device signals. | Connects endpoint posture with access decisions. |
| External identities | Supports access for partners, guests and customers. | Safer collaboration beyond the organisation. |
Authentication, MFA and Passwordless Access
Entra ID supports password-based and passwordless authentication methods, including Microsoft Authenticator, FIDO2 security keys and passkeys in supported scenarios. Organisations can use authentication policies and registration campaigns to improve adoption.
MFA should be prioritised for administrators and then extended to all users. Stronger phishing-resistant methods should be considered for privileged and high-risk roles.
Conditional Access and Zero Trust
Conditional Access is the policy engine used to apply controls at sign-in. A policy can require MFA, a compliant device, a specific authentication strength or block access when defined conditions apply.
Verify explicitly
Zero Trust does not assume that a request is safe merely because it comes from inside the office network. Entra ID can evaluate identity and context each time access is requested.
Microsoft Entra ID vs Active Directory
| Area | Microsoft Entra ID | Windows Server Active Directory |
|---|---|---|
| Primary model | Cloud identity and access management. | On-premises domain directory. |
| Common protocols | OAuth, OpenID Connect and SAML. | Kerberos, NTLM and LDAP. |
| Device relationship | Entra registration and join. | Domain join. |
| Management focus | Users, cloud apps, access policy and tokens. | Domains, computers, Group Policy and local network resources. |
| Relationship | The services can be connected for hybrid identity; one is not simply a cloud-hosted copy of the other. | |
Microsoft Entra ID Licensing
Core Entra ID capabilities are included with Microsoft cloud subscriptions. Entra ID P1 adds capabilities such as Conditional Access and is included in Microsoft 365 Business Premium. Entra ID P2 adds more advanced identity protection and governance capabilities.
Licensing should be checked against the exact feature being deployed because integrated services such as Intune, Microsoft Defender and governance products can have separate requirements.
Microsoft Entra ID Security Best Practices
- Require MFA and prioritise phishing-resistant authentication for privileged users.
- Use separate administrator accounts and minimise permanent high-privilege assignments.
- Deploy Conditional Access through report-only mode and pilot groups.
- Maintain and monitor emergency access accounts.
- Disable or remove stale users, devices, applications and credentials.
- Review guest access and application consent regularly.
- Monitor sign-in logs, audit logs and identity-risk information.
- Automate joiner, mover and leaver processes where practical.
Common Microsoft Entra ID Mistakes
- Treating identity security as only a password problem.
- Giving Global Administrator access for routine tasks.
- Leaving old guest accounts and enterprise applications unreviewed.
- Deploying access policies without pilots or emergency access planning.
- Ignoring service principals, workload identities and application secrets.
- Assuming on-premises security controls automatically protect cloud identities.
Official Microsoft References
Need Help Securing Microsoft Entra ID?
Fedelta helps Australian businesses review identities, administrator roles, MFA, Conditional Access, guest access and identity lifecycle processes.
Book a consultationFrequently Asked Questions
Is Microsoft Entra ID the same as Azure Active Directory?
Yes. Azure Active Directory was renamed Microsoft Entra ID. The underlying service, deployments and licensing continued without requiring customers to migrate.
Is Microsoft Entra ID the same as Windows Server Active Directory?
No. Entra ID is a cloud identity and access management service. Windows Server Active Directory is a traditional on-premises directory service, although the two can be connected in hybrid environments.
Is Microsoft Entra ID included with Microsoft 365?
A Microsoft Entra tenant and core identity capabilities are included with Microsoft 365. Advanced capabilities depend on the Microsoft 365 plan or Entra ID P1 or P2 licensing.
Why is Microsoft Entra ID important for security?
It is the identity control plane for Microsoft 365 and many connected applications, enabling MFA, Conditional Access, role management, device identity and monitoring.