Microsoft Entra ID Guide

What is Microsoft Entra ID?

Microsoft Entra ID is Microsoft's cloud-based identity and access management service. It authenticates users, devices, applications and workloads, then provides the identity information and authorisation controls used to access Microsoft 365, Azure, software-as-a-service applications and custom applications.

Every Microsoft 365 organisation already relies on a Microsoft Entra tenant. The tenant contains identities, groups, registered applications, devices, policies, administrative roles, logs and security configuration. The quality of this identity foundation has a direct effect on the security and usability of the wider cloud environment.

Identity is now the control plane for modern work. A compromised or poorly governed identity can bypass otherwise strong network and endpoint controls.

Tenant architecture and governance

A Microsoft Entra tenant is a security boundary and administrative boundary. Start with clear ownership, verified domains, contact details, emergency access, administrative roles and change processes. Avoid creating additional tenants without a justified business, legal or isolation requirement because each tenant introduces separate identity lifecycle, security, application and support obligations.

Core governance decisions

• Who owns the tenant and approves identity architecture changes?
• Which domains and user principal name formats are standard?
• How are administrative roles assigned, activated and reviewed?
• How are applications approved, registered and consented?
• How are guests, contractors and partner organisations governed?
• Which logs are retained and forwarded to security operations?

Use least-privilege roles rather than assigning Global Administrator for convenience. Separate everyday user accounts from privileged administration accounts, and maintain two dedicated emergency access accounts.

User and group lifecycle

Identity lifecycle management begins before the account is created. Define authoritative data sources, naming standards, required attributes, manager relationships, licence rules, group membership and access approval. A good joiner, mover and leaver process ensures that access follows the person's role rather than accumulating indefinitely.

Groups and dynamic membership

Use groups to assign licences, applications and policy wherever practical. Dynamic groups can reduce manual administration when reliable attributes are available, but their rules should be documented and monitored. Avoid reusing one group for unrelated purposes because a future membership change may create unexpected access or policy impact.

Authentication strategy

Passwords remain common, but they should not be the only factor protecting important resources. Microsoft Entra supports a range of methods including Microsoft Authenticator, passkeys and FIDO2 security keys, Windows Hello for Business, certificate-based authentication, temporary access passes and OATH tokens.

Choose methods according to user needs, device availability, security risk and recovery requirements. Administrators and high-risk users should use phishing-resistant methods. Temporary Access Pass can support secure onboarding and recovery without relying on a weak initial password.

MFA and self-service password reset

Enforce multifactor authentication through Conditional Access rather than relying on per-user MFA settings. Conditional Access allows the requirement to reflect user role, application sensitivity, device state, location and risk. Protect authentication method registration so an attacker with a stolen password cannot easily register their own method.

Self-service password reset reduces support demand and gives users a controlled recovery path. In hybrid identity environments, password writeback can allow a cloud-initiated reset to update the on-premises directory when properly licensed and configured. Align SSPR methods with the authentication methods policy and define a helpdesk process for users who lose every registered method.

Hybrid identity

Hybrid identity connects on-premises Active Directory with Microsoft Entra ID. Common authentication approaches include password hash synchronisation, pass-through authentication and federation. Password hash synchronisation is often the simplest and most resilient option because cloud authentication can continue without a real-time dependency on on-premises agents.

Microsoft Entra Cloud Sync and Microsoft Entra Connect Sync can synchronise users and groups. The correct choice depends on topology, attribute requirements, writeback needs and existing architecture. Whichever tool is used, protect synchronisation servers or agents, document filtering and transformation rules, monitor health and avoid unsupported manual changes to synchronised attributes.

Enterprise applications and application registrations

Enterprise applications represent service principals used in the tenant. Application registrations define applications that your organisation develops or integrates. Both can hold permissions and become powerful access paths, so application governance is a core identity security responsibility.

Use single sign-on where possible and automate provisioning through standards such as SCIM. Assign applications to groups, establish an application owner and periodically review sign-in activity and permissions. User consent should be controlled so individuals cannot grant high-impact permissions to unverified applications without review.

Application governance checklist

Device identities

Devices can be Microsoft Entra registered, Microsoft Entra joined or Microsoft Entra hybrid joined. The appropriate state depends on ownership, operating model and whether on-premises domain dependence remains. Device identity provides a signal that Conditional Access can combine with Microsoft Intune compliance.

Cloud-native join is usually simpler for new devices where applications and operations no longer require traditional domain join. Hybrid join can be a useful transition, but it should not become a permanent default without reviewing the dependencies that make it necessary.

Conditional Access and identity protection

Conditional Access uses identity, application, device, location, client and risk signals to enforce access requirements. Establish emergency access accounts, block legacy authentication, protect administrators, require MFA and add device or authentication strength controls according to application sensitivity.

Microsoft Entra ID Protection detects risky users and risky sign-ins. With Microsoft Entra ID P2, these signals can trigger automated Conditional Access decisions such as requiring secure password change, strong authentication or blocking access. Security teams should investigate risk events rather than treating automation as a complete substitute for response.

Privileged access management

Administrative access should be limited in number, separate from normal productivity accounts and protected with stronger authentication. Microsoft Entra Privileged Identity Management can make eligible role assignments activate only when needed, with approval, MFA, justification, time limits and notifications.

Review permanent assignments, eliminate unnecessary Global Administrators and use task-specific roles. Protect privileged accounts with phishing-resistant authentication and, where practical, require access from managed privileged workstations. Monitor role activation, role changes, application consent and emergency account activity.

Identity Governance

Microsoft Entra ID Governance capabilities help manage access packages, entitlement lifecycles, access reviews, lifecycle workflows and privileged access. Entitlement management can bundle groups, applications and SharePoint sites into access packages with request, approval, expiry and review policies.

Access reviews are valuable for guests, privileged roles and high-impact application groups. Reviews need accountable reviewers, useful context and a default action for non-response. A review that repeatedly approves all access without evidence creates administration without meaningful governance.

External identities and collaboration

Microsoft Entra External ID supports business collaboration with guests and external organisations. Define who may invite guests, which domains are allowed or restricted, how cross-tenant trust is configured and how guest access expires. Require a sponsor or owner for external users and review guests that have no recent sign-in or no continuing business purpose.

Cross-tenant access settings can govern inbound and outbound collaboration and determine whether MFA or device claims from another tenant are trusted. Trust should be deliberate and limited to organisations whose controls are understood.

Monitoring, logs and security operations

Microsoft Entra produces sign-in logs, audit logs, provisioning logs and risk information. Define who reviews these records, how long they are retained and whether they are exported to a SIEM or Log Analytics workspace. Alert on privileged role changes, emergency account activity, risky sign-ins, impossible or unusual travel, application consent, credential additions and repeated authentication failures.

Operational dashboards should also track stale accounts, inactive guests, unused applications, expiring credentials, failed provisioning, synchronisation health and authentication method registration. These indicators reveal governance problems before they become incidents.

Common Entra ID mistakes

Microsoft Entra ID deployment roadmap

Microsoft Entra ID checklist

Frequently asked questions