Browse and query Microsoft Entra ID
What it is
Microsoft Entra ID is the directory where an administrator views and manages users, groups, devices, applications, roles, and tenant settings. In the Azure portal, directory tasks appear under Microsoft Entra ID; Azure resource access tasks appear under Access control (IAM) on a resource or scope.
Why it exists
An Azure administrator needs to distinguish an identity object from an Azure resource. Searching the directory answers questions such as “does this guest exist?” and “which groups contain this user?” It does not, by itself, prove that the identity can manage an Azure resource.
Practical route
- In the portal, open Microsoft Entra ID and use the appropriate blade: Users, Groups, Enterprise applications, Devices, or Roles and administrators.
- Filter by display name, user principal name, object ID, or relevant object property.
- Record the immutable object ID when investigating an ambiguous display name.
- For Azure-resource access, separately inspect the applicable Azure RBAC role assignments at the relevant scope.
Common confusion
Entra role assignments govern directory administration. Azure RBAC role assignments govern actions on Azure resources. A user can appear correctly in the directory yet still have no resource permission.
Related
entraid · user-account · groups · azure-ad-roles · rbac