Microsoft Entra ID (formerly Azure Active Directory)
What it is
Microsoft Entra ID is Microsoft’s cloud-based identity and access-management service. It stores identities such as people, groups, devices, and applications; verifies a sign-in (authentication, “who are you?”); and can enforce sign-in policies. It was formerly called Azure Active Directory (Azure AD).
Why it exists
An organization needs one place to recognize its people and workloads across Azure, Microsoft 365, and connected apps—without running cloud domain controllers. An Entra tenant is that organization’s isolated directory.
Key ideas
- Tenant: the isolated Entra directory for an organization. An Azure subscription trusts one tenant for identity.
- Directory objects: users, groups, devices, applications, service principals, and managed identities.
- Single sign-on (SSO): after a successful Entra sign-in, connected applications can reuse that identity experience instead of each asking for a separate password.
- Policy is contextual: Conditional Access can require controls such as MFA based on the sign-in and policy conditions.
- Not a domain controller: Entra ID can join and manage modern devices, but it is not Windows Server AD DS. A legacy workload needing LDAP, Kerberos/NTLM, or Group Policy needs AD DS-compatible services.
Components relevant to AZ-104
- Users & groups
- Service principals & managed identities (how apps authenticate)
- MFA, SSPR, Conditional Access
- Microsoft Entra roles
- App registrations / Enterprise apps
Relationship to RBAC
Azure RBAC authorizes access to Azure resources. Entra ID supplies the identity RBAC evaluates. Entra also has directory roles for managing Entra objects. In short: Entra helps establish who or what is asking; the assigned role and scope decide what that identity may do.
Northwind example
Maya creates an Entra group named Northwind-Platform-Admins, then assigns that group an Azure role at the appropriate scope. When Luis joins the platform team, Maya adds him to the group instead of making several separate role assignments. A Conditional Access policy asks Luis for MFA when its conditions require it. The group is not the resource permission by itself—it is a convenient way to give the same assignment to the right people.
Diagram
Diagrams courtesy of Microsoft Learn / Azure docs: entra/identity/entra-overview
Exam notes
- Entra ID = cloud identity, authentication, and policy layer. Azure RBAC = Azure-resource authorization layer.
- Rebranded from Azure AD in 2023; the exam may still reference “Azure AD” — same thing.
- A tenant = the container for identities; a subscription = a container for resources that trusts a tenant.
Related
rbac · user-account · service-principal · mfa · conditional-access · tenant
📘 Sources: Microsoft Learn — What is Microsoft Entra? and Azure AD naming change.