Microsoft Entra ID (formerly Azure Active Directory)
What it is
Microsoft Entra ID is the cloud identity service that provides authentication (who are you?) and the directory that grants authorization authority for users, groups, and applications accessing Azure and Microsoft 365. It’s the modern rebrand of Azure Active Directory (Azure AD).
Why it exists
On-premises you had Active Directory Domain Services (AD DS) in a domain you control. Azure is a multi-tenant cloud you don’t fully control, so you need a tenant-scoped, managed directory that stores identities and decides access — without you running a domain controller.
Key ideas
- Tenant — an isolated dedicated instance of Entra ID representing one org. Every Azure subscription is trusted by a tenant.
- Directory objects — users, groups, service principals (the “identity” of apps/services), managed identities, devices.
- SSO — one sign-in works across Azure, M365, and third-party SaaS apps that trust the tenant.
- Behind the scenes — it is not AD DS: no Kerberos, no GPOs, no domain join. It’s a REST-based IDaaS.
Components relevant to AZ-104
- Users & groups
- Service principals & managed identities (how apps authenticate)
- MFA, SSPR, Conditional Access
- Microsoft Entra roles
- App registrations / Enterprise apps
Relationship to RBAC
RBAC authorizes resource access in Azure; Entra ID authorizes identity operations. They work together: Entra ID says who you are, RBAC says what you may do to this resource.
Diagram
Diagrams courtesy of Microsoft Learn / Azure docs: entra/identity/entra-overview
Exam notes
- Entra ID = identity/authN layer. RBAC = resource authZ layer.
- Rebranded from Azure AD in 2023; the exam may still reference “Azure AD” — same thing.
- A tenant = the container for identities; a subscription = a container for resources that trusts a tenant.
Related
rbac · user-account · service-principal · mfa · conditional-access · tenant
📘 Source: Microsoft Learn — Entraid