Microsoft identity platform

What it is

The Microsoft identity platform is the protocol and service model applications use to sign users or workloads in and obtain tokens for protected resources. Microsoft Entra ID is the tenant identity provider; the platform describes how an app registration, authority, scopes, consent, and tokens fit together.

Prerequisites and mechanics

Understand HTTP, principals, tenants, authorization, and JSON claims. A client requests a token for a resource scope; the identity provider authenticates the caller and issues a token when the request and consent are allowed. The API validates the token and then authorizes the operation. A valid token proves an identity context; it does not automatically grant every API or Azure resource action.

Relationships, boundaries, and failure

Authentication establishes who acts; authorization decides what that principal may do. Entra issues identity/access tokens, while Azure RBAC authorizes Azure control-plane actions and Microsoft Graph permissions authorize Graph data access. A token-audience mismatch, missing consent, expired token, or missing downstream role produces a different failure and should be diagnosed separately.

Worked example and route

A web app signs in a user, requests an API scope, sends the bearer token to the API, and the API checks both token validity and the user’s application permission. This appears before Entra app authentication, Graph, Key Vault, and managed identity in AZ-204.

Re-audit

Re-open when supported protocols, token behavior, consent, or Entra integration changes. Sources checked 2026-08-31: Microsoft identity platform overview and authentication vs authorization.