Microsoft Entra ID
Also known as: Entra ID, Azure Active Directory, Azure AD
Microsoft Entra ID, known until 2023 as Azure Active Directory (Azure AD), is Microsoft's cloud-based identity and access service.
It stores user accounts, passwords, groups, and devices for Microsoft 365, and controls who can sign in to email, Teams, SharePoint, and thousands of connected apps. It provides single sign-on, multi-factor authentication, and access policies. While most small businesses use Entra ID without realizing it, it's effectively the front door to the whole company, so securing it is one of the most important IT jobs.
Microsoft Entra ID, explained at three levels
At home
Entra ID works like the reception desk of a large office building. Everyone checks in there once, shows ID, and gets a keycard that opens only the rooms they're allowed into. Entra ID does the same online: it confirms who you are with your password and phone, then hands each work app a digital pass saying what you may open.
At work
Microsoft Entra ID is the master list of everyone who works at a company that uses Microsoft 365. It holds each person's account, password, groups and devices, and every connected app checks with it before letting someone in. That makes it the single place IT adds new staff, removes leavers and turns on MFA, and the first place attackers aim for.
At home
Entra ID is the front door for your work account. When you sign in to Outlook, Teams or another connected app, the app sends you to Entra ID, which checks your password, your MFA and the device you are using. If everything passes, Entra ID gives the app a signed token saying who you are and what you may access. Apps trust that token, so one sign-in can open many services, which is called single sign-on.
At work
Entra ID holds users, groups, devices and app registrations for a Microsoft 365 tenant, and issues tokens using standards such as OAuth 2.0, OpenID Connect and SAML, so thousands of third-party apps can use it. Licences come in Free, P1 and P2 tiers: P1, included in Microsoft 365 Business Premium, adds Conditional Access, while P2 adds risk-based policies and Privileged Identity Management. Entra Connect or Cloud Sync links accounts with an on-premises Active Directory.
At home
Because one Entra ID account unlocks email, files, Teams and many other apps, attackers target it more than any single app. If someone gets your password, the MFA prompt on your phone may be the only thing standing between them and everything you can access. That is why an unexpected approval request matters so much. In my view, that prompt is often the only warning before an account is taken over, so deny it and tell IT right away.
At work
Most tenant compromises start with identity, so prioritize phishing-resistant MFA for administrators, block legacy authentication, and restrict who can consent to third-party apps, since illicit OAuth grants survive password resets. Review admin roles and use Privileged Identity Management for just-in-time elevation where licensed. Monitor risky sign-ins and audit logs, maintain break-glass accounts, and clean up stale users, guests, unused app registrations and forgotten test tenants. Tools such as Microsoft Secure Score and CISA's ScubaGear help baseline settings.
Real-world examples
At home
Sophie started a new job and signed in to Outlook, Teams, and the company's HR app with the same work account, all managed through Entra ID.
At work
Marcus runs IT for a Calgary engineering firm. He used Entra ID to require MFA for everyone and to block sign-ins from outdated email apps.
How it compares
| feature | Microsoft Entra ID | Active Directory |
|---|---|---|
| Location | Cloud | On-premises servers |
| Main use | Microsoft 365 and cloud apps | Office networks and Windows domains |
| Sign-in methods | Web, MFA, passkeys | Domain logins |
| Management | Admin portals | Domain controllers |
Active Directory runs office networks. Entra ID runs cloud identity.
For analysts
In any Microsoft 365 assessment, I'd start with Entra ID: MFA coverage, admin accounts, and stale users. That's where most small business compromises begin.
History & origin
Microsoft released Active Directory with Windows 2000 Server, and it became the standard way businesses managed office networks. As Office 365 launched in 2011, Microsoft built a cloud directory, Windows Azure Active Directory, that became generally available in 2013. Over the following decade, it added conditional access, passwordless sign-in, and identity protection. Microsoft renamed it Microsoft Entra ID in July 2023, although features and prices stayed the same. High-profile attacks, including a breach of Microsoft's own systems, disclosed in 2024, that began with a password-spraying attack on an old test account without MFA, showed how central identity security had become. In my view, Entra ID is now more important to a small business than its office firewall.