Microsoft Entra ID (Azure AD): Cloud Identity & Access

Q: Is Entra ID the same as Azure AD?

Yes — Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023. Same service, new name (part of the broader "Entra" identity product family). Documentation, tooling, and community content use both names during the transition; they refer to the identical platform.

Q: How does Entra ID relate to AWS IAM?

For Azure resource access, Entra ID + Azure RBAC + managed identities play the role AWS IAM plays on AWS (who can manage what, credential-free workload access). But Entra ID is much broader — it's also the workforce identity provider for Microsoft 365 and SaaS SSO, customer identity (B2C), and application authentication. IAM is scoped to AWS resource access; Entra ID spans an organization's entire identity landscape.

Q: How do my applications use Entra ID for login?

Create an app registration and integrate via OAuth 2.0 / OpenID Connect (using MSAL libraries / the Microsoft Identity Platform). Your app then offers "Sign in with Microsoft" / organizational login, delegating authentication to Entra ID. It's OAuth/OIDC integration tied into the Microsoft ecosystem — giving your users SSO with their work accounts.

Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory / Azure AD) is Microsoft's cloud identity and access management platform — the identity backbone behind Microsoft 365, Azure, and thousands of integrated applications. It's who-you-are and what-you-can-access for the entire Microsoft ecosystem: when you sign into Office, Teams, or the Azure portal, Entra ID authenticates you; when an app grants your company SSO, Entra ID is often the identity provider.

For any organization on Microsoft, Entra ID is foundational infrastructure — it governs employee sign-in, enforces MFA and conditional access, federates SSO to SaaS apps, and secures access to Azure resources. It's Azure's answer to identity, comparable in role to AWS IAM for cloud-resource access but far broader, spanning workforce identity, customer identity, and application authentication across the whole Microsoft world.

TL;DR

Entra ID (formerly Azure AD) is Microsoft's cloud identity provider — authentication and authorization for Microsoft 365, Azure, and integrated apps.
A tenant is an organization's dedicated identity instance, holding users, groups, and app registrations.
It provides SSO (via OIDC/SAML) to thousands of SaaS apps, enforces MFA, and applies conditional access policies (context-aware access rules) — the practical engine of zero trust for Microsoft shops.
App registrations let your applications use Entra ID for login (OAuth/OIDC); managed identities let Azure resources authenticate to each other without stored credentials.
It secures Azure resource access via Azure RBAC (role assignments scoped to subscriptions/resource groups/resources).
≠ the older on-prem Active Directory (Windows domain controllers); Entra ID is cloud identity, though the two integrate (hybrid identity).

Core Concepts

Tenants, Users, and Groups

A tenant is your organization's dedicated, isolated instance of Entra ID (identified by a domain like contoso.onmicrosoft.com). It holds all your identities and app configurations.
Users are identities (employees, guests). Groups collect users for assigning access and licenses at scale (assign a policy or app to a group, not each user).
Guest access (B2B) invites external users into your tenant with controlled access; Entra External ID (B2C) handles customer/consumer identity for your apps.

SSO, MFA, and Conditional Access

Entra ID is the practical identity control plane for Microsoft organizations:

Single Sign-On — users authenticate once to Entra ID and access Microsoft 365 plus thousands of pre-integrated SaaS apps (Salesforce, Slack, etc.) via SAML/OIDC, without separate passwords.
Multi-Factor Authentication — enforce MFA (Microsoft Authenticator, passkeys, etc.), ideally passwordless/phishing-resistant.
Conditional Access — the powerful policy engine: grant/block/challenge access based on context — user, device compliance, location, risk level, app. "Require MFA from outside the corporate network," "block legacy auth," "require a compliant device for finance apps." This is zero trust in practice — access decisions per-request, based on identity + device + context, not network location.

App Registrations: Auth for Your Apps

To let your own application authenticate users with Entra ID, you create an app registration — configuring OAuth 2.0 / OpenID Connect, redirect URIs, and API permissions. Your app then uses Entra ID as its identity provider (the "Sign in with Microsoft" / organizational login). The Microsoft Identity Platform (with MSAL libraries) is the developer surface for building this — the equivalent of integrating any OAuth/OIDC provider, tied into the Microsoft ecosystem.

Securing Azure Resources: RBAC and Managed Identities

For Azure resource access specifically, Entra ID underpins Azure RBAC — role assignments (Owner, Contributor, Reader, or custom roles) scoped to a subscription, resource group, or individual resource. This is the AWS IAM-equivalent for controlling who can manage what in Azure.

Managed identities are the key security feature for workloads: an Azure resource (VM, Function, AKS pod) gets its own Entra identity and accesses other Azure services (Key Vault, storage, databases) without stored credentials. The equivalent of AWS IAM roles — no access keys to leak.

Entra ID vs Active Directory

A common confusion: Active Directory (AD) is the traditional on-premises Windows identity system (domain controllers, LDAP, Kerberos, group policy). Entra ID is cloud identity (modern protocols: OAuth/OIDC/SAML, internet-facing). They're different systems that integrate — hybrid identity syncs on-prem AD to Entra ID (via Entra Connect) so users have one identity across both. Entra ID is not "AD in the cloud"; it's a cloud-native identity platform.

Common Mistakes

Confusing Entra ID with On-Prem Active Directory

They're distinct: Entra ID is cloud identity (modern web auth), AD is on-prem Windows domains (LDAP/Kerberos). Assuming Entra ID works like AD (or vice versa) causes design errors. They integrate via hybrid sync, but you must understand which system you're configuring for what.

Weak or SMS-Only MFA

Enabling only SMS-based MFA leaves users vulnerable to SIM-swap and real-time phishing. Push toward phishing-resistant methods — Microsoft Authenticator with number matching, passkeys/WebAuthn — especially for admins. Entra ID supports strong methods; use them.

Not Using Conditional Access

Entra ID's conditional access is its most powerful control, and leaving everything at "just a password" wastes it. Enforce MFA, block legacy authentication protocols (a major attack vector), require compliant devices for sensitive apps, and apply risk-based policies. This is the zero-trust core.

Storing Credentials Instead of Using Managed Identities

Embedding access keys or connection strings in VMs/Functions/apps to reach Azure resources is a leak risk. Use managed identities so resources authenticate via their Entra identity with no stored secrets. It's the correct, credential-free pattern (like AWS IAM roles).

Over-Privileged Role Assignments

Granting Owner/Contributor broadly across subscriptions violates least privilege — a compromised account then controls everything. Scope Azure RBAC roles tightly (least privilege, resource-group or resource scope), use Privileged Identity Management (PIM) for just-in-time elevation of admin roles, and review assignments. Same discipline as AWS IAM.

FAQ

Is Entra ID the same as Azure AD?

Yes — Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023. Same service, new name (part of the broader "Entra" identity product family). Documentation, tooling, and community content use both names during the transition; they refer to the identical platform.

How does Entra ID relate to AWS IAM?

For Azure resource access, Entra ID + Azure RBAC + managed identities play the role AWS IAM plays on AWS (who can manage what, credential-free workload access). But Entra ID is much broader — it's also the workforce identity provider for Microsoft 365 and SaaS SSO, customer identity (B2C), and application authentication. IAM is scoped to AWS resource access; Entra ID spans an organization's entire identity landscape.

What is conditional access?

Entra ID's policy engine that makes access decisions based on context — who the user is, whether their device is compliant, their location, sign-in risk, and which app they're accessing — then grants, blocks, or challenges (e.g., requires MFA). It's how organizations implement zero trust: access isn't granted by network position but by verified identity + device + context, per request.

How do my applications use Entra ID for login?

Create an app registration and integrate via OAuth 2.0 / OpenID Connect (using MSAL libraries / the Microsoft Identity Platform). Your app then offers "Sign in with Microsoft" / organizational login, delegating authentication to Entra ID. It's OAuth/OIDC integration tied into the Microsoft ecosystem — giving your users SSO with their work accounts.

What are managed identities?

An Entra ID identity automatically assigned to an Azure resource (VM, Function, AKS workload) so it can authenticate to other Azure services (Key Vault, storage, SQL) without any stored credentials. Azure manages the identity's lifecycle and credentials. It's the Azure equivalent of AWS IAM roles — the secure, keyless way for workloads to access resources.