Microsoft Entra ID
Also known as: Entra ID, Azure Active Directory, Azure AD, AAD
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
What is Microsoft Entra ID?
Microsoft Entra ID is Microsoft's cloud identity and access-management service for users, applications, devices and workloads. This profile connects the concept to KBY's practical engineering guidance.
It is the identity plane behind Microsoft 365 and Azure and supports federation, OAuth, OpenID Connect, Conditional Access and lifecycle management. It is not a hosted Active Directory domain, although organisations commonly integrate the two.
Authenticate cloud identities and govern their access to applications and resources.
- Cloud identity management
- Single sign-on (SSO)
- Conditional Access policies
Explore related technologies
Sub-technologies
Related technologies
17 resources for Microsoft Entra ID
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Learn and operate with Microsoft Entra ID
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Lexicon Definitions(1)
Start here: understand the core vocabulary.
Graduate Learning(11)
Build practical knowledge and hands-on skills.
- A Practical First Workflow for Identity and Access with Entra IDOpen
- Learning Identity and Access Through a Safe Entra ID LabOpen
- Configuring Entra ID PIM for Just-in-Time Admin AccessOpen
- Configuring Entra ID Access Reviews for Privileged RolesOpen
- Setting Up Recurring Entra ID Access Reviews for GuestsOpen
- Decommissioning Windows Devices in Intune: Retire, Wipe, CleanupOpen
- Entra ID Temporary Access Pass for Zero-Touch OnboardingOpen
- Configuring Entra ID Cross-Tenant Access for B2B GuestsOpen
- Escrowing BitLocker Recovery Keys via Intune and Entra IDOpen
- Building a Governed AWS Landing Zone with Entra ID FederationOpen
- Group-Based Licensing in Microsoft Entra ID for M365Open
Ops Playbooks(3)
Operate, maintain and improve it in production.
Config Traps(2)
Recognise and avoid known failure modes.
- The Legacy Auth Exclusion Group Nobody PrunesA Conditional Access exclusion group created during the Basic Auth migration keeps growing long after the cutover finished, and every account inside it authenticates via IMAP, POP or SMTP AUTH with no MFA claim attached. Identity Protection never logs these sign-ins as blocked legacy auth, because the policy excludes them from evaluation entirely rather than denying access. Open
- The Client Apps Toggle That Bypasses Azure MFAWhen a Conditional Access MFA policy scopes Client apps to only Browser and Mobile apps and desktop clients, IMAP, POP3, SMTP AUTH and EAS sign-ins fall outside enforcement entirely. Legacy-protocol authentication succeeds with password alone, no challenge, no risk evaluation, enabling undetected password-spray campaigns against Exchange Online mailboxes. Open