Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. It manages identities for users, devices, applications, and services — the foundation of Zero Trust architecture.

Free / P1 / P2 Zero Trust SSO MFA Identity

📋 Overview & Editions

🆔 Identity Management

Central management for users, groups, devices, and service accounts.

🔑 Authentication

MFA, Passwordless, SSPR, Smart Lockout, Phishing-resistant credentials.

📜 Authorization

Conditional Access, RBAC, App Permissions, PIM for JIT access.

🔗 Application Integration

SSO for 3,000+ pre-integrated SaaS apps, plus custom app registration.

Editions Comparison

Feature	Free	P1	P2
MFA (per-user)	✅	✅	✅
Conditional Access	❌	✅	✅
SSPR	❌	✅	✅
Identity Protection (Risk)	❌	❌	✅
PIM (JIT)	❌	❌	✅
Access Reviews	❌	❌	✅

👥 Identity Types

entra.microsoft.com › Users › All users

Home

Identity

Users → All users

Groups

Devices

Applications

All users (1,247 users)

Display name	User principal name	User type	Status
Alice Johnson	alice.johnson@contoso.com	Member	Active
Bob Smith	bob.smith@contoso.com	Member	Active
Carol Partner (Fabrikam)	carol@fabrikam.com	Guest	Active
Dave (Former Employee)	dave.old@contoso.com	Member	Disabled

💡 Filter by "Guest" to audit all external users. Review quarterly.

📸 Entra ID All Users — identify Guest accounts and disabled accounts

Type	Description	Notes
Member Users	Internal employees	Created in your tenant
Guest Users (B2B)	External partners, vendors	Invited via B2B collaboration
Service Principals	Application identities	Used by apps and services
Managed Identities	Auto-managed service identity for Azure resources	No credentials to manage
Device Identities	Azure AD Joined / Registered / Hybrid Joined devices	Used in Device Compliance CA

🔐 Authentication Methods

Method	Phishing Resistant?	Strength
Windows Hello for Business	✅ Yes	Highest
FIDO2 Security Key	✅ Yes	Highest
Microsoft Authenticator (Passkey)	✅ Yes	High
Certificate-Based Auth (CBA)	✅ Yes	High
Microsoft Authenticator (Number Match)	⚠️ Partial	Medium-High
TOTP (Authenticator App code)	❌ No	Medium
SMS / Voice OTP	❌ No	Low
Password only	❌ No	Weakest

🔄 Self-Service Password Reset (SSPR)

SSPR allows users to reset their own passwords without calling the helpdesk. Reduces IT support load and improves security by reducing phone-based social engineering attacks.

Require 2 authentication methods for reset
Methods: Authenticator App, Email, Phone, Security Questions
Enable SSPR Writeback for hybrid environments (syncs back to on-premises AD)
Monitor SSPR Activity in the Entra admin center

ℹ️

Pilot first. Enable SSPR for a pilot group before rolling out org-wide. Monitor for unexpected lockouts during the first week.

📜 Conditional Access

Conditional Access is the Zero Trust policy engine. It evaluates signals (user, device, location, app, risk) and enforces controls (Allow, Block, Require MFA, Require Compliant Device).

// Example: Block Legacy Authentication
Name: "Block Legacy Authentication"
  Users: All Users
  Cloud Apps: All Apps
  Conditions:
    Client Apps: Exchange ActiveSync clients, Other clients (legacy)
  Grant: Block Access

⚠️

Always test in Report-Only mode first. Enable a policy in Report-Only for at least 7 days and review the impact before switching to Enforce mode.

🔗 Hybrid Identity

Sync Method	Description	Recommendation
Password Hash Sync (PHS)	Hash of hash synced to Entra ID	✅ Recommended — simplest + most resilient
Pass-Through Auth (PTA)	On-premises AD validates passwords in real-time	Use when PHS is not allowed by policy
Federation (ADFS)	External STS (ADFS) handles authentication	⚠️ Avoid — complex, single point of failure

📦 App Registration vs Enterprise Application

Concept	Description
App Registration	Application definition — client ID, permissions, redirect URIs
Enterprise Application (Service Principal)	Instance of the app in your tenant — where you assign users/groups
API Permissions	Delegated (user context) vs Application (daemon/service)
Admin Consent	Org-wide consent for an application's permissions

🎭 Key Entra ID Roles

Role	Permissions	Risk
Global Administrator	Full tenant control	🔴 Critical — maximum 5 accounts
Privileged Role Administrator	Manage role assignments and PIM	🔴 Critical
Security Administrator	Manage security policies and alerts	🟠 High
User Administrator	Create/manage users and groups	🟡 Medium
Application Administrator	Register and manage apps	🟠 High
Conditional Access Administrator	Manage CA policies	🟠 High

🔎 KQL Queries

Sign-ins by Country

SigninLogs
| where TimeGenerated > ago(7d)
| summarize SignIns = count() by tostring(LocationDetails.countryOrRegion)
| order by SignIns desc
| take 20

MFA Usage Report

SigninLogs
| where TimeGenerated > ago(30d)
| summarize
    Total = count(),
    WithMFA = countif(AuthenticationRequirement == "multiFactorAuthentication"),
    WithoutMFA = countif(AuthenticationRequirement == "singleFactorAuthentication")
  by UserPrincipalName
| extend MFARate = round(100.0 * WithMFA / Total, 1)
| where Total > 5
| order by MFARate asc

Risky Sign-ins (Identity Protection)

AADRiskyUsers
| where RiskLevel in ("high", "medium")
| where RiskState == "atRisk"
| project UserPrincipalName, RiskLevel, RiskDetail, RiskLastUpdatedDateTime
| order by RiskLastUpdatedDateTime desc

Microsoft Entra ID — Complete Guide