Capabilities of Microsoft Entra · Topic 1 of 4
Entra ID and Identity Types
SC-900 Microsoft Entra ID: what it does, Free, P1, P2 and Governance editions, user, workload, device and external identities, and hybrid identity.
- 6 min
- Microsoft Entra ID is the cloud identity and access service, formerly Azure Active Directory.
- Editions are Free, P1, P2 and the ID Governance add on.
- Identity types are user, workload, device and external.
What it is
Microsoft Entra is the family name for Microsoft's identity and access products. Its core is Microsoft Entra ID, a cloud identity and access management service that was formerly called Azure Active Directory. It signs people in to Microsoft 365, Azure and thousands of other applications, and it controls what they can reach.
Entra ID holds the identities, checks them when they sign in, and issues the tokens that applications trust.
How it works
What Entra ID does
- Authenticates users, devices and applications.
- Provides single sign on to cloud and on premises apps with one set of credentials.
- Controls access with Conditional Access and roles.
- Protects identities with multifactor authentication and risk detection.
- Manages the identity lifecycle with governance tools.
It is not a copy of Active Directory in the cloud. It uses web based protocols and a flat structure of users, groups and applications, rather than domains, forests and organizational units.
Editions
| Edition | What it adds |
|---|---|
| Free | The core directory, users and groups, single sign on and basic security |
| P1 | Conditional Access, dynamic groups and hybrid features |
| P2 | Everything in P1, plus Identity Protection and Privileged Identity Management |
| ID Governance | An add on for access packages, access reviews and lifecycle automation |
Types of identity
Entra ID manages more than people.
| Identity type | What it represents | Example |
|---|---|---|
| User | A person with an account in the tenant, including guests | An employee or a partner |
| Workload identity | An application or service that needs to reach resources | A web app, a script or a managed identity |
| Device identity | A computer or phone known to the tenant | A company laptop |
| External identity | A person outside the organisation, such as a partner or customer | A supplier who signs in with their own account |
Workload identities let software sign in without a person. They include applications and service principals, and managed identities, which Azure creates and manages for a resource so that no password has to be stored in code.
Devices can be registered, joined or hybrid joined. A registered device is a personal device that the user adds. A joined device belongs to the organisation and is joined to Entra ID. A hybrid joined device is joined to both on premises Active Directory and Entra ID.
External identities let partners and customers use their own accounts to reach your resources, which is called business to business collaboration, or sign in to your apps as customers.
Hybrid identity
Most organisations still have an on premises Active Directory, so they use hybrid identity: one identity that works for both on premises and cloud resources. The directory objects are synchronised to Entra ID, usually with Microsoft Entra Connect or Entra Cloud Sync. Users then sign in with the same account everywhere.
There are three ways to check a password in a hybrid setup.
| Method | How passwords are checked |
|---|---|
| Password hash synchronisation | A hash of the password hash is synchronised to the cloud and checked there |
| Pass through authentication | The sign in is passed to an on premises agent for checking |
| Federation | A trusted on premises service, such as AD FS, performs the check |
A worked scenario
A company with an on premises Active Directory moves email to Microsoft 365. It installs Microsoft Entra Connect, which synchronises its users to Entra ID, so staff keep their usual sign in and gain single sign on to cloud apps. An Azure web app needs to read a database without a stored password, so the team gives it a managed identity. A supplier's staff need access to a shared site and are invited as guests with their own accounts.
Tenants and groups
A tenant is your organisation's dedicated instance of Microsoft Entra ID, which holds its users, groups and apps. Users can be organised into groups to manage access in bulk. A security group gives access to resources, and a Microsoft 365 group adds a shared mailbox, calendar and files. Membership can be assigned by hand, or it can be dynamic, where rules such as "department equals Sales" add and remove people automatically, which needs P1.
Other products in the Entra family
| Product | What it does |
|---|---|
| Microsoft Entra ID | Core cloud identity and access management |
| Microsoft Entra External ID | Sign in and access for customers and partners outside the organisation |
| Microsoft Entra Verified ID | Issues and checks digital credentials, such as proof of employment |
| Microsoft Entra Domain Services | Managed domain join, LDAP and Kerberos in Azure, with no domain controllers to run |
| Microsoft Entra ID Governance | Access packages, access reviews and lifecycle workflows |
| Microsoft Entra ID Protection | Detects and responds to risky users and sign ins |
| Microsoft Entra Privileged Identity Management | Just in time, time bound privileged roles |
Single sign on in practice
With single sign on, a user signs in once to Entra ID in the morning and then opens Outlook, Teams and a third party app without typing a password again. Applications are registered in Entra ID, which issues tokens that those apps trust. This saves time and lowers the number of passwords that users can forget, reuse or have stolen.
What to remember for the exam
- Microsoft Entra ID is the cloud identity and access service, formerly Azure Active Directory.
- Editions are Free, P1, P2 and the ID Governance add on.
- Identity types are user, workload, device and external.
- Managed identities are workload identities that Azure manages, with no password to store.
- Hybrid identity synchronises on premises accounts to the cloud, often with Entra Connect.
A question that asks for an identity for software, not a person, is a workload identity. A managed identity is the answer when no stored secret is wanted.
How the exam asks about this
- "Entra ID was formerly known as?" Azure Active Directory.
- "An application needs to access Azure resources without credentials in code." A managed identity.
- "Sign in to on premises and cloud resources with one account." Hybrid identity.
- "Which tool synchronises on premises directory objects to the cloud?" Microsoft Entra Connect.
Common mistakes
Treating Entra ID as Windows Server Active Directory. It is a different, cloud based service with a different structure.
Forgetting that apps have identities too. Workload identities are separate from users.
Confusing registered and joined devices. Registered is personal. Joined is organisation owned.
Assuming guests need new accounts. External identities can use their own existing accounts.
Check yourself
What was Microsoft Entra ID called before?
Azure Active Directory.
What is a managed identity?
A workload identity that Azure creates and manages for a resource, so no secret is stored in code.
What does Microsoft Entra Connect do?
It synchronises on premises directory objects to Microsoft Entra ID.
Topic 1 of 4 in Capabilities of Microsoft Entra
Test yourself on Capabilities of Microsoft Entra
The full Microsoft SC-900 question bank has 503 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.