Microsoft Entra ID is Microsoft's cloud identity and access management service, formerly Azure Active Directory. It manages users, groups, devices, applications, workload identities and access to Microsoft and third-party services. Despite shared terminology, it is not classic Active Directory moved to the cloud.
Entra ID and Active Directory compared
| Area | Active Directory | Entra ID |
|---|---|---|
| Focus | Windows domain, devices, Kerberos/NTLM, LDAP and Group Policy. | Cloud identities, OAuth/OIDC/SAML, SaaS and API access. |
| Boundary | Domains and forests. | Tenant, app registrations, service principals and external identities. |
| Devices | Domain Join and GPO. | Entra Join/Registration, device state and MDM signals. |
| Hybrid | Synchronization and federation connect both worlds and create additional paths. | |
What does Conditional Access do?
Conditional Access evaluates user, target resource, device, location, risk and authentication strength. Policies can block, demand MFA, require a managed device or force fresh authentication. It is a policy engine rather than standalone protection: exclusions, uncovered protocols and incomplete targeting create gaps.
Common security problems
- Excess privilege:
Permanent Global Admin and no separation of daily accounts. - Incomplete policies:
Service principals, guests, legacy auth or apps remain outside. - App consent:
Overprivileged applications retain broad data tokens. - Workload identity:
Long-lived client secrets and excessive API rights. - Hybrid identity:
Sync and federation bridge cloud and on-premises attack paths.
Practical baseline
- - Keep and test two monitored emergency accounts separated from daily admin.
- - Require phishing-resistant MFA for privilege and block legacy authentication.
- - Time-limit roles, review access and use separate administrative identities.
- - Govern consent and app permissions; remove unused principals and credentials.
- - Centralize sign-in, audit and risk events and test alerts.
- - Validate Conditional Access changes in report-only mode before blocking.
Useful open-source tools
ROADtools collects and analyzes tenant objects for authorized review. Monkey365 reviews Microsoft 365/Azure/Entra configuration and Maester turns baselines into executable tests. Exports contain sensitive identity and privilege data and need strict handling and manual review of intended exceptions.
Thank you for your feedback! We will review it and optimize this content.
Do you have feedback on Microsoft Entra ID? Tell us!
Additional Services
Comprehensive IT security solutions for complete protection
Red Teaming
Simulation of real attacks on your company including people, infrastructure and processes. A comprehensive approach to testing your entire security strategy.
Learn more
Phishing Exercises
Practical phishing simulations to raise employee awareness. Increase awareness and reduce the risk of successful email-based attacks.
Learn more