Lesson 1 — What is Microsoft Entra?
Modern attacks often begin with identity rather than malware.
Microsoft Entra is Microsoft's family of identity and network access products. At the centre of that family is Microsoft Entra ID, the cloud identity platform used by Microsoft 365, Azure and thousands of connected applications.
This lesson introduces the Microsoft Entra family, explains how Entra ID manages users, groups, devices, applications and roles, and shows how authentication, Conditional Access and Zero Trust decisions fit together.
What you will learn
This lesson introduces the identity platform behind Microsoft 365, Azure and modern Microsoft security.
Learning objectives
After completing this lesson, you should be able to describe the role Microsoft Entra plays in modern identity security.
- Explain the Microsoft Entra product family.
- Describe Microsoft Entra ID and an Entra tenant.
- Recognise users, groups, devices, applications and roles.
- Differentiate authentication from authorisation.
- Explain how Conditional Access supports Zero Trust.
The problem this solves
Organisations need one trusted identity system that can control access to cloud applications, Microsoft 365, Azure resources and connected services.
Microsoft Entra provides the identity, access and policy controls used to verify users, evaluate conditions and grant only the access that should be allowed.
What is Microsoft Entra?
Microsoft Entra is a family of identity and network access products designed to support Zero Trust security.
The family includes Microsoft Entra ID, identity governance and protection capabilities, Verified ID, External ID, and Global Secure Access products such as Microsoft Entra Internet Access and Microsoft Entra Private Access.
This academy focuses primarily on Microsoft Entra ID because it is the identity platform behind authentication, access, applications, roles and Conditional Access.
What is Microsoft Entra ID?
Microsoft Entra ID is Microsoft's cloud-based identity and access management service.
It stores and manages identities and helps users sign in securely to Microsoft 365, Azure, SaaS applications and custom applications.
What is an Entra tenant?
A tenant is a dedicated instance of Microsoft Entra ID associated with an organisation.
It contains the organisation's identity objects, policies, applications, roles, devices and security settings.
Core identity objects
| Object | Purpose |
|---|---|
| User | Represents a person or workload identity that can authenticate and receive access. |
| Group | Collects users, devices or service principals so access and policy can be assigned efficiently. |
| Device | Represents a registered, joined or managed endpoint that can contribute security context. |
| Enterprise application | Represents an application's service principal inside the tenant and controls how users access it. |
| App registration | Defines an application's identity and authentication settings in the Microsoft identity platform. |
| Role | Grants administrative permissions to manage Entra resources and settings. |
Authentication
Authentication answers the question:
Who are you?
It can involve passwords, Microsoft Authenticator, passkeys, FIDO2 security keys, Windows Hello for Business or other approved methods.
Authorisation
Authorisation answers the question:
What are you allowed to do?
It is controlled by application assignments, roles, permissions, policies and resource access rules.
Authentication compared with authorisation
| Concept | Question | Example |
|---|---|---|
| Authentication | Can Microsoft verify the identity? | A user signs in with a password and passkey. |
| Authorisation | What access should the verified identity receive? | The user can read SharePoint files but cannot administer the tenant. |
How a sign-in decision works
Conditional Access
Conditional Access is Microsoft's Zero Trust policy engine.
It brings together signals such as user, application, device, location and risk, then enforces access decisions such as require MFA, require a compliant device or block access.
Zero Trust and identity
Zero Trust does not assume that a user, device or network location is automatically safe.
Access is continuously evaluated using identity, device, risk and application context.
Where Entra fits in Microsoft security
Why security analysts care
- Risky sign-ins may indicate stolen credentials.
- New MFA methods can indicate account takeover.
- Role assignments can indicate privilege escalation.
- OAuth consent can create persistent application access.
- Conditional Access failures can explain why access was blocked or allowed.
Identity is evidence
- Sign-in logs show authentication activity.
- Audit logs show directory changes.
- Risk detections show suspicious identity signals.
- Application logs show token and consent activity.
- PIM logs show privileged role activation.
Example identity investigation
Do not investigate a sign-in as a single event. Investigate the identity, device, application, policy decision and activity that followed.
Microsoft Entra ID and Active Directory
Microsoft Entra ID is not simply Active Directory hosted in the cloud.
Active Directory Domain Services uses traditional domain protocols and on-premises concepts, while Entra ID is designed for cloud identity, modern authentication, tokens, SaaS access and Zero Trust policy.
Hybrid identity
Many organisations use both Active Directory and Microsoft Entra ID.
Hybrid identity synchronises or provisions identities so users can access on-premises and cloud resources with connected identity controls.
Common mistakes
| Mistake | Why it creates risk | Better practice |
|---|---|---|
| Thinking Entra is only a user directory | Applications, roles, devices, risk and access policy are overlooked. | Treat Entra as the identity and access control plane. |
| Confusing authentication with authorisation | A successful sign-in may be mistaken for permission to perform every action. | Separate identity verification from access rights. |
| Assigning permanent high privilege | Compromised accounts retain powerful standing access. | Use least privilege and Privileged Identity Management. |
| Ignoring sign-in and audit logs | Identity attacks can remain invisible. | Monitor authentication, risk, application and directory changes. |
Key takeaways
- Microsoft Entra is a family of identity and network access products.
- Microsoft Entra ID is the cloud identity platform behind Microsoft 365 and Azure access.
- A tenant contains the organisation's identities, applications, devices, roles and policies.
- Authentication verifies identity; authorisation determines permitted access.
- Conditional Access combines signals to enforce Zero Trust decisions.
- Identity activity is a critical source of security evidence.
Related Agent Foskett resources
Continue learning
What is Microsoft Entra?
Microsoft Entra is a family of identity and network access products. Microsoft Entra ID provides cloud identity, authentication, application access, roles, devices and Conditional Access for Microsoft 365, Azure and connected applications.
Microsoft Entra Academy Lesson 1
This Agent Foskett Microsoft Entra Academy lesson explains Entra ID tenants, users, groups, devices, enterprise applications, roles, authentication, authorisation and Zero Trust access decisions.
