2.3.1. Microsoft Entra ID
💡 First Principle: Microsoft Entra ID (formerly Microsoft Entra ID) is the cloud identity and access management service that underpins every Microsoft 365 service. Every user account, every group, every application access decision, every sign-in — they all flow through Entra ID.
Think of Entra ID as the digital passport office for your organization. It issues identities, verifies them at the door, and records every entry and exit. Without it, M365 services have no way of knowing who's asking for access or whether they should get it.
Key capabilities of Microsoft Entra ID:
| Capability | What It Does |
|---|---|
| User and group management | The canonical directory of all identities in your organization |
| Authentication | Verifies who users are using passwords, MFA, passwordless methods |
| Authorization | Enforces what users can access through role assignments and app permissions |
| Conditional Access | Policy engine that evaluates context before granting access |
| Identity Secure Score | Measurable score (0-100%) of your identity security posture with improvement recommendations |
| B2B collaboration | External guest access — invite partners and contractors into your tenant. Guests sign in with their own work, school or social identity; your tenant holds only a guest user object, so their home organization keeps managing the credential, and disabling it there ends their sign-in |
| Hybrid identity | Synchronize on-premises Active Directory to Entra via Entra Connect |
Identity Secure Score deserves special attention for the exam. It's a percentage-based score in the Entra admin center that measures how well your identity configuration follows Microsoft's security recommendations. Each recommendation shows its point value, implementation difficulty, and impact. Use it to prioritize identity hardening work — higher-impact, lower-effort improvements first.
Hybrid identity and account types. Microsoft Entra Connect synchronizes on-premises AD accounts to Entra ID so people sign in to Microsoft 365 with the same username and password, using password hash synchronization, pass-through authentication or federation. Entra ID is not AD DS running in the cloud: it is built on web protocols (SAML, OAuth 2.0, OpenID Connect) rather than LDAP and Kerberos, and it runs alongside existing domain controllers rather than requiring them to be retired. A member account belongs to someone inside the organization; a guest is an external B2B collaborator with more limited default directory permissions, still subject to Conditional Access and MFA.
Protecting sign-ins. Smart Lockout locks an account for a short time after repeated failed sign-ins (10 by default) from unfamiliar locations, while the real user signing in from a familiar location can still get in — which blunts brute-force and password-spray attacks. Microsoft Entra ID Protection (Entra ID P2) scores sign-in risk (anonymous IP addresses, unfamiliar locations, impossible travel) and user risk (for example leaked credentials) and feeds those levels to Conditional Access, which can then require MFA, require a password change or block.
Identity Secure Score can also drop with no change in your tenant, because Microsoft adds new recommendations and that raises the points available.
⚠️ Exam Trap: Entra ID is not a replacement for on-premises Active Directory in all scenarios. Organizations running legacy apps that rely on Kerberos or NTLM still need on-premises AD. Entra ID excels at cloud and modern authentication; it's not a drop-in replacement for every AD use case.
Reflection Question: An admin sees their Identity Secure Score is 45%. Which section of the Entra admin center should they visit to get prioritized recommendations for improvement?
