3.1.1. What Is Microsoft Entra ID
💡 First Principle: Microsoft Entra ID exists to answer "who is this, and what do they belong to?" for the entire Microsoft cloud ecosystem — it's a multi-tenant, cloud-native identity platform, meaning each organization gets its own isolated tenant, and identities inside that tenant can authenticate to Microsoft 365, Azure resources, and any of thousands of pre-integrated third-party applications using modern protocols like OAuth 2.0, OpenID Connect, and SAML.
Every Microsoft 365 or Azure subscription is anchored to an Entra ID tenant — it's the foundational identity layer everything else in the Microsoft cloud sits on top of. Sign-ins, group memberships, application permissions, and device registrations all live here, and Microsoft Graph is the API surface that lets applications programmatically read and act on this identity data.
⚠️ Exam Trap: Microsoft Entra ID is not built on Kerberos/NTLM like on-premises Active Directory Domain Services — it uses token-based protocols suited for internet-facing applications, which is exactly why it can authenticate users into external SaaS apps that on-prem AD never could reach directly.
Reflection Question: Why does a cloud-native identity platform need different authentication protocols than an on-premises directory built for a private corporate network?