3.1. Function and Identity Types of Microsoft Entra ID

💡 First Principle: Microsoft Entra ID is the identity provider and directory service (both roles from Phase 2, combined) for the Microsoft cloud — it's the single place where every user, device, and application identity is created, authenticated, and governed for Microsoft 365, Azure, and thousands of third-party SaaS applications.

Why care: almost everything in the rest of this phase — MFA, Conditional Access, RBAC, PIM, Identity Protection — is a capability of Microsoft Entra ID, not a separate product bolted on. Understanding Entra ID's core role first makes every later subsection click into place as "one more thing Entra ID does" rather than a new, disconnected product name to memorize.

⚠️ Common Misconception: Assuming Microsoft Entra ID is simply "Active Directory, but hosted in the cloud." It's a distinct, cloud-native platform built on modern authentication protocols — the 3.1.1 section below unpacks exactly why that distinction matters.