This chapter covers Microsoft Entra ID (Azure Active Directory), Azure's identity and access management service. AZ-900 tests this under objective 2.5, "Describe identity, access, and security."
Jump to a section
A simple way to picture Microsoft Entra ID (Azure AD)
Imagine a large company where every employee carries a single badge that grants access to whichever buildings, floors, and systems they're authorized to use, verified centrally by security rather than each building checking IDs independently. Microsoft Entra ID (formerly Azure Active Directory) works similarly for digital identity — it's a centralized identity service that verifies who a user is and manages what they're allowed to access across an organization's applications and resources, rather than each application managing its own separate set of usernames and passwords.
What Microsoft Entra ID is
Microsoft Entra ID (the current name for what was previously called Azure Active Directory) is Microsoft's cloud-based identity and access management service. It manages user identities and controls access to applications and resources, both within Azure and across many other Microsoft and third-party services.
Identity vs. access
Identity refers to verifying who a user (or application) actually is — typically through a sign-in process. Access refers to what that verified identity is then allowed to do — which resources or applications it can use, and what actions it can perform.
Key capabilities
Single sign-on: users can sign in once and access multiple applications without re-authenticating for each one.
User and group management: organizations manage users and can group them for easier access control.
Integration across services: Entra ID isn't limited to Azure resources — it's used to manage identity for Microsoft 365 and many third-party applications as well.
How it differs from a traditional on-premises directory
Traditional on-premises directory services (like Windows Server Active Directory) are typically confined to an organization's own network. Microsoft Entra ID is cloud-based, letting identity and access management extend to cloud resources and services accessible from anywhere, though organizations can also connect their on-premises directory to Entra ID for a hybrid identity setup.
Create and manage user identities
Users are created and managed within Microsoft Entra ID, representing the people (or applications) that need to access resources.
Verify identity through sign-in
When a user signs in, Entra ID verifies their identity, typically through a username and password, and often additional verification steps.
Control access to resources
Once identity is verified, access controls determine what that user is permitted to do — which applications, resources, or actions they're allowed.
Extend across multiple services
The same identity can be used to access Azure resources, Microsoft 365, and many third-party applications, rather than needing separate credentials for each.
An organization uses Microsoft Entra ID so employees can sign in once and access Azure resources, Microsoft 365 email, and several third-party business applications — all with the same identity, rather than juggling separate usernames and passwords for each service.
A separate organization connects its existing on-premises directory to Microsoft Entra ID, extending its established identity management into the cloud so employees can use their existing credentials to access both on-premises and cloud resources consistently, rather than maintaining two entirely separate identity systems.
Objective 2.5 expects candidates to understand what Microsoft Entra ID is and its role in managing identity and access, distinct from the resource-level access control covered in the RBAC chapter.
A common wrong answer is assuming Entra ID only manages access to Azure resources — it also manages identity for Microsoft 365 and many third-party applications. Another common trap is confusing identity (who you are) with access (what you're allowed to do) — Entra ID handles both, but they're conceptually distinct steps.
Stable terms: Microsoft Entra ID, identity, single sign-on. Note that this service was previously named Azure Active Directory (Azure AD) — both names may appear, referring to the same underlying service.
Memory trick: identity answers "who are you?" Access answers "what are you allowed to do?" Microsoft Entra ID handles both, centrally, across many services — not just Azure.
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service.
Identity refers to verifying who a user is; access refers to what that verified identity is permitted to do.
Entra ID supports single sign-on across Azure, Microsoft 365, and many third-party applications, not just Azure resources.
Organizations can connect an existing on-premises directory to Entra ID for a hybrid identity setup.
These come up on the exam all the time. Here's how to tell them apart.
Identity
Verifying who a user or application actually is
Typically established through sign-in
Answers: 'Who are you?'
Access
Determining what a verified identity can do
Controlled through permissions and roles
Answers: 'What are you allowed to do?'
Mistake
Microsoft Entra ID only manages access to Azure resources.
Correct
It also manages identity and access for Microsoft 365 and many third-party applications, not just Azure resources specifically.
Mistake
Identity and access are the same thing.
Correct
Identity refers to verifying who a user is; access refers to what that verified identity is then permitted to do. They're related but distinct concepts, both handled by Entra ID.
Mistake
Microsoft Entra ID is the same as a traditional on-premises directory service.
Correct
Entra ID is cloud-based and can extend identity management to cloud resources accessible from anywhere, though it can also connect to an on-premises directory for a hybrid setup.
It's Microsoft's cloud-based identity and access management service (previously called Azure Active Directory), used to verify user identities and manage what they're allowed to access across Azure, Microsoft 365, and many third-party applications.
Identity refers to verifying who a user or application actually is, typically through a sign-in process. Access refers to what that verified identity is then permitted to do — which resources or actions it can use. Entra ID manages both.
Yes — Microsoft Entra ID is the current name for the service previously called Azure Active Directory (Azure AD). Both names refer to the same underlying identity and access management service.
You've just covered Microsoft Entra ID (Azure AD) — now see how well it sticks with free AZ-900 practice questions. Full explanations included, no account needed.
Done with this chapter?