Microsoft Entra ID (Azure AD) in M365

Microsoft Entra ID is a cloud-based identity and access management (IAM) service. It provides authentication and authorization for users, devices, and applications. It is the identity backbone for Microsoft 365, Azure, and many third-party SaaS applications. Entra ID is not a directory service in the traditional sense like on-premises Active Directory Domain Services (AD DS); it is an identity platform that uses REST APIs and modern protocols (OAuth 2.0, OpenID Connect, SAML, WS-Federation) instead of Kerberos and LDAP.

Before cloud computing, organizations used on-premises Active Directory to manage users and computers within a corporate network perimeter. With the rise of SaaS apps and mobile work, identities needed to work outside the network. Entra ID was built to handle internet-scale authentication, supporting billions of authentication requests per day. It decouples identity from the corporate network, allowing users to access resources from anywhere, on any device.

When a user attempts to sign in to a Microsoft 365 app (e.g., Outlook Web Access), the following happens:

Administrators manage Entra ID through the Entra admin center (https://entra.microsoft.com) or via PowerShell with the Microsoft Graph PowerShell SDK.

Example: Get tenant details

Connect-MgGraph -Scopes "Organization.Read.All"
Get-MgOrganization | Select-Object Id, DisplayName, VerifiedDomains

Example: Get users

Get-MgUser -All | Select-Object UserPrincipalName, DisplayName, UserType

Example: Create a conditional access policy

$params = @{
    displayName = "Require MFA for all users"
    state = "enabled"
    conditions = @{
        users = @{ includeUsers = ["All"] }
        applications = @{ includeApplications = ["All"] }
    }
    grantControls = @{
        builtInControls = ["mfa"]
        operator = "OR"
    }
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $params

Entra ID has four editions: Free, Microsoft Entra ID P1, Microsoft Entra ID P2, and Microsoft Entra ID Governance. The MS-900 exam focuses on the capabilities included with Microsoft 365 subscriptions: - Microsoft 365 Business Basic/Standard/Premium: Includes Entra ID Free (with some P1 features like self-service password reset for cloud users). - Microsoft 365 E3: Includes Entra ID P1. - Microsoft 365 E5: Includes Entra ID P2.

Key differences: - Free: User/group management, single sign-on (SSO) to Microsoft apps, basic security reports. - P1: Conditional Access, self-service password reset with write-back, dynamic groups, Microsoft Identity Manager. - P2: Identity Protection, Privileged Identity Management (PIM), identity governance.

A large enterprise with 50,000 on-premises Active Directory users wants to move to Microsoft 365. They deploy Microsoft Entra Connect with password hash sync. User objects are synced every 30 minutes (default sync cycle). Passwords are hashed and synced to Entra ID. Users can now use the same password for on-premises and cloud resources. The IT team enables self-service password reset (SSPR) with write-back, so users can reset their own passwords from the cloud, and the change is written back to on-premises AD. Common misconfiguration: failing to sync the password hash properly due to firewall blocking port 443 to Azure. Solution: ensure outbound HTTPS is allowed to *.msappproxy.net.

A company with 10,000 users wants to enforce MFA when users access corporate email from outside the office. They create a Conditional Access policy: target all users, target Exchange Online app, condition: location = any IP except corporate range, grant: require MFA. The policy is enabled. Users outside the office are prompted for MFA via Microsoft Authenticator app. Performance consideration: MFA prompts can cause user fatigue; they set the session token lifetime to 24 hours to reduce prompts. Common issue: users on VPN may appear as coming from corporate IP, bypassing MFA. Solution: use trusted IPs with Conditional Access or require MFA for all external access.

A software company partners with external vendors. They invite 500 guest users to their Entra ID tenant via B2B collaboration. Guests use their own work or social identities to sign in. The company grants access to a SharePoint site and a custom SaaS app. They set an expiration policy for guest accounts: 90 days. Problem: guests are not automatically removed; the expiration policy sends a reminder email. Misconfiguration: forgetting to enable MFA for guest users, leaving the tenant vulnerable. Solution: create a Conditional Access policy requiring MFA for all guest users.