📖 What is Microsoft Entra ID?
Microsoft Entra ID is a cloud-based identity and access management service that helps organizations secure identities and manage access to applications. It provides single sign-on (SSO), multi-factor authentication, and conditional access to protect resources across the Microsoft 365 ecosystem and external cloud services.
"Remember that Entra ID is the rebranded name for Azure Active Directory; you will see both terms, but focus on the Entra nomenclature for current exams."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Microsoft Entra ID?
- ▸ Conditional Access policies act as the primary security engine, allowing administrators to define specific conditions, such as user location or device state, before granting access.
- ▸ Hybrid Identity enables synchronization between on-premises Active Directory and Entra ID using Entra Connect, facilitating a seamless login experience for users across environments.
- ▸ Privileged Identity Management (PIM) provides just-in-time and just-enough administration, reducing the attack surface by eliminating permanent high-privilege assignments for administrative roles.
- ▸ Single Sign-On (SSO) allows users to access multiple cloud and on-premises applications using a single set of credentials, improving productivity and reducing password fatigue.
- ▸ Identity Governance tools, including Access Reviews, ensure that only the right people have the appropriate access to resources through periodic validation of permissions.
🎯 How does Microsoft Entra ID appear on the MS-102 Exam?
You may be asked to design a security policy where users accessing sensitive data from an untrusted IP range are required to perform MFA via Conditional Access.
A scenario might describe a need to limit the time a user holds the Global Administrator role; you will need to identify Privileged Identity Management (PIM) as the solution.
Expect questions regarding the selection of the correct synchronization method, such as Password Hash Synchronization versus Pass-through Authentication, based on specific organizational security requirements.
❓ Frequently Asked Questions
How does Entra ID differ from traditional Active Directory Domain Services (AD DS)?
AD DS is a hierarchical identity service for on-premises networks using Kerberos/NTLM, while Entra ID is a flat, cloud-based identity service using modern protocols like OAuth 2.0 and SAML.
Can Conditional Access be used without MFA?
Yes, Conditional Access can trigger various outcomes beyond MFA, such as blocking access entirely, requiring a compliant device, or forcing a password change based on risk levels.
What is the difference between a User and a Service Principal in Entra ID?
A User represents a human identity, whereas a Service Principal is an identity created for applications or services to access resources without requiring a human user's credentials.