Microsoft Entra ID and authentication

Identity is the new security perimeter: in the cloud, controlling who can sign in matters as much as any firewall.

Authentication and authorisation

• Authentication (AuthN) proves who you are: "Are you really Asha?" (passwords, codes, fingerprints).
• Authorisation (AuthZ) decides what you are allowed to do once signed in: "Asha can read this storage account but not delete it."

Authentication always comes first.

Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. It is used to sign in to Azure, Microsoft 365, and thousands of other applications.

It provides:

• Authentication: verifying identities, including self-service password reset and MFA.
• Single sign-on (SSO): one identity for many applications.
• Application management: managing access to cloud and on-premises apps.
• Device management: registering devices and controlling access from them.

Microsoft Entra Connect synchronises users from an on-premises Active Directory to Entra ID, so people use the same identity everywhere.

Microsoft Entra Domain Services

Older applications often need traditional Active Directory features such as domain join, Group Policy, LDAP and Kerberos/NTLM authentication. Microsoft Entra Domain Services provides these as a managed service, so you can lift and shift such applications to Azure without running your own domain controllers.

When you turn it on, Azure deploys and patches a pair of Windows Server domain controllers for you (the managed domain). Users, groups and passwords flow one way, from Microsoft Entra ID into the managed domain, so people sign in with the credentials they already have. Things you create directly inside the managed domain are not copied back to Entra ID.

Authentication methods

• Single sign-on (SSO): sign in once and access many applications. Fewer passwords means fewer weak or reused ones.
• Multi-factor authentication (MFA): requires two or more of:
  • something you know (a password),
  • something you have (a phone, a security key),
  • something you are (a fingerprint, your face).
• Passwordless: removes the password entirely, replacing it with something you have plus something you are or know. Options include Windows Hello for Business (a PIN or biometrics on your own PC), the Microsoft Authenticator app, and passkeys (FIDO2), such as a hardware security key. Passwordless sign-in is both more convenient and harder to phish.

External identities

An external identity is a person, device or service outside your organisation. Microsoft Entra External ID lets them use their own identities (a work account, a personal Microsoft or Google account, a one-time email code) to reach your apps, so you never manage passwords for them.

For partners, inside your organisation's own (workforce) tenant:

• B2B collaboration: invite partners and guests to use your organisation's apps with their own work, school or social accounts. They appear in your directory as guest users, and you control what they can reach.
• B2B direct connect: a two-way trust with another Microsoft Entra organisation, used today for Teams shared channels. Those users are not added to your directory.

For customers, in a separate external tenant:

• Customer-facing apps (CIAM): publish consumer or business-customer apps where customers sign up and sign in with social or local accounts, with your own branding.