📗 Fundamentals (Basics)
From Notes_Wiki
Fundamentals (Basics)
What is Microsoft Entra ID (Azure AD)?
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft’s cloud-based identity and access management service. It helps employees of an organization sign in and access resources such as Microsoft 365, Azure services, and thousands of other SaaS applications.
- Cloud-based replacement for traditional on-prem Active Directory
- Supports single sign-on (SSO), multifactor authentication (MFA), and Conditional Access
- Identity provider for Microsoft 365 and third-party apps
Difference between On-Prem AD vs Azure AD
| Feature | On-Prem AD | Azure AD |
|---|---|---|
| Authentication Protocols | Kerberos, NTLM | OAuth2, SAML, OIDC |
| Infrastructure | Domain Controllers on-premises | Microsoft-managed cloud service |
| Device Join | Domain Join | Azure AD Join / Register |
| Group Policy | Yes | No (Uses Intune policies) |
| Internet Ready | No | Yes |
| MFA Support | With extra tools (NPS, RADIUS, etc.) | Built-in |
Entra ID Free vs P1 vs P2 Features
| Feature | Free | P1 | P2 |
|---|---|---|---|
| User and Group Management | yes | yes | yes |
| SSO for SaaS Apps | yes | yes | yes |
| Conditional Access | No | yes | yes |
| Self-Service Password Reset | Yes (Cloud only) | Yes | Yes |
| Identity Protection (Risk-based CA) | No | No | Yes |
| Privileged Identity Management (PIM) | No | No | Yes |
- Free – Basic identity features
- P1 – Ideal for enterprise hybrid identities
- P2 – Advanced security & governance (PIM, Identity Protection)
Understanding Entra ID Tenants & Domains
- A Tenant is a dedicated instance of Microsoft Entra ID (Azure AD)
- Each organization has a globally unique tenant ID and domain name (e.g., `yourcompany.onmicrosoft.com`)
- You can add custom domains (e.g., `yourcompany.com`) for branding and authentication
- Tenants are isolated – one tenant cannot access another tenant's resources unless explicitly allowed
How to create an Entra ID tenant step-by-step
- Go to [1](https://entra.microsoft.com)
- Sign in with a Microsoft account (or create one)
- Navigate to: Manage tenants > Create
- Choose Azure Active Directory
- Enter:
- Organization name
- Initial domain name (e.g., `mycompany.onmicrosoft.com`)
- Country/region
- Click Create
- After a few seconds, your tenant will be ready
Understanding Users, Groups, and Roles in Entra ID
- Users: Represent real people or service accounts
Types: Cloud-only, Synced from on-prem, Guest (B2B)
- Groups: Used for access control and policy assignment
Types: Security Groups, Microsoft 365 Groups
- Roles: Define what permissions a user or group has
Examples: Global Administrator, User Administrator, Security Reader Role-Based Access Control (RBAC) is used to assign roles
