Most engineers think…
Most people hear 'Entra ID' (or its old name, Azure AD) and picture 'Active Directory, but in the cloud — same domain controllers, same Group Policy'. That mental model fails you in an interview and in production.
Microsoft Entra ID is a cloud identity provider (IDaaS). It authenticates users and apps using modern protocols — OAuth 2.0, OpenID Connect and SAML — not the Kerberos, LDAP and Group Policy that on-prem Active Directory Domain Services (AD DS) uses to manage domain-joined Windows machines. Entra ID has no organizational units or domain controllers; it has a tenant with users, groups, administrative units and apps. Understanding that split is what lets you answer 'Entra ID vs on-prem AD' and 'app registration vs enterprise app' without fumbling.
① What Microsoft Entra ID actually is — a cloud identity provider
The single most important idea: Microsoft Entra ID is a cloud identity provider, not a cloud domain controller. It was renamed from Azure Active Directory (Azure AD) to Microsoft Entra ID — same service, current name. It gives every user and app one identity to sign in to Microsoft 365, the Azure portal and thousands of SaaS apps.
Compare it to on-prem Active Directory Domain Services (AD DS). AD DS runs domain controllers, speaks Kerberos, LDAP and Group Policy, and manages domain-joined Windows machines with organizational units (OUs). Entra ID has none of those — no OUs, no Group Policy, no domain controllers. Instead it authenticates over modern web protocols (OAuth 2.0, OpenID Connect, SAML) that work over the internet, which is exactly why it suits mobile users and SaaS.
The interview line: AD DS manages machines on a corporate LAN; Entra ID manages identities for cloud apps over the internet. They solve different problems, and most organisations run both, linked by hybrid identity.
Microsoft renamed Azure Active Directory to Microsoft Entra ID — the service is identical, only the name changed. In an interview, use the current name and add one line: 'it's a cloud identity provider, not a cloud domain controller.' That single contrast signals you actually understand it.
Microsoft Entra ID is best described as…
② The tenant and its objects — users, groups and administrative units
An instance of Entra ID is a tenant: an isolated directory that holds one organisation's users, groups, devices and apps, plus its access policies. Every tenant gets an initial domain like contoso.onmicrosoft.com (globally unique, can't be changed), and you add your own custom domains. Tenants are securely isolated from each other.
Groups you must name
Security groups grant access to apps and resources (the cloud cousin of an AD security group). Microsoft 365 groups add shared collaboration — a mailbox, calendar, Teams and SharePoint site. Membership can be assigned (you add people manually) or dynamic — an attribute rule (e.g. department equals Sales) that auto-adds and removes users. Dynamic groups need a P1 licence.
Administrative units (AUs) scope admin rights to a slice of the directory — for example, a 'Mumbai' AU so a regional helpdesk can reset only Mumbai users' passwords. AUs are how you delegate without making everyone a global admin.
An isolated instance of Entra ID for one organisation — its users, groups, admin units and apps, with an initial contoso.onmicrosoft.com domain.
A group whose membership is set by an attribute rule (e.g. department = Sales). Auto-adds and removes users. Needs a P1 licence.
The application object — the global blueprint (client ID, secrets, redirect URIs, permissions) living once in the app's home tenant.
The service principal — the local instance of an app inside a tenant. It signs in and gets the access; one per tenant the app is used in.
You want a group whose membership updates automatically when a user's department changes. What do you use?
③ Apps and SSO — app registration vs enterprise application
This is the classic interview trap. When a developer builds an app, they create an app registration — the application object. It is the global blueprint: the app's identity (client ID), redirect URIs, secrets/certificates, API permissions and whether it is single- or multi-tenant. It lives once, in the app's home tenant.
An enterprise application is the service principal — the local instance of that app inside a specific tenant. It is what actually signs in and is granted access. Per tenant, an app has one app registration in its home tenant but a service principal in every tenant where it is used. So a SaaS app like Salesforce shows up under Enterprise applications (a service principal) in your tenant, even though its app registration lives in the vendor's tenant.
SSO to SaaS
Add a SaaS app from the gallery, wire up SAML or OIDC, and users get single sign-on with their Entra ID identity — no extra password. Two related service-principal types are worth naming: a managed identity (an app identity Azure manages for you, no secrets to rotate) and a legacy service principal (an older app with no app registration).
The number-one Entra interview slip is treating app registration and enterprise application as the same thing. Registration = the blueprint (app object, home tenant). Enterprise app = the service principal (local instance, one per tenant). One blueprint, many instances — say it that way.
▶ Watch a user single sign-on to a SaaS app via Entra ID
How one click into Salesforce becomes a signed token from your tenant. Press Play for the healthy path, then Break it to see the classic failure.
Salesforce appears under 'Enterprise applications' in your tenant. Where does its app registration live?
④ Hybrid identity and licensing — Entra Connect, Cloud Sync and the tiers
Most companies keep on-prem AD DS and use Entra ID, so they link the two — that's hybrid identity. Microsoft Entra Connect is the on-prem sync tool that copies users and groups up to the tenant. The sign-in method is the key choice: Password Hash Sync (PHS) syncs a hash of the on-prem password to the cloud (simplest, also enables leaked-credential detection); Pass-Through Authentication (PTA) validates the password against an on-prem agent live (no password hash stored); Federation (AD FS) hands sign-in to an on-prem identity service (most complex).
Cloud Sync — the lighter option
Microsoft Entra Cloud Sync is the newer, lightweight agent. Configuration lives in the cloud, multiple agents give automatic failover, and it natively handles disconnected forests (mergers). Microsoft is steering customers toward Cloud Sync; it still has limits (e.g. ~150K objects per domain) versus the older Connect Sync.
Licensing in one breath
Free = basic users, groups and SSO. P1 adds dynamic groups, administrative-unit admins, Conditional Access and self-service password reset writeback. P2 adds Identity Protection and Privileged Identity Management (PIM). Match the feature to the tier and you've answered the licensing question.
Rohan, an IT admin at a Pune manufacturing firm, faces this
After enabling Entra Connect with PHS, new Microsoft 365 users can sign in, but a regional helpdesk lead complains he 'can't reset passwords for anyone' even though he was told he's an admin.
He was given a directory role but with no scope, then locked down — or he needs his rights scoped to just his region, which means an administrative unit, not a tenant-wide role.
Check his role assignment: he is a User Administrator scoped to a 'Pune' administrative unit, but the Pune users were never added as members of that AU, so there is nothing in his scope.
Entra admin center ▸ Roles & admins ▸ Administrative units ▸ Pune ▸ MembersAdd the Pune users (directly, or via a dynamic-membership AU rule on a P1 licence) as members of the Pune administrative unit; his User Administrator role then applies to exactly those users.
Re-test: he can reset passwords for Pune users only and cannot touch Mumbai or Delhi users — least-privilege delegation working as intended.
Before chasing a 'can't sign in' ticket, check which hybrid method is configured — PHS, PTA or federation. The same symptom has different causes: a PTA agent being down, a federation certificate expiring, or PHS simply not yet synced. Read the method first, then troubleshoot.
Which hybrid sign-in method validates the password against an on-prem agent without storing a password hash in the cloud?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why is Microsoft Entra ID called a 'cloud identity provider' rather than 'Active Directory in the cloud'? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Microsoft Entra ID
- The cloud identity and access management service (IDaaS), formerly named Azure Active Directory (Azure AD). Authenticates users and apps over OAuth 2.0, OIDC and SAML.
- Active Directory Domain Services (AD DS)
- On-prem directory that manages domain-joined Windows machines using Kerberos, LDAP, NTLM and Group Policy, organised in OUs. Not the same as Entra ID.
- Tenant
- An isolated instance of Entra ID for one organisation, holding its users, groups, administrative units and apps, with a unique contoso.onmicrosoft.com initial domain.
- Security group / Microsoft 365 group
- Security groups grant access to resources; Microsoft 365 groups add collaboration (mailbox, Teams, SharePoint). Both can be assigned or dynamic.
- Dynamic group
- A group whose membership is set by an attribute rule (e.g. department = Sales) and updates automatically. Requires a P1 licence.
- Administrative unit (AU)
- A container that scopes admin rights to a slice of the directory, enabling delegated, least-privilege administration (e.g. by region).
- App registration
- The application object — the global blueprint of an app (client ID, secrets, redirect URIs, permissions) that lives once in the app's home tenant.
- Enterprise application (service principal)
- The local instance of an app within a tenant. It is what signs in and is granted access; one exists per tenant where the app is used.
- Entra Connect / Cloud Sync
- Hybrid-identity sync tools that copy on-prem AD users and groups to a tenant. Cloud Sync is the newer, cloud-managed, lightweight-agent option.
- PHS / PTA / Federation
- Hybrid sign-in methods: Password Hash Sync (hash in cloud), Pass-Through Authentication (live on-prem check), and Federation via AD FS.
📚 Sources
- Microsoft Learn — What is Microsoft Entra ID? learn.microsoft.com/entra/fundamentals/what-is-entra
- Microsoft Learn — Compare Active Directory to Microsoft Entra ID. learn.microsoft.com/entra/fundamentals/compare
- Microsoft Learn — Application and service principal objects in Microsoft Entra ID. learn.microsoft.com/entra/identity-platform/app-objects-and-service-principals
- Microsoft Learn — What is Microsoft Entra Connect? (PHS, PTA, federation). learn.microsoft.com/entra/identity/hybrid/connect/whatis-azure-ad-connect
- Microsoft Learn — What is Microsoft Entra Cloud Sync? & Connect-to-Cloud-Sync decision guide. learn.microsoft.com/entra/identity/hybrid/cloud-sync/what-is-cloud-sync
- Microsoft Learn — Administrative units & dynamic groups (licensing P1/P2). learn.microsoft.com/entra/identity/role-based-access-control/administrative-units
What's next?
Got the fundamentals? Next, go deep on Conditional Access and MFA — the policy engine that decides who can sign in, from where and on what device — then on Privileged Identity Management (PIM), Identity Protection and identity governance for least-privilege and just-in-time admin access.