Microsoft Entra ID

As explained in Azure Security

Microsoft Entra ID is Microsoft’s cloud identity and access management service for authenticating identities and controlling access to resources.

Microsoft Entra ID, formerly Azure Active Directory (Azure AD), is Azure’s cloud-based identity and access management (IAM) service. It helps give the right users access to the right resources at the right time and for the right reasons through authentication, authorization, custom roles, and identity governance. section 2.0 section 2.1.1

An Azure tenant represents an organization and contains a dedicated directory for users, groups, applications, and IAM functions. A tenant can contain many Azure subscriptions; each subscription is associated with one Entra ID directory, allowing identities to be used across those subscriptions. section 2.1.1

Use Entra ID as part of layered identity security:

• Detect suspicious sign-ins and require multifactor authentication (MFA) to resist brute-force attempts. section 1.8.1
• Protect privileged identities by requiring additional controls, such as a password change, when identity protection detects possible compromise. section 1.8.1
• Treat identity protection as one control in a broader defense: compromised identities can enable lateral movement and phishing activity. section 1.8.1

Password plus MFA

A user authenticates to Azure by presenting a username and password to Entra ID. Because anyone holding those credentials could attempt the same sign-in, MFA adds another protection when credentials are disclosed. section 2.2.1

Figure 2.2 The relationship between Azure AD and Azure subscriptions

View the tenant-to-subscription relationship: one tenant directory can serve multiple subscriptions, while each subscription has one associated directory. section 2.1.1

How Azure Security covers it

How deep it goes

Defines Entra ID, tenants, subscription relationships, IAM authentication, and the four identity pillars.

Examples

Uses a username-and-password Azure sign-in, MFA protection, suspicious-login response, and tenant-to-subscription diagram.

What it assumes

Introduces IAM and identity security from the problem of determining who needs access to which resources.

What you can do after

Evaluate/understand how Entra ID centralizes identities across subscriptions and adds controls for suspicious or compromised sign-ins.

How it connects

Connects authentication, authorization, custom roles, identity governance, MFA, identity protection, Microsoft Sentinel, and Azure subscriptions.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Microsoft Azure in ActionEntra ID is Microsoft's cloud-based identity and access management service.
• 

  liveBookmanning.com
  Architecting an Apache Iceberg LakehouseAzure Active Directory is Microsoft's cloud identity and access management service for authenticating identities and enforcing authorization policies.

Compare how 3 books explain Microsoft Entra ID →

Related concepts

• identity and access managementkind of · Identity and access management is the discipline and set of policies and systems for managing digital identities and controlling their authentication, authorization, and access to resources.
• authenticationused by · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
• multifactor authenticationuses · Multifactor authentication is an authentication method that verifies identity using evidence from at least two distinct authentication-factor categories.
• Azure Data Lake Storageused by · Azure Data Lake Storage is a cloud storage service optimized for scalable storage and analysis of large datasets with hierarchical organization.
• identity protectionhas part · Identity protection is a Microsoft Entra capability that detects identity and sign-in compromise risk using behavioral analysis and supports protective responses.
• managed identityhas part · A managed identity is a nonhuman digital identity whose credentials and lifecycle are administered by a cloud or infrastructure service, allowing workloads to authenticate to supported resources without managing credentials directly.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.