Microsoft Entra Capabilities
What Entra is
Microsoft Entra is the cloud identity and access management family (successor branding for Azure AD). Core capabilities: Entra ID (directory, SSO, MFA, Conditional Access), Entra ID Governance (access reviews, entitlement management, lifecycle workflows, PIM), Entra Verified ID (decentralized identity), Entra Permissions Management (CIEM for multicloud), and Entra Internet/Private Access (SSE).
Key mechanics
Conditional Access evaluates signals (user, device, location, risk) and enforces decisions (allow, block, require MFA, require compliant device). Privileged Identity Management (PIM) provides just-in-time role activation with approval and time limits. Access reviews periodically recertify who still needs access. Entitlement management uses access packages to bundle resources. Lifecycle workflows automate joiner/mover/leaver tasks. Identity Protection surfaces risky users and risky sign-ins.
Traps to watch
- Conditional Access requires Entra ID P1; PIM and Identity Protection require P2.
- PIM is not a password manager - it manages role activation, not credentials.
- Access reviews recertify access; they do not grant it.
- Entra Permissions Management is for cloud permissions (AWS, Azure, GCP), not on-prem AD.
- B2B is guest collaboration; B2C is customer identity - do not swap them.
Rule of thumb
If the scenario is "temporary elevated access with approval," choose PIM. If it is "periodically confirm users still need access," choose access reviews. If it is "block sign-ins from unfamiliar locations," choose Conditional Access.
Worked example
An admin needs Global Administrator for two hours during an incident. Answer: PIM eligible assignment with approval and time-bound activation - not a permanent role.