Microsoft Entra Capabilities
Identity platform fundamentals
Microsoft Entra ID is the cloud identity provider behind Microsoft 365 and Azure. Distinguish Entra ID (cloud directory) from AD DS (on-premises) and from Entra Domain Services (managed domain services in the cloud). A frequent trap: Entra ID does not use traditional OUs or Group Policy.
Editions and hybrid identity
Free, P1, and P2 differ mainly in conditional access and identity protection features. P1 includes Conditional Access; P2 adds Privileged Identity Management and Identity Protection risk policies. Hybrid identity options: password hash synchronization, pass-through authentication, and federation with AD FS. Know that password hash sync enables leaked-credential detection.
Access and protection features
- Conditional Access: if-then policy engine using user, device, location, app, and risk signals.
- MFA: something you know, have, or are.
- Self-service password reset (SSPR): reduces helpdesk load; can write back to on-premises AD.
- Privileged Identity Management (PIM): just-in-time role activation, approvals, access reviews.
- Identity Protection: user and sign-in risk detections.
- Entra ID Governance: access reviews, entitlement management, lifecycle workflows.
- External identities: B2B collaboration (guest accounts) versus B2C (customer identities).
Traps
Do not confuse B2B (partners use their own credentials as guests) with B2C (customers). Do not say Conditional Access requires P2 - it requires P1. Do not claim SSPR alone grants admin password reset without roles.
Rule of thumb
Match the requirement to the smallest feature: time-bound admin elevation = PIM; risk-based sign-in blocking = Identity Protection; guest collaboration = B2B.
Worked example
"Admins must request elevation for 2 hours with approval." That is PIM in Entra ID P2, not Conditional Access, which evaluates access but does not grant temporary roles.