Microsoft Entra Capabilities
The second domain covers Microsoft Entra, the cloud identity provider family formerly called Azure AD. Questions focus on what each feature does, which licence it needs, and when to choose Entra ID over traditional Active Directory.
Entra ID versus AD DS
Entra ID is a multi-tenant cloud directory and identity provider using HTTP-based protocols (SAML, WS-Federation, OIDC); it has no organizational units, Group Policy, or domain controllers. AD DS remains the on-premises LDAP/Kerberos system. Entra Connect Sync or Entra Cloud Sync replicates on-premises identities to Entra ID for hybrid identity; Entra Domain Services provides managed domain services (domain join, LDAP, Kerberos) for lift-and-shift VMs without deploying a domain controller.
Access, protection, governance
Conditional Access (Entra ID P1) evaluates signals - user, device, location, app, risk - and enforces grant or session controls. MFA and passwordless methods (Microsoft Authenticator, FIDO2, Windows Hello for Business) strengthen sign-in. Self-service password reset with on-premises writeback needs P1. Identity Protection (P2) detects risky users and sign-ins and feeds risk into Conditional Access. Privileged Identity Management (P2) gives just-in-time role activation with approval and audit. Access reviews and entitlement management (ID Governance) handle lifecycle. B2B invites external partners as guests; B2C serves consumer apps, with Entra External ID as the newer external-identity offering.
Worked example
A finance director signs in from an unfamiliar country on an unmanaged device. Conditional Access evaluates: user group = Finance, location = not trusted, device = unmanaged. The grant control requires a compliant device plus MFA, so access is blocked until the device is enrolled. Reasoning: Conditional Access is policy-based evaluation of signals, not a blanket MFA switch, and it does not override the need for the user's role to be activated through PIM.
Traps
Entra ID does not replace AD DS for GPO or OU management; PIM does not make anyone permanently privileged; B2C is for customers, B2B for partners; Conditional Access is not included in free Entra ID.