Microsoft Entra
Microsoft Entra is Microsoft's family of identity and network access products. Entra ID (formerly Azure Active Directory) handles sign-in, MFA and Conditional Access; other members cover governance, identity risk, external and workload identities, VPN-free private access, internet access and identities for AI agents.1
Also known as Microsoft Entra ID, Entra ID, Azure Active Directory, Azure AD, Microsoft Entra Suite
- Intended for
- Identity and access administrators, Security architects planning Zero Trust, Network teams replacing VPNs, Developers adding sign-in to apps, Teams deploying AI agents
- Runs on
- Microsoft cloud service, Hybrid with on-premises Active Directory through Microsoft Entra Connect, Managed domains for legacy apps (Domain Services), Agents on Microsoft and non-Microsoft platforms
At a glance
- What is it?
- Microsoft Entra is a product family for verifying identities, checking access conditions and protecting connections under a Zero Trust approach. Its foundation is Microsoft Entra ID, the cloud identity service behind every Microsoft 365, Azure and Dynamics 365 tenant. Around it sit Domain Services (managed Kerberos, LDAP and group policy for legacy apps), Private Access and Internet Access (network access), ID Governance, ID Protection, Verified ID (decentralized credentials), External ID (partners and customers), Workload ID (apps and services) and Agent ID (AI agents). Microsoft renamed Azure AD to Microsoft Entra ID, announced on 11 July 2023, and changed license display names on 1 October 2023.12
- What does it do?
- Entra ID authenticates users with passwords, MFA or passwordless methods and gives them single sign-on to apps. Conditional Access combines user, device, app, location and risk signals to allow or block access or ask for stronger checks. ID Protection detects risky sign-ins and users. ID Governance automates access requests, assignments, reviews and joiner and leaver processes. Private Access lets remote users reach internal apps without a VPN, and Internet Access filters web and SaaS traffic. Agent ID gives AI agents their own identities, created from blueprints, with sign-in and audit logs. Admins work in the Entra admin center or through Microsoft Graph.13
- Who needs it?
- Every organization on Microsoft 365 or Azure already has Entra ID. Paid plans matter for IT and security teams that need Conditional Access, identity risk protection, automated access lifecycles or a VPN replacement. Developers use the Microsoft identity platform and MSAL to add sign-in to their apps, and teams building AI agents use Agent ID to give each agent a governed identity.1
- What does it need?45
- A Microsoft Entra tenant, which comes with Microsoft 365, Azure and Dynamics 365 subscriptions
- Licenses for paid features: Entra ID P1 or P2, Entra Suite, ID Governance, Private Access or Internet Access, or a Microsoft 365 plan that includes them
- Entra ID P1, or a plan that includes it, before buying Entra Suite
- Microsoft Agent 365 licenses to extend Entra security features to agents
- Security Copilot capacity (SCUs) for Entra agents
- Least-privilege admin roles, such as Security Administrator or Conditional Access Administrator
- What it is not
- Entra ID is not Windows Server Active Directory: on-premises Active Directory keeps its name and is still supported, and Microsoft Entra Connect synchronizes the two. Domain Services provides a managed domain for legacy apps that cannot use modern authentication. Azure AD B2C kept its name and has not been sold to new customers since 1 May 2025; External ID is the newer option. Agent ID is available to all Entra customers, but extending Entra security features to agents requires Microsoft Agent 365 licenses.23
Availability and licensing. Checked 26 Oct 2026 on Microsoft's pricing page (per user per month, annual): Entra ID P1 $7.00, P2 $10.00, Entra Suite $12.00 (needs P1), ID Governance $7.00, Private Access $5.00, Internet Access $5.00, Workload ID $3.00. External ID is pay-as-you-go, free up to 50,000 monthly active usages. Microsoft 365 E3 includes Entra ID P1 and E5 includes P2. Agent ID is available to all Entra customers; its security features need Agent 365. Azure AD B2C is closed to new customers since 1 May 2025.46
The problem it solves
Users sign in from anywhere to SaaS apps, cloud resources and internal systems, and attackers go after credentials first. Network location no longer shows whether a request is safe, and manual provisioning leaves access in place long after people change roles or leave.
Entra puts identity at the center: each sign-in is checked against policy and risk, access is granted and removed through governed workflows, and the same controls now extend to workloads and AI agents.1
How it works
Each tenant is a Microsoft Entra directory with an initial domain, such as contoso.onmicrosoft.com, to which you add your own domain names.
- Authentication: users and devices sign in with Entra credentials; apps use the Microsoft identity platform and open-source libraries such as MSAL.
- Policy: Conditional Access evaluates signals at sign-in, including device compliance from Intune and risk levels from ID Protection.
- Governance: ID Governance automates assignments, access reviews and lifecycle tasks.
- Network access: Private Access connects users to internal resources without a VPN; Internet Access applies controls such as web content filtering.
- Agents: Agent ID creates agent identities from blueprints and supports OAuth 2.0, MCP and A2A; agents from other platforms, such as AWS Bedrock or n8n, can join through the Entra ID Auth SDK sidecar or workload identity federation.
Administrators use the Entra admin center or Microsoft Graph. Security Copilot agents, such as the Conditional Access Optimization Agent, run inside the admin center.137
Diagram as a list
Copilot & business apps
- Microsoft Entra admin center and Microsoft GraphConfigure and automate identity and accessConnects to Microsoft Entra ID
Agents & automation
- Microsoft Entra Agent IDIdentities and blueprints for AI agents
AI models & platform
- Security Copilot agents in EntraConditional Access optimization and identity risk investigation
Security, identity & governance
- Microsoft Entra IDDirectory, authentication and single sign-on
- Conditional AccessEvaluates user, device, app, location and risk signals at sign-in
- ID ProtectionDetects risky sign-ins and users
- ID GovernanceAccess requests, reviews and lifecycle workflows
Cloud & hybrid infrastructure
- Microsoft IntuneReports device compliance state
- Private Access and Internet AccessVPN-free private app access and internet traffic controlsConnects to Conditional Access
Capabilities
Entra ID authentication and single sign-on1
Cloud identity and access management that authenticates users, devices and apps and enforces policy, with single sign-on and MFA.
Why it matters: One identity for Microsoft 365, Azure and integrated SaaS apps.
Limits: Legacy apps that need Kerberos or LDAP may require Domain Services.
Conditional Access7
Policies that combine user, device compliance, app, location and risk signals to allow, block or require stronger authentication.
Why it matters: Access decisions follow real device and risk posture instead of network location.
Limits: Device signals require Intune or another compliance source; policies should be piloted before broad enforcement.
ID Protection12
Detects and reports identity risks and supports risk-based Conditional Access, for example requiring MFA for medium or high sign-in risk.
Why it matters: Stops many account takeover attempts automatically.
Limits: Risk policies need licensing that includes ID Protection, such as Entra ID P2 in Microsoft 365 E5.
ID Governance14
Automates access requests, assignments, reviews and identity lifecycle tasks for joiners and leavers.
Why it matters: Removes access people no longer need.
Limits: Separate add-on at $7.00 per user per month, annual (checked 26 Oct 2026), or part of Entra Suite.
Private Access and Internet Access14
Private Access reaches internal apps and resources without a VPN; Internet Access secures traffic to internet, SaaS and Microsoft 365 resources, with web content filtering.
Why it matters: Narrows network access to individual apps and adds identity-aware web controls.
Limits: Each is $5.00 per user per month, annual (checked 26 Oct 2026), or included in Entra Suite.
External ID and Workload ID14
External ID covers partner collaboration and customer sign-in for consumer apps; Workload ID secures apps, services and containers such as GitHub Actions.
Why it matters: Extends the same identity controls beyond employees.
Limits: Azure AD B2C has not been sold to new customers since 1 May 2025; External ID is pay-as-you-go and free up to 50,000 monthly active usages.
Agent ID3
Identity constructs for AI agents built from blueprints, with Conditional Access, Identity Protection, governance, network controls and sign-in and audit logs for agents.
Why it matters: Gives each agent an accountable, least-privilege identity instead of shared accounts.
Limits: Security features for agents require Microsoft Agent 365, included in Microsoft 365 E7 and an add-on for E5, A5 and Business Premium.
Practical use cases
Staff sign in to many SaaS apps with separate passwords and inconsistent MFA.
- Approach
- Connect apps to Entra ID for single sign-on and require MFA through Conditional Access.
- Role of Microsoft Entra
- Entra ID authenticates users and enforces policy at every sign-in.
- Data, infrastructure and skills
- A plan with Conditional Access; Microsoft 365 E3 includes Entra ID P1.
- Type of benefit
- Reduced credential risk
- Caveats
- Apps that cannot use modern authentication may need Domain Services.
- First step
- List your apps and pilot single sign-on and MFA with one group.
Remote staff use a VPN to reach internal apps, which gives them broad network access.
- Approach
- Publish internal apps through Entra Private Access and apply Conditional Access per app.
- Role of Microsoft Entra
- Private Access gives per-app access without a VPN.
- Data, infrastructure and skills
- A Private Access or Entra Suite license.
- Type of benefit
- Narrower access
- Caveats
- Plan a period where the VPN and Private Access run side by side.
- First step
- Pilot one internal app with a small user group.
AI agents call company systems with shared service accounts and leave no clear audit trail.
- Approach
- Give each agent an Entra agent identity created from a blueprint and grant least-privilege permissions.
- Role of Microsoft Entra
- Agent ID provides governed identities plus sign-in and audit logs for agents.
- Data, infrastructure and skills
- An Entra tenant; Agent 365 licenses to apply Entra security features such as Conditional Access to agents.
- Type of benefit
- Accountability for agents
- Caveats
- Agents built on other platforms need the Auth SDK sidecar or workload identity federation.
- First step
- Create one agent identity blueprint for a pilot agent.
Works with
Optional integration
- Microsoft IntuneIntune relies on Entra ID for authentication and groups and sends device compliance to Conditional Access.
- Microsoft Security CopilotSecurity Copilot agents run in the Entra admin center.
- Microsoft Defender XDRDefender XDR uses Entra ID Protection signals and can revoke sessions or suspend users in Entra ID.
Complementary tools
- Microsoft Agent 365Extending Entra security features to agents requires Microsoft Agent 365.
Required by
- Microsoft Agent 365Agent identities come from Microsoft Entra Agent ID, and Entra enforces access controls for agents.
- Microsoft IntuneIntune relies on Microsoft Entra ID for authentication, groups and Conditional Access.
- Azure Virtual DesktopMicrosoft Entra ID is always used to authenticate AVD users.
- Microsoft Copilot ChatEnterprise data protection applies when users sign in with Microsoft Entra work or school accounts.
- Microsoft TeamsTeams uses identities stored in Microsoft Entra ID.
- Windows 365Microsoft Entra ID provides identity; Enterprise users need Entra ID P1.
- Microsoft 365 CopilotEnterprise Data Protection applies when users sign in with Microsoft Entra accounts.
Optional integration for
- Azure DevOpsAzure DevOps integrates with Microsoft Entra ID; the remote MCP Server requires an Entra-backed organization.
- Microsoft Defender XDRDefender uses Entra ID Protection signals and can revoke sessions or suspend users in Entra ID.
- Microsoft Security CopilotEmbedded in the Entra admin center; Microsoft-built agents can use Entra Agent ID identities.
- Azure Kubernetes Service (AKS)AKS uses Microsoft Entra ID for Kubernetes access based on identity and group membership.
- Microsoft 365 E7E7 adds the full Microsoft Entra Suite to E5 identity.
- Microsoft FoundryFoundry uses Microsoft Entra identity and RBAC for access control.
- Microsoft Foundry Agent ServiceEach agent can have a dedicated Microsoft Entra identity and appear in the Entra Agent Registry.
Relationship labels follow Microsoft's documentation. "Alternative approaches" does not mean one is better: each profile says when it fits.
Getting started
Confirm your tenant and licenses
Sign in to the Microsoft Entra admin center and check which Entra plans your Microsoft 365 or standalone licenses include.
Check: The tenant overview shows your license, for example Entra ID P1 or P2.
Protect sign-in
Create Conditional Access policies that require MFA, starting with a pilot group and then all users.
Check: Sign-in logs show Conditional Access applied to pilot users.
Turn on the Conditional Access Optimization Agent
With Entra ID P1 and Security Copilot capacity, configure the agent as Security Administrator; it runs every 24 hours.
Check: Suggestions appear on the agent page under Agents.
Plan governance and agent identities
Set up access reviews with ID Governance and register AI agents with Agent ID.
Check: Reviews are scheduled and agents show in sign-in and audit logs.
Official resources
Deciding whether you need it?
Three free tools apply Microsoft's own published guidance to your situation, and say when Microsoft Entra or any new technology is not needed.
Sources
Each statement above links to the source it comes from. Labels say who reported it.
- What is Microsoft Entra? (opens in a new tab)
- New name for Azure Active Directory (Microsoft Learn) (opens in a new tab)
- What is Microsoft Entra Agent ID? (opens in a new tab)
- Microsoft Entra plans and pricing page (opens in a new tab)
- Microsoft Entra agents (Microsoft Learn) (opens in a new tab)
- Microsoft Entra product page (opens in a new tab)
- What is Microsoft Intune? (opens in a new tab)
- Automatic attack disruption in Microsoft Defender (Microsoft Learn) (opens in a new tab)
Thank you. Your correction was sent.
The editors check it against the sources. If you left an email address, they may reply about it.