Microsoft Entra ID Explained

Microsoft Entra ID (formerly Azure Active Directory) is Azure's cloud-based identity and access management service, and identity questions make up a meaningful share of the AZ-900 governance domain.

At its core, Entra ID authenticates users — confirms they are who they claim to be — and authorises access to resources and applications, including Azure itself, Microsoft 365, and thousands of third-party SaaS applications that support it. It is the identity backbone underlying most of Microsoft's cloud ecosystem.

A common point of confusion is the relationship between Entra ID and on-premises Active Directory (AD DS). They are separate identity systems — one cloud-native, one traditionally on-premises — but organisations commonly synchronise them using a tool like Microsoft Entra Connect, so employees have one consistent identity across both environments. This is called hybrid identity.

Multi-factor authentication (MFA) requires more than one verification method before granting access — typically something you know (a password) combined with something you have (a code from an authenticator app or a phone prompt). This significantly reduces the risk of a compromised password alone leading to unauthorised access.

Conditional Access goes further than MFA alone — it applies context-aware policies based on signals like the user's location, the device they're using, or the assessed risk level of the sign-in attempt. A common example: requiring MFA only when someone signs in from an unfamiliar location, while allowing seamless sign-in from a recognised corporate network.

The exam often distinguishes these by asking which specific feature addresses a described requirement. A requirement for 'a second verification step' points to MFA. A requirement for 'different security rules depending on where or how someone signs in' points to Conditional Access — a broader, more flexible policy engine than MFA alone.