Microsoft Entra ID: identities, Conditional Access, MFA and identity protection
In short: Microsoft Entra ID is the cloud identity service behind Microsoft 365 and Azure. It holds users, groups, devices and app identities, and Conditional Access uses signals such as location, device health and sign-in risk to decide whether to allow access, demand MFA or block.
What Entra ID is
Microsoft Entra ID, formerly called Azure Active Directory, is Microsoft's cloud identity and access management service. Every Microsoft 365 and Azure customer has at least one tenant: a dedicated directory for the organisation. It is not the same as on-premises Active Directory Domain Services; it speaks modern protocols such as OpenID Connect, OAuth 2.0 and SAML rather than Kerberos and LDAP. Many organisations sync on-premises accounts into it with Microsoft Entra Connect or Cloud Sync.
Managed identities deserve a special mention: they let an Azure resource, such as a VM or function, get tokens without any stored secret.
MFA and authentication methods
| Method | Phishing resistant? | Notes |
|---|---|---|
| Passkeys (FIDO2 keys or device-bound) | Yes | Best choice for admins and high-risk users |
| Windows Hello for Business | Yes | Tied to a managed device |
| Certificate-based authentication | Yes | Uses smart cards or device certificates |
| Microsoft Authenticator push with number matching | Partly | Good baseline, but can be phished by proxy attacks |
| SMS or voice codes | No | Weakest; vulnerable to SIM swap and interception |
Use authentication strengths in Conditional Access to demand phishing-resistant methods for administrators. Microsoft also now enforces MFA for sign-ins to Azure management portals and tools.
Conditional Access
Conditional Access (CA) policies are "if this, then that" rules. They need Microsoft Entra ID P1 licences or above. A sensible starting set:
- Require MFA for all users.
- Require phishing-resistant MFA for admin roles.
- Block legacy authentication protocols that cannot do MFA.
- Require a compliant or hybrid-joined device for sensitive apps.
- Block or restrict sign-ins from countries you never operate in.
- Exclude two monitored emergency "break-glass" accounts so you cannot lock yourself out.
Tip: start new policies in report-only mode, check the sign-in logs for impact, then switch them on.
Identity protection and privileged access
- Microsoft Entra ID Protection (P2) scores user risk and sign-in risk using signals such as leaked credentials, impossible travel and anonymous IP addresses. Risk-based CA policies can then demand MFA or a secure password change.
- Privileged Identity Management (PIM) makes admin roles eligible rather than permanent; people activate them just in time, with approval and a reason.
- Access reviews ask owners to confirm regularly who still needs access, including guests.
- Monitor sign-in and audit logs, ideally in a SIEM such as Microsoft Sentinel.
Practise safely in the Azure MFA and Conditional Access lab with a test tenant.
Practice
Why should you block legacy authentication?
What is a break-glass account?
How does PIM reduce risk?
Key takeaways
- Entra ID is Microsoft's cloud identity service for Microsoft 365 and Azure.
- Prefer phishing-resistant MFA, especially for admins.
- Conditional Access combines signals into allow, MFA or block decisions.
- Block legacy auth and keep monitored break-glass accounts.
- Use ID Protection, PIM and access reviews to manage risk and privilege.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.