What is Microsoft Entra ID?

Entra ID in plain English

Picture a large office complex. At the entrance, a reception desk checks IDs and issues access cards. Each card opens exactly the doors its holder is authorized to use. The house rules define who may enter which rooms and when. Microsoft Entra ID is that reception desk – for your cloud applications.

Every organization has its own isolated area in Entra ID, called a tenant. It holds the user accounts, groups, guest access, and the rules for access. When someone signs in to Microsoft 365, for example for email or file storage, they are actually signing in to Entra ID.

Despite its former name, Entra ID is not “Active Directory in the cloud.” Classic Active Directory runs on your own servers in the corporate network and uses protocols such as Kerberos. Entra ID, by contrast, works with web standards such as OAuth 2.0, OpenID Connect, and SAML. These standards let applications rely on a central service to confirm a user’s sign-in.

How Entra ID works

1. Sign-in: A person enters their username and password and, ideally, confirms with a second factor, such as an app or a security key.
2. Verification: Entra ID checks the details and applies Conditional Access rules: Is the device known? Where is the sign-in coming from? Has multi-factor authentication (MFA) been completed?
3. Token: If everything checks out, Entra ID issues a digital access ticket called a token. It opens connected applications without the user having to sign in again – the principle of single sign-on.
4. Roles: Administrator roles define who can manage what. The most powerful is the “Global Administrator,” who can change practically everything in the tenant.
5. Applications: Programs also receive identities and permissions, for example to access mailboxes or files. These are known as app registrations.
6. Synchronization: In many organizations, Microsoft Entra Connect synchronizes the accounts from the on-premises Active Directory with the cloud. This hybrid identity connects both worlds – for better and for worse.

A practical example

Here’s a typical scenario: An engineering firm uses Microsoft 365, and MFA is enabled for all employees – with one exception. The account that the multifunction printer uses to send scans by email was excluded from the policy, and its password is weak. During a password spraying attack, in which attackers try common passwords against many accounts, the password turns out to be a match.

In the account’s mailbox, the attacker finds scanned invoices. In the firm’s name, the attacker then sends fake invoices with altered bank details to customers. The subsequent investigation reveals further weaknesses: too many Global Administrators, including the account of a former employee, and an old app with read access to all mailboxes.

Why does this matter for businesses?

For many organizations, Entra ID is the master key to email, files, chats, cloud resources, and other applications. Anyone who takes over an account gets direct access to data – without needing access to the corporate network at all. And because the service is reachable over the internet, attackers anywhere in the world can launch sign-in attempts.

Many risks stem from the configuration of your own tenant. The organization itself is responsible for this, not Microsoft. Typical issues include MFA that isn’t enforced consistently, exceptions in Conditional Access, legacy sign-in methods without MFA, too many Global Administrators, app registrations with excessive permissions, and forgotten guest accounts. On top of that comes token theft via phishing pages that silently position themselves between the victim and the real sign-in page. Basic MFA methods don’t reliably protect against this.

In hybrid environments, both worlds are linked: whoever compromises the on-premises Active Directory may be able to attack the cloud via synchronization – and vice versa.

How to protect your organization

• MFA without gaps: Enforce MFA for all accounts. At least for administrators, prefer phishing-resistant methods such as FIDO2 security keys or passkeys, which don’t work on fake sign-in pages.
• Block legacy methods: Block sign-in protocols that don’t support MFA.
• Review exceptions: Document every exception in Conditional Access and review it regularly.
• Limit admin rights: Assign the Global Administrator role only to a few dedicated admin accounts, and store emergency access accounts securely.
• Control apps and guests: Review the permissions of app registrations and remove orphaned guest and user accounts.
• Secure synchronization: Protect the server running Entra Connect as strictly as your domain controllers, the central sign-in servers of Active Directory.
• Analyze logs: Monitor sign-in and audit logs for anomalies.

How Rootsektor can help

In our Microsoft 365 & Azure Review, we check your tenant for misconfigurations – from Entra ID and Conditional Access to email, file storage, and your Azure resources. Read-only permissions are all we need; we don’t change any settings. On request, we assess hybrid environments together with an Active Directory security assessment. You can request your fixed-price quote via our Pentest Quote page – you’ll receive it within 24 hours of scoping (on business days).