Microsoft Entra ID is Microsoft’s cloud-based identity and access management service. It was previously called Azure Active Directory, or Azure AD, and was renamed in 2023. It handles sign-in and access for Microsoft 365, Azure and thousands of other cloud applications.

What is Entra ID used for?

It gives organisations a central place to manage users, groups, devices and applications in the cloud. It authenticates people, applies policies such as conditional access and MFA, and provides single sign-on to cloud and on-premises applications.

How does Entra ID relate to Microsoft 365?

Microsoft 365 uses Entra ID for sign-in. A compromised Entra ID account is therefore also access to email, files and collaboration tools, which is why attackers value it so much.

How is Entra ID different from Active Directory?

Active Directory is mostly used in on-premises Windows environments and relies on domains and domain controllers. Entra ID is built for the cloud and works with modern protocols and web applications. It is not simply Active Directory hosted in the cloud, although the two are often used together.

What is hybrid identity?

Many organisations synchronise their on-premises Active Directory with Entra ID, so that the same identities work in both. It makes access simple, and it also links the two worlds. A compromised on-premises account can become a cloud problem, and a cloud compromise can reach back to on-premises systems.

Which identities does Entra ID manage?

• Users and guests.
• Groups and roles.
• Devices.
• Applications and their service principals, which are non-human identities.
• Managed identities used by cloud workloads.

What are Entra ID roles?

Roles define administrative permissions. The most powerful, such as Global Administrator, control the whole tenant. The recommended approach is to keep these roles few, assign them only when needed and for a limited time, and to review who holds them.

What are service principals and managed identities?

A service principal is the identity an application uses in Entra ID, and a managed identity is one that Azure manages for a workload. Both are non-human identities. They can hold powerful permissions and long-lived secrets, and they are often forgotten once the project ends.

Why do attackers target Entra ID?

It is the entry point to cloud applications and data. Attackers use phishing, stolen session tokens, MFA fatigue and malicious application consent to get in, and then look for privileged roles such as Global Administrator. A single account with broad cloud roles can open mail, files and infrastructure at once.

How do MFA and conditional access protect Entra ID?

MFA and conditional access policies decide who can sign in and under which conditions. They are essential, but they act at sign-in. They do not show what an account does afterwards, and attackers who steal a session token can bypass the sign-in step altogether.

What are common weaknesses?

• Too many accounts with powerful administrative roles.
• Legacy authentication that bypasses MFA.
• Applications granted broad permissions that nobody reviews.
• Service principals with long-lived secrets.
• Guest accounts that stay active after a project ends.
• Gaps in MFA coverage.

What are the warning signs of Entra ID abuse?

• Sign-ins from new locations or devices for privileged accounts.
• New roles assigned outside normal change windows.
• New applications or permissions granted to an app.
• Sudden changes to MFA methods.
• Unusual activity by service principals.

How do you reduce Entra ID risk?

Keep administrative roles few and temporary, enforce MFA and conditional access, review application permissions, retire guest and dormant accounts and treat role changes as security events.

Sharelock gives continuous visibility on identities and privileges, including non-human ones, and monitors the behaviour that follows sign-in, so risky access and unusual activity surface early.