What Entra ID Is

A client rings: nobody on their side can sign in to your system. Their staff can still open Outlook and Teams without trouble, so the problem isn't their internet or their computers. Somewhere between the sign-in button and your system, a connection to Microsoft Entra ID has stopped working. This course teaches you to find out where, to read the evidence, and to explain it to the client. This first chapter gives you the map: what Entra ID is, what lives inside it, and where the pieces you'll be troubleshooting sit.

Identity, Authentication and Authorization

Three words come up in every Entra conversation, and they are not interchangeable. Microsoft's own definitions:

Authentication comes first and authorization after it. Microsoft's documentation also notes that the information from authentication is carried in an ID token and the information from authorization in an access token. Don't worry about tokens yet; Chapter 3 follows them step by step. For now, remember the pair of questions every sign-in answers: Who are you? and Are you allowed in?

What Microsoft Entra ID Is

Microsoft Entra ID is a cloud-based identity and access management service. Microsoft describes it as providing authentication, policy enforcement and protection for users, devices, apps and resources. In plain terms it is the organisation's central list of who exists and what they may reach, together with the service that checks credentials when they try.

That makes it an identity provider (IdP): one trusted place that creates, stores and manages identity information, so that every other system doesn't have to keep its own list of usernames and passwords. Those other systems hand the sign-in to the identity provider and trust its answer. Your product, when it offers "Sign in with Microsoft", is exactly such a system.

Three consequences follow, and they explain most of this course. The decision to let someone in is made in the client's Entra tenant, not in your system. Your system's job is to ask correctly and to check that the answer really came from Entra. And when the connection between the two breaks, every user of that client is affected together, while other clients, with their own tenants, carry on as normal.

The Name: Azure AD Became Entra ID

You'll meet both names. Microsoft renamed Azure Active Directory (Azure AD) to Microsoft Entra ID. The change was publicly announced on 11 July 2023, and the new name started to appear across Microsoft experiences from 15 August 2023; plan and SKU display names changed on 1 October 2023. Microsoft says the rename was meant, among other things, to reduce confusion with Windows Server Active Directory.

A few names were deliberately not changed: Windows Server Active Directory and its related services (AD DS, AD FS), Azure AD B2C, the Azure AD Graph and Azure AD PowerShell modules (both on the path to deprecation, with Microsoft Graph and Microsoft Graph PowerShell as the replacements), and the Microsoft Authentication Library. If a document uses "Azure AD" in one of those names, it is still correct.

The Entra Family, and Where Entra ID Fits

"Microsoft Entra" is the name of a family of identity and network-access products. Microsoft Entra ID is the foundational one. The others are good to recognise, because they appear in the portal and in client conversations, but this course concentrates on Entra ID.

Tenants

Everything in Entra ID lives inside a tenant: one organisation's own, separate instance of the service. Each tenant has:

• a tenant ID, a unique identifier (a GUID) that names it,
• an initial domain name of the form something.onmicrosoft.com, created with the tenant, and
• optionally one or more custom domains, the organisation's own names, such as contoso.com.

If an organisation subscribes to Microsoft 365, Azure or Dynamics CRM Online, it is already using Entra ID: Microsoft's documentation says that every such tenant is automatically a Microsoft Entra tenant. This is why the same set of work accounts opens Outlook, Teams and, once someone has set it up, your system.

What lives inside a tenant

Entra ID and the Other Systems It Touches

Entra ID and on-premises Active Directory

Many organisations have two directories: Windows Server Active Directory Domain Services (AD DS) in their own data centre, and Entra ID in the cloud. They are related but not the same thing. Microsoft describes Entra ID as an identity-as-a-service solution for apps across cloud and on-premises, where AD DS was built for managing on-premises infrastructure.

Organisations that have both usually run Microsoft Entra Connect, which syncs identities from AD DS to Entra ID so people use one account in both places. For your purposes, remember that modern sign-in integrations talk to Entra ID, not to AD DS. If a client says "it's our Active Directory", that is a prompt to find out whether they mean the on-premises directory, Entra ID, or the sync between them.

Entra ID, Microsoft 365 and Azure

Microsoft 365 and Azure use Entra ID for their own sign-in; they are customers of the same service your integration uses. The licence level of the tenant (Entra ID Free, P1 or P2, or Microsoft Entra Suite) decides which features exist. Microsoft 365 E3 includes Microsoft Entra ID P1 and Microsoft 365 E5 includes Microsoft Entra ID P2. The licence matters to this course in one practical way: it limits some features and how long some logs are kept, which Chapter 7 covers precisely.

Entra ID and your system

Your system is neither Microsoft 365 nor Active Directory. It is an application that relies on the client's Entra ID to sign people in. In identity vocabulary it is a "relying party", although you'll more often hear "the application" or "the integration". Chapter 2 explains how it is registered with the tenant and what the different integration types are.

Whose Side Is It?

An integration has two ends, and troubleshooting starts by working out which end is at fault and who owns it. In broad terms:

Where You Manage Entra ID

You can see and manage Microsoft Entra in three web portals, per Microsoft's documentation:

• the Microsoft Entra admin center, https://entra.microsoft.com, the dedicated portal;
• the Azure portal, https://portal.azure.com, where Microsoft Entra ID appears as a service; and
• the Microsoft 365 admin center.

Administrators can also automate it through Microsoft Graph and the Microsoft Graph PowerShell module. As a support engineer you will mostly be reading the portal, often together with the client's administrator, so the first practical skill is finding which tenant you are looking at.

Finding the tenant ID

These are the steps Microsoft documents. You need to sign in as at least a Global Reader.

Terms to Keep Handy

Hands-On Exercises

All three use fictional organisations. Do not paste real tenant IDs, secrets or client names into notes you share.