Microsoft Entra ID
The new name (since 2023) for Azure Active Directory — Microsoft’s cloud-based identity provider. The foundation of every modern Microsoft environment: single sign-on, MFA, Conditional Access and device identity.
What is Microsoft Entra ID?
Microsoft Entra ID is Microsoft’s cloud-based identity and access management (IAM) service. It manages users, groups, roles, device assignments and authentication against thousands of cloud and on-premises applications.
Entra ID is the foundation of every modern Microsoft environment. Microsoft 365, Azure and Dynamics — but also third-party applications such as Salesforce, Workday and Zoom — use Entra ID for sign-in and authorisation.
Do not confuse: Entra ID is not the same as classic on-premises Active Directory (AD DS). It uses different protocols (SAML and OAuth instead of Kerberos and LDAP) and is cloud-native from the ground up. The two can nevertheless be synchronised (Entra Connect).
Entra ID editions
| Edition | What is included | In which licences |
|---|---|---|
| Entra ID Free | Basic SSO, Security Defaults | M365 Apps for Business |
| Entra ID P1 | Conditional Access, MFA, Group-based App Access | M365 E3, A3, Business Premium |
| Entra ID P2 | Identity Protection, PIM, Risk-based Policies | M365 E5, A5 |
| Entra ID Governance | Access Reviews, Entitlement Management | An add-on, including to E5 |
| External ID (B2B/B2C) | Guest access, partner integration, custom applications | Separate licensing |
The three ways devices join Entra ID
| Join type | When | What it means |
|---|---|---|
| Entra Registered | BYOD, personal devices | The device knows Entra, but sign-in stays local |
| Hybrid Entra Joined | Classic on-premises AD plus Entra | The device sits in both directories |
| Entra Joined | A modern workplace, cloud-first | Entra only — no on-premises AD needed |
Entra joined is the future
For new setups Microsoft clearly recommends Entra Joined. Every feature — Windows Hello, Autopilot, Intune, Conditional Access — works natively. On-premises AD is then only needed for legacy applications (Kerberos applications, file servers).
Relevant for AVD: Since 2023 AVD session hosts can be Entra joined. That means no on-premises AD is needed and no hybrid setup complexity. It simplifies AVD deployments enormously.
Hybrid scenarios: Entra Connect
Most organisations still have classic Active Directory on-premises. The bridge to Entra ID is Microsoft Entra Connect (formerly “Azure AD Connect”):
- Password Hash Sync — passwords are hashed in on-premises AD and synchronised to Entra
- Pass-Through Authentication — sign-in is checked against on-premises AD in real time
- Federation with ADFS — for complex policies (increasingly deprecated)
Entra Connect Sync runs every 30 minutes, so changes in on-premises AD show up in Entra promptly. New since 2023: Entra Cloud Sync as a cloud-hosted alternative without a local sync server.
Entra ID in the DaaS world
Windows 365
Windows 365 Cloud PCs have to sit in Entra ID (or hybrid). Without Entra, Windows 365 does not work at all.
Azure Virtual Desktop
AVD supports all three join types:
- Hybrid AD DS — classic, with domain controllers on-premises or Azure AD DS
- Entra Joined — modern, cloud identities only, since 2023
- Mixed — different host pools with different join types
Identity features for DaaS
- Single Sign-On (SSO) — one sign-in for AVD, Windows 365, Microsoft 365 and every connected application
- MFA — additional protection for sessions
- Conditional Access — for example “AVD only from Germany, and not from jailbroken devices”
- Windows Hello for Business — passwortloser Login in Cloud-PCs
Entra-ID-Patterns in DaaS Maps
DaaS Maps shows Entra ID integration patterns for modern DaaS setups. For discussion of identity strategy in Microsoft environments, you will find me on LinkedIn.