Microsoft Entra ID

Overview

Microsoft Entra ID is the identity plane of the Microsoft estate, and the first thing to get right is its name. It was renamed from Azure Active Directory in August 2023, with SKU names following that October, and Azure AD is now wrong.

What distinguishes it from a standalone identity provider is that you probably already own it. Every Microsoft 365, Azure and Dynamics tenant is already an Entra tenant, and the free tier comes with those subscriptions.

It is cloud-only. There is no self-hosted directory, and reach into on-premises Active Directory is through a synchronisation agent rather than by running the service yourself.

Entra is a family rather than a product, spanning governance, network access, verified credentials, external identity and workload identity, each licensed separately, which is where most budgeting mistakes begin.

The commonest of those mistakes is assuming governance comes with the premium tier. Lifecycle workflows, account discovery and machine-assisted access certifications need Entra ID Governance, a separate product, not P2.

The bundle above it, Entra Suite, is also not a substitute for a base licence. It requires P1 or a package containing it underneath, so it adds to rather than replaces the per-user subscription.

Its current direction is agent identity. Entra Agent ID reached general availability in April 2026, giving agents their own identities and templates, and speaking the emerging agent protocols alongside OAuth.

Read the agent licensing carefully though, because the security controls are gated separately. Conditional access and identity protection for agents require Microsoft Agent 365, not the premium identity tiers.

Two dated facts to check against older guidance. Azure AD B2C has not been purchasable by new customers since May 2025, the successor being External ID with monthly-active-user billing, free to the first fifty thousand.

Key features and capabilities

The same headings are used for every identity & access entry, so two tools can be read side by side.

Identity and directory

• A cloud multi-tenant directory with published object ceilings, 50,000 without a verified domain and 300,000 with one
• Dynamic membership groups, naming and expiry policies, and administrative units for delegated scope
• External and guest identity through Entra External ID; legacy Azure AD B2C closed to new customers in May 2025
• Workload identities are applications, service principals and managed identities, the last free of licence charge
• Device identity covers joined, registered and hybrid-joined devices, and agents are now a distinct object type

Authentication and single sign-on

• Unlimited single sign-on to gallery and custom applications is included in the free tier
• Multi-factor methods are tiered, with the authenticator app free but fraud alert, trusted IPs and on-premises MFA needing P1
• Passwordless covers Windows Hello, the authenticator app and FIDO2 keys, with passkeys and synced passkeys generally available since March 2026
• Conditional access requires P1 and risk-based conditional access requires P2, with a ceiling of 240 policies per tenant
• Self-service password reset is free but writing passwords back to on-premises directories requires P1

Authorisation and policy

• Built-in directory roles are free; custom roles require P1 for every holder, capped at 100 definitions per tenant
• Entitlement management and access packages are largely an Entra ID Governance capability rather than a P2 one
• Privileged Identity Management for just-in-time elevation requires P2 or Entra ID Governance
• Access reviews start at P2, but machine-assisted certifications and catalogue reviews are governance-only
• Licences are counted per participant, so approvers and reviewers consume entitlements too

Provisioning and lifecycle

• Automated user provisioning to software services is free, but group, on-premises, API-driven and HR-driven provisioning need P1
• Joiner-mover-leaver automation through lifecycle workflows requires Entra ID Governance, capped at 50 workflows
• Published HR sources include Workday, SAP SuccessFactors, Oracle HCM and a generic API-driven connector for any system
• Self-service portals cover groups, applications and access requests, the access portal requiring P2 or above
• The synchronisation agent is free but its health monitoring requires P1, and Microsoft is migrating customers to cloud sync

Standards and protocols

• OAuth 2.0 and OpenID Connect are the primary protocols, issuing access, identity and refresh tokens as signed web tokens
• SAML and SCIM are both supported, with SCIM 2.0 service APIs generally available since March 2026
• Federation covers AD FS and third-party providers, with domainless SAML federation generally available in June 2026
• Kerberos, NTLM and LDAP are not native; they come from the separate Domain Services product billed by the hour
• Workload identity federation covers pipelines and Kubernetes, and agent scenarios add the newer agent protocols

Integrations

• The application gallery is no longer published as a count, only as a marketplace to browse
• Named data platform integrations include Snowflake, Azure Databricks, Tableau Cloud, MongoDB Atlas and Amazon Managed Grafana
• Cross-cloud identity integration covers AWS IAM Identity Center and Google Cloud provisioning
• Generic connectors extend reach to SQL Server, Oracle, Db2, MySQL and Postgres, and to any LDAP directory
• Microsoft Graph is the supported API surface; the older directory API and authentication library are deprecated

Where it runs and what it costs

• Cloud only, with no self-hosted option for the directory itself
• Government cloud support is documented feature by feature, with governance available in the higher assurance clouds
• Some capabilities are absent from government clouds, including threat intelligence risk detection and delegated user management
• Data residency for external identity is an add-on currently limited to two countries
• Pricing units vary by product, from per user and per workload identity to per active user, per hour and per transaction

Pricing

SubscriptionFree tier included with Microsoft cloud subscriptions

Tiered per user per month as Free, P1 and P2, with Free included in any Microsoft cloud subscription. A caveat matters for budgeting: the Azure retail price interface publishes no per-user rate for Free, P1, P2, Entra Suite, Entra ID Governance or Workload ID. What is published there covers external identity at no charge to fifty thousand monthly active users then fractions of a cent each, governance for guests at $0.75, provisioning calls at $0.002, identity verification checks at $0.25, and Domain Services from $0.15 to $1.60 per hour by tier. No trial length is published.

Vendor pricing page →

Demos and videos

• Microsoft Entra ID beginner's tutorial Tutorial · YouTube
• Microsoft Entra Agent ID explained Tutorial · YouTube
• Conditional access optimisation agent Product demo · YouTube

About Microsoft

Entra ID is built and operated by Microsoft Corporation and sold as part of the Microsoft cloud rather than as a standalone identity company's product. Note what this profile deliberately omits: the documentation and Azure domains that publish the product detail carry no corporate figures at all, so revenue, employee count, customer count and acquisition history are recorded as not published rather than restated from elsewhere. What those pages do establish is the operating surface, namely the Entra admin centre for administration and Microsoft Graph as the supported programmatic interface, with the older directory API deprecated. The product line is continuously delivered, so there is no version number to cite, only dated release notes.

Redmond, Washington · microsoft.com