Topic 1 of 5
Microsoft Entra ID and identity types
Entra ID is Microsoft's cloud identity service. Here you'll see what it is, how it's organized, what each license includes, and the identity types it handles: users, workloads, AI agents, devices, and groups.
Contents
What is Microsoft Entra ID?
It's Microsoft's cloud-based identity and access management service. It lets employees, guests, workloads, and AI agents sign in and access the resources they need.
Internal resources
Apps on the corporate network and intranet, and cloud apps developed by the organization itself.
External services
Microsoft 365, the Azure portal, and any SaaS apps the organization uses.
- It provides a single identity system for cloud and on-premises apps.
- It can sync with on-premises Active Directory, with other directories, or be used standalone.
- It enables secure use of personal devices and collaboration with partners and customers.
IT admins
Control access to apps and resources based on business needs; for example, require MFA for important resources.
Developers
Add SSO to their apps with a standards-based approach and use APIs to build experiences with organizational data.
Subscribers
Anyone with Azure, Microsoft 365, or Dynamics 365 already has Entra ID and can extend it with premium licenses.
Identity Secure Score
A percentage showing how well you align with Microsoft's security recommendations. It's in all editions of Entra ID, with improvement actions tailored to your configuration. It helps measure identity posture, plan improvements, and check their effect.
Tenant, directory, and multitenant
Tenant
An instance of Entra ID holding a single organization's information: users, groups, devices, app registrations, and access and compliance policies. It has a unique ID and a domain (contoso.onmicrosoft.com) and is a security and administrative boundary.
Directory
A logical container inside the tenant that stores and organizes identity objects, like a database or catalog. Used interchangeably with tenant: a tenant has only one directory.
Multitenant
An organization with more than one Entra ID instance. Typical reasons: subsidiaries or units operating independently, mergers and acquisitions, or different residency regulations by region.
Editions and licensing
The exam often asks which license a feature requires. Summary based on the Microsoft Entra licensing documentation:
| Features | Minimum license |
|---|---|
| Security defaults, SSPR, audit and sign-in logs, managed identities, Verified ID | Free (included with Azure, Microsoft 365…) |
| Conditional Access, custom roles, SSPR with writeback, MFA for on-premises apps, trusted IPs | P1 |
| ID Protection and risk-based Conditional Access, PIM, core access reviews and entitlement management | P2 |
| Lifecycle workflows, machine learning-assisted reviews, automatic assignment policies | Microsoft Entra ID Governance |
| Private Access, Internet Access, ID Governance, ID Protection, and premium Verified ID together | Microsoft Entra Suite |
- P1 is included in Microsoft 365 E3 and Business Premium, among others; P2 in Microsoft 365 E5.
- Built-in roles are free; custom roles require P1 for every user with an assignment.
- Managed identities have no licensing requirement.
- Microsoft Entra Connect (sync) is free with the Azure subscription.
User identities
Identities can be assigned to three things: people (user identities), devices, and software objects like apps, VMs, services, and containers (workload identities). Devices and workloads are grouped as machine identities.
Users represent employees and external people (customers, consultants, vendors, partners) and are classified on two axes:
How they authenticate
Internal: they have an account in the host organization's Entra ID. External: they use another Entra account, a social identity, or another provider.
UserType property
Describes the relationship to the tenant: Member or Guest. By default, guests have fewer privileges than members.
| Internal authentication | External authentication | |
|---|---|---|
| Member | Internal member: employees | External member: users from another tenant in the same large organization with member access |
| Guest | Internal guest: an internal account created for an external user and marked as Guest. Legacy scenario | External guest: consultants, vendors, and partners with their own account |
External guests and external members are B2B collaboration users and are part of external identities (see the hybrid and external identities article).
Workload identities
A workload identity is assigned to software so it can authenticate to and access other services. Protecting them matters because a workload may handle several credentials that must be stored securely, and it's hard to know when an identity was created or when it should be revoked. Microsoft Entra Workload ID helps with that. In Entra they are applications, service principals, and managed identities.
Applications and service principals
A service principal is essentially an application's identity. The app is first registered in Entra ID; then a service principal is created in each tenant where it's used, which enables its authentication and authorization. The developer has to manage and protect its credentials.
Managed identities
A type of service principal that Entra ID manages automatically: the developer doesn't handle credentials. They connect to Azure resources that support Entra authentication and have no extra cost.
| System-assigned | User-assigned | |
|---|---|---|
| How it's created | Enabled on the resource (for example, a VM) | As a standalone Azure resource |
| Lifecycle | Tied to the resource: delete the resource and Azure deletes the identity | Independent: it must be deleted explicitly |
| Resources that use it | Only that resource | One or several |
Microsoft Entra Agent ID
Unlike an app that runs predetermined logic, an AI agent analyzes data, takes actions, and interacts with other systems on its own. That brings its own risks:
Larger attack surface
They interact with external systems and are vulnerable to attacks like prompt injection.
Permission risk
They're often given broad permissions and can do more than needed.
Uncontrolled sprawl
Agent sprawl: temporary agents that stay in production with permissions nobody reviews.
Agent ID gives agents dedicated identities, distinct from workload identities, with two key concepts:
Agent identity blueprint
A reusable template that defines a class of agent (for example, "Sales assistant"). It sets its classification, holds the credentials to create instances, and lets you apply policies to every agent of that type.
Agent identity
An instance created from a blueprint, with a unique ID, a name, and a sponsor (the accountable person or group). It has no credentials of its own: the blueprint acquires tokens on its behalf.
- Attended (on-behalf-of): the agent acts for a user with the delegated permissions that user grants.
- Unattended: the agent acts under its own authority, roles, and permissions, with no user present.
- It integrates with Conditional Access, ID Protection, ID Governance, and the agent registry, which gives visibility into every agent in the tenant.
- It's platform-agnostic: it also governs agents built outside Microsoft.
- Entra ID blocks agents from receiving many high-privilege roles and permissions, following least privilege.
- Agent ID is available to all Entra customers; extending security features to agents requires Microsoft Agent 365.
Device identities
A device is hardware: phones, laptops, servers, or printers. Its identity gives information for access or configuration decisions, for example in a Conditional Access policy.
Entra registered
BYOD and mobile: the user accesses organization resources from a personal device.
Entra joined
Joined with an organizational account that is then used to sign in. Usually organization-owned.
Hybrid joined
For organizations with on-premises AD: joined to on-premises AD and Entra ID at once. Requires an organizational account to sign in.
Registering or joining devices gives SSO to cloud and on-premises resources. Tools like Microsoft Intune control how the organization's devices are used.
Groups
If several identities need the same access, you create a group and assign permissions to the group instead of one by one. This aligns with the Zero Trust principle of limiting access to only those who need it.
| Group | Used for | Possible members |
|---|---|---|
| Security | The most common. Access to shared resources and the target of policies such as SSPR or Conditional Access | Users (including external), devices, other groups, service principals, and agent identities |
| Microsoft 365 | Collaboration: shared mailbox, calendar, files, and SharePoint sites | Users only (including external) |
Assigned membership
Members are selected manually.
Dynamic membership
Rules that add and remove identities automatically based on their attributes.
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| An outside consultant authenticates with their own account and shows up as Guest | External guest | External authentication and UserType Guest. |
| Users from a subsidiary with another tenant need member access | External member | They authenticate externally, but with UserType Member. |
| A VM needs to access Key Vault without storing credentials in code | Managed identity | Entra ID manages the credentials; no extra cost. |
| Several Function Apps must share the same identity | User-assigned managed identity | It's a standalone resource assignable to several resources. |
| A personal laptop accesses Microsoft 365 | Entra registered device | BYOD scenario. |
| Corporate computers joined to on-premises AD and to Entra ID | Hybrid joined | Joined to both directories. |
| Group members must change automatically when a user's department changes | Dynamic membership | Rules that add and remove members based on attributes. |
Common exam traps
❓ A managed identity must survive deletion of the VM that uses it and be shared across several VMs. Which type?
User-assigned. A system-assigned identity is deleted with the resource and belongs only to it.
❓ Can a Microsoft 365 group contain devices?
No. Users only. Security groups do support devices, service principals, and agent identities.
❓ Can a tenant have several directories?
No. An Entra tenant has a single directory; that's why the terms are used interchangeably.
❓ Do managed identities require a premium license?
No. They have no licensing requirement and are used at no extra cost.
❓ Does an agent identity have its own credentials?
No. The blueprint acquires tokens on its behalf.
❓ Does Identity Secure Score require P2?
No. It's available in all editions of Entra ID.
❓ Are custom Entra roles free?
No. They require P1. Built-in roles are free.
Did you get this topic?
Test what you just learned
A developer wants their app on an Azure VM to read secrets from Key Vault without storing any credentials in code. What should they use?
Ready to test "Entra ID and identity types"?
Original questions, each with a full explanation.
Start a mock examSign in to save your progress.