What is Microsoft Entra ID?
Also known as
Definition
Microsoft Entra ID is Microsoft's cloud-based identity and access management service. It's where your users, groups, guests, and devices live. It handles authentication (verifying who someone is) and enforces the policies that determine what they can access. Every time someone signs into Microsoft 365, Entra ID is doing the work in the background.
It's the foundation the rest of Microsoft 365 is built on. SharePoint uses Entra ID groups to control site access. Teams uses them to manage channel membership. Exchange uses them for distribution lists. Conditional access policies run through Entra ID. Access reviews are run against Entra ID. If something is wrong with your identity layer, it shows up everywhere.
tip
Review identity, guest, and group dependencies before migration. Identity comes first. Everything else follows.
Why it matters
Entra ID is not just an IT infrastructure component. The decisions made there: who exists, what groups they belong to, how authentication works. They flow through to every workload, every access decision, and every migration wave.
- Migration: Users have to exist in Entra ID at the destination before their content can move. Groups have to be mapped or permissions break on arrival. Identity comes first, everything else follows.
- Governance & security: Access reviews, conditional access policies, and guest lifecycle all run through Entra ID. When your users, groups, and guests are in good shape, governance is manageable.
- Guest collaboration: Every external guest in your Microsoft 365 environment has an account in Entra ID. That's what gives them access. If nobody reviews those accounts, guests accumulate.
Commonly confused with: SharePoint permissions
SharePoint permissions control who can access a specific site, list, or file. Entra ID provides the identities and groups that SharePoint permissions are applied to. They work together but are different layers. Fixing a SharePoint permissions problem sometimes means going back to the identity layer in Entra ID.
What we see out there
Identity mapping is a bigger migration dependency than expected.
Organizations with on-premises Active Directory synced to Entra ID find that getting group structures mapped correctly before migration is one of the hardest parts of the project. Permissions at the destination depend on it and getting it wrong means manual cleanup after the fact.
SharePoint groups that Entra ID can't see.
SharePoint groups created directly in SharePoint don't show up in Entra ID. That means IT can't run access reviews on them through standard Microsoft tooling. The governance gap between SharePoint and Entra ID catches organizations off guard, especially when they're trying to enforce least-privilege access.
Frequently asked questions
Is Entra ID the same as Azure AD?
Yes, it's the same product with a new name. Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023. The underlying technology is the same. You'll still see Azure AD referenced in older documentation, third-party tools, and everyday conversation, but Microsoft Entra ID is the current name and the one Microsoft uses going forward.
How does Entra ID relate to Microsoft 365 Groups?
Microsoft 365 Groups live in Entra ID. When you create a Team, a SharePoint site connected to a group, or a shared mailbox, an Entra ID group object is created in the background. That group controls membership across all the connected workloads. Managing groups in Entra ID means managing access across Teams, SharePoint, and Exchange at the same time.
What matters in Entra ID before a migration?
First, users need to exist in the target tenant before their content can move. Identity comes before content.
Second, groups need to be mapped correctly between source and destination, or permissions break on arrival.
Third, guests need to be reviewed: carry over only the ones that still need access, and make sure they'll have accounts in the target tenant. Skipping any of these creates cleanup work after cutover.
How does Entra ID affect guests?
Every external guest in your Microsoft 365 environment has an account in Entra ID. That account is what gives them access to Teams, SharePoint, and other workloads. If a guest account exists in Entra ID, the guest can potentially access anything they've been given permission to reach. Entra ID access reviews let you run a systematic check. It asks the person who invited the guest whether that access is still needed and removes it automatically if there is no response.
