Cloud AD — Microsoft Entra ID

A beginner-friendly guide to running your identity directory in the cloud with Microsoft Entra ID (formerly Azure AD)

1. What is Microsoft Entra ID?

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access service. If on-prem Active Directory is the badge office in your building, Entra ID is the same badge concept hosted in Microsoft's cloud — no server to buy, no DC to run, and it is what signs you into Microsoft 365, Azure, and thousands of other apps.

🏢 Analogy — Bank Account vs a Credit Card Network
On-prem AD is like running your own bank: you buy the building, the vault, the staff. Entra ID is like joining a global payment network instead — the clearing house, security, and uptime are all managed for you, and you only worry about your own accounts. Same idea (identity + rules), but you don't operate the infrastructure.

🎯 Real-World Examples

Scenario	Without a cloud directory	With Entra ID
Employee joins	Create + configure an account on every app	One user in Entra ID — sign-in works across all connected apps
Sign into Microsoft 365	Manual or voucher-based accounts	SSO — one password, plus MFA
Access from anywhere	VPN into the office network	Sign in wherever you are — no VPN needed

2. Why choose a cloud directory? (The Benefits)

☁️ Zero infrastructure
No servers, no licences to manage — Microsoft runs everything.

🔑 SSO everywhere
One sign-in for thousands of cloud apps: Microsoft 365, Shopify, Salesforce, and more.

📱 MFA built in
Strong multi-factor authentication for every account, no extra setup per user.

🚦 Conditional Access
Rules like "only allow sign-ins from trusted devices or regions".

🌍 Works from anywhere
Users sign in wherever they are — no VPN back to the office.

🔁 Hybrid friendly
Syncs with your on-prem AD, so you get the best of both worlds.

3. On-prem AD vs Entra ID vs Other Cloud Directories

Feature	Windows Server AD	Entra ID (cloud)	Auth0 / Okta
Where it runs	Your own server	Microsoft's cloud	Cloud (SaaS)
Focus	Managing network & domain computers	Cloud sign-in & app access	App authentication (developer focus)
Protocols	LDAP, Kerberos	OAuth 2, OpenID Connect, SAML	OAuth 2, OpenID Connect, SAML
Devices	Domain-joined PCs you own	Microsoft 365, Azure, Windows 11 (Entra join)	Apps, not devices
License	Windows Server + CAL	Free tier, then P1/P2 per user	Per-user / per-CI

🏢 Analogy — Property Manager vs. Tenant
If AD on-prem is owning and managing an office building, Entra ID is renting premium space in Microsoft's complex — the plumbing, security guards, and maintenance are the landlord's job. Okta/Auth0 are property managers with flexible floorplans for apps you build. Choose by whether you own devices (AD), use MS cloud apps (Entra), or build apps and want login-for-anyone (Okta/Auth0).

4. Entra ID + Your Existing AD (Hybrid)

You don't have to choose between your on-prem Active Directory and the cloud — the standard approach is a hybrid setup: keep AD as the source of truth for users, and sync that identity to Entra ID.

🔌 How the sync works

Entra Connect Sync (cloud tool) runs inside your network next to your AD.
It continuously copies users, groups, and passwords (hashes) from AD up to Entra ID.
Employees get one identity: same username works on-prem and in the cloud.
You manage the authoritative copy in AD; the cloud is the shadow copy for the Microsoft ecosystem.

If you have no Windows server, you can run Entra ID alone, with Entra ID as the only directory.

5. Core Concepts

6. Step-by-Step: Try Entra ID

Term	What it is
Tenant	Your isolated "namespace" in Entra ID — one per organisation
User	An account for a person (or service) that can sign in
Group	A collection of users used to assign licenses and access in bulk
Conditional Access	Policy rules deciding when/where access is allowed
SSO	Single sign-on — authenticate once, no repeated passwords
MFA	Multi-factor auth — password plus authenticator app, SMS, or phone
Enterprise App	A registered app (e.g. ServiceNow) that can accept Entra ID sign-ins

Create a free tenant

Go to entra.microsoft.com (or the Microsoft 365 admin centre), sign in with any Microsoft account, and start a trial of Microsoft 365 or create a free Entra ID tenant.

Add a user

In the portal: Users → All users → New user. Fill in name, username, and initial password. That's your first cloud identity.

Create a group and assign

Groups → New group, then add the user. Groups are how you later target MFA policies and app permission grants.

Turn on MFA

Under Security → MFA, enable enrollment for the group. Users will register an authenticator on next sign-in.

Add a Conditional Access policy

Protection → Conditional Access → New policy. Example: "Require MFA for all users" or "Block sign-ins from unexpected regions".

Sync your on-prem AD (optional)

Install Microsoft Entra Connect on a server that can reach your Windows AD, configure Azure AD Sync, and your on-prem users start appearing as cloud users.

7. Quick Reference

8. Best Practices

Item	What it does
`entra.microsoft.com`	The Entra admin portal
Users	Manage identities (create, edit, delete, guest)
Groups	Assign access & license to many people at once
Conditional Access	Policy rules for sign-in (MFA, devices, location)
Enterprise apps	Connect apps to Entra ID for SSO
Microsoft Entra Connect	Sync on-prem AD → Entra ID

🔐 MFA for everyone
Turn on MFA by default — most of the cost, huge security win.

🚦 Conditional Access over deny-all
Write rules that adapt to risk (location, device) instead of blanket blocks.

🔭 Least-privilege roles
Nobody is "Global Admin for life" — give just enough permission per role.

🔁 Sync, don't duplicate
Use Microsoft Entra Connect so on-prem AD stays the one source of truth.

📊 Audit constantly
Watch sign-in logs & identity risk reports in the cloud.

🧱 Guard the tenant
Your Entra tenant is the crown jewels — protect the tenant owner account like a root credential.

Entra ID is what happens when AD's "badge office" moves to the cloud and leaves the servers behind.
Try it free — one tenant, a few users, and you'll see the whole model.

☁️ Cloud AD — Microsoft Entra ID