---
name: entra-id
description: "Guidance for Microsoft Entra ID (formerly Azure AD) — cloud identity and access management and the control plane for Zero Trust. Covers tenant and identity model, authentication methods (passkeys, FIDO2, certificate-based), hybrid identity with Entra Connect or Cloud Sync, app registrations and consent governance, groups and administrative units, break-glass accounts, and Zero Trust identity foundations. WHEN: Microsoft Entra ID, Azure AD, identity provider setup, SSO, hybrid identity, Entra Connect, Cloud Sync, authentication methods, passwordless, passkey, FIDO2, certificate-based auth, app registration, enterprise application, illicit consent grant, break-glass account, emergency access, administrative units, SSPR, password writeback. DO NOT USE for risk-based detection (use entra-id-protection), Conditional Access design (use conditional-access-mfa), PIM (use azure-pim), or identity governance lifecycle (use entra-id-governance)."
license: MIT
metadata:
  author: Microsoft
  version: "0.1.0"
---

# Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is the cloud identity and access
management service that authenticates users, devices, and workloads. It is the control plane
for Zero Trust and the foundation every other Microsoft security control assumes is healthy.

## When to use
Establishing the identity foundation: tenants, users/groups, authentication methods, SSO for
apps, and hybrid identity with on-premises Active Directory. Use this skill **before**
configuring Conditional Access, Identity Protection, or PIM - they all assume a clean Entra
ID baseline.

**Do not use this skill** for risk-based sign-in detection (`entra-id-protection`), policy
enforcement (`conditional-access-mfa`), just-in-time admin roles (`azure-pim`), or lifecycle
workflows (`entra-id-governance`).

## Map the identity goal to the right Entra control

| If the goal is... | Use | Notes |
|---|---|---|
| Sync on-prem AD users to cloud | **Entra Cloud Sync** (preferred new) or **Entra Connect Sync** | Cloud Sync is lighter, no server farm |
| Federate sign-in to on-prem | **AD FS** (legacy) or **Pass-Through Authentication** | Avoid new AD FS deployments; prefer PHS + WHfB |
| Replace passwords | **Passkeys (FIDO2)** > Windows Hello for Business > Microsoft Authenticator passwordless | Phishing-resistant only |
| Single sign-on to SaaS | **Enterprise Applications** (gallery or non-gallery) | OIDC > SAML where supported |
| Self-service password reset | **SSPR** with cloud writeback (hybrid) | Requires Entra ID P1 |
| Delegated admin scoped to a region/BU | **Administrative Units** | Combine with custom roles for least privilege |
| App calls Microsoft Graph or another API | **App Registration** + delegated/application permissions | Require admin consent workflow for risky scopes |
| Emergency tenant access if MFA breaks | **Break-glass accounts** (2x cloud-only, excluded from CA) | Hardware FIDO2 only; alerted on every sign-in |

> **Rule of thumb:** if you are about to type a username and password into a Microsoft service
> in 2026, stop. Move to passkeys or WHfB. Password reuse + phishing is still the #1 root
> cause in identity incident response.

## Approach

1. **Tenant & identity model** — Decide cloud-only vs hybrid. Define naming conventions for
   users, groups (assigned vs dynamic), and administrative units. Block guest invites at
   tenant level by default; allow per-collaboration scenario.
   *Verify: `Get-MgPolicyAuthorizationPolicy` shows `allowedToCreateApps = false` for default
   users; admin consent workflow is enabled.*

2. **Hybrid identity** — Choose **Entra Cloud Sync** for new deployments (agent-based,
   lightweight, supports disconnected forests). Use **Entra Connect Sync** only if you need
   PHS + write-back features Cloud Sync doesn't yet support. Avoid new AD FS - it adds an
   on-prem dependency and an attack surface (MDI sensor required).
   *Verify: `Get-MgDirectoryOnPremisesSynchronization` shows healthy sync; password hash sync
   enabled.*

3. **Authentication methods - move to phishing-resistant** — Manage via the **Authentication
   methods policy** (replaces legacy MFA + SSPR registration policies). Roll out in this
   order: Authenticator (push + number matching) → WHfB on managed devices → FIDO2 passkeys
   for admins → broad passkey rollout. Disable SMS as a primary method.
   *Verify: `User Registration Details` report shows > 90% of users with at least one
   phishing-resistant method.*

4. **Applications & consent governance** — Use the gallery for SSO where available. Enable
   **admin consent workflow** so users request high-risk permissions instead of granting them.
   Run the **Risky Apps** report monthly. Apply least-privilege Graph permissions and review
   app credentials (secrets vs certs vs federated identity).
   *Verify: no consented apps with `Application.ReadWrite.All` or `Directory.ReadWrite.All`
   outside the approved list.*

5. **Self-service & lifecycle** — Enable SSPR with writeback for hybrid users. Configure My
   Account / My Apps. Use dynamic groups for attribute-driven membership (department, country,
   employeeType).

6. **Break-glass accounts** — Create **two** cloud-only emergency access accounts. Exclude
   from all Conditional Access policies. Authenticate only with FIDO2 hardware keys stored
   physically separately. Alert on every sign-in via Sentinel.
   *Verify: monthly sign-in test from each break-glass account; alert fires within 5 minutes.*

7. **Block legacy auth and weak methods** — Use Conditional Access (separate skill) to block
   legacy authentication protocols (POP, IMAP, SMTP AUTH, basic auth). Disable SMS / voice
   as primary MFA methods.

## Guardrails
- **Break-glass accounts are sacred.** Two of them, cloud-only, hardware FIDO2, excluded from
  every CA policy, monitored on every sign-in. Test monthly. If you skip this, you can lose
  the tenant in a CA misconfiguration.
- **Avoid new AD FS deployments.** It's an on-prem identity dependency, an attack surface,
  and a maintenance burden. PHS + WHfB covers nearly every requirement.
- **Block legacy authentication.** POP, IMAP, SMTP AUTH, basic auth bypass MFA. Block via
  Conditional Access, then monitor the sign-in logs for stragglers for 30 days.
- **Govern app consent.** Illicit consent grants are how attackers stay resident after
  password reset. Enable the admin consent workflow and review the Risky Apps report.
- **Don't use group-based licensing as the only assignment mechanism for admin accounts.** If
  the group sync breaks, admins lose their licence and access. Direct-assign for break-glass
  and tier-0 admins.
- **Cloud Sync is preferred over Connect Sync for new builds.** Lighter, no server farm, fewer
  failure modes.

## Common anti-patterns
- **"We use SMS for MFA - it's good enough"** - SMS is phishable and SIM-swappable. Treat as
  recovery factor only, never as primary.
- **"One break-glass account in Keepass"** - Single point of failure and not auditable. Two
  hardware-key accounts with separated custody.
- **"Federated sign-in via AD FS because that's how we always did it"** - In 2026 this adds
  cost and risk. Move to PHS + Conditional Access unless there's a specific federation
  requirement.
- **"Allow user app consent for all permissions"** - Tenant gets cluttered with risky
  consented apps. Enable admin consent workflow.
- **"Don't bother with Administrative Units, just use global admin"** - Breaks separation of
  duties and bypasses RBAC. Scope helpdesk and regional admins to AUs.
- **"Disable security defaults but skip Conditional Access for a week"** - Tenant is wide
  open during that gap. Enable CA policies before disabling defaults.

## Example prompts
- `Design a hybrid identity model with Entra Cloud Sync and password hash sync.`
- `Plan a rollout from passwords to passkeys for 5,000 users.`
- `Configure break-glass accounts for our Entra tenant and the monitoring alert.`
- `Move users off SMS MFA - what's the migration path?`
- `Prevent illicit consent grants in our Entra ID tenant.`
- `Configure SSPR with writeback for a hybrid environment.`
- `When should I use Administrative Units vs custom roles for delegated admin?`

## Microsoft Learn
- Overview: https://learn.microsoft.com/entra/fundamentals/whatis
- Entra Cloud Sync: https://learn.microsoft.com/entra/identity/hybrid/cloud-sync/what-is-cloud-sync
- Authentication methods policy: https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods
- Passkeys (FIDO2): https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passwordless
- Break-glass accounts: https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access
- Admin consent workflow: https://learn.microsoft.com/entra/identity/enterprise-apps/configure-admin-consent-workflow
- Administrative Units: https://learn.microsoft.com/entra/identity/role-based-access-control/administrative-units
- Block legacy authentication: https://learn.microsoft.com/entra/identity/conditional-access/policy-block-legacy-authentication
- Zero Trust identity: https://learn.microsoft.com/security/zero-trust/deploy/identity