Microsoft Entra ID, formerly Microsoft Azure Active Directory, is y̶e̶t̶ a̶n̶o̶t̶h̶e̶r̶ c̶o̶n̶f̶u̶s̶i̶n̶g̶ M̶i̶c̶r̶o̶s̶o̶f̶t̶ r̶e̶b̶r̶a̶n̶d Microsoft’s solution for identity and access management across their organizations. This cloud-based tool helps sysadmins provide employees secure access to external resources (such as Microsoft 365) and manage user identities.
In short, both Active Directory and Microsoft Entra ID strive to accomplish the same mission — to manage identities and access in an environment — but how they do this is different, and for good reason.
Allow me to read your mind for a moment. You’re thinking, “Why did Microsoft do this to us? Why is it so complicated?” Well, dear reader, in this (wait for it) ever-evolving landscape where employees can work from Ireland for a company based in California, it has to be a little more complicated.
We’ll dig into this soon — but first, the basics.
What is Microsoft Entra ID?
The oversimplified explanation of Entra ID making its rounds across the internet is that it’s exactly like Active Directory but with cloud capabilities. But frankly, that definition is a little too oversimplified. Microsoft Entra ID is more than just the cloud or hybrid alternative to the historically on-prem Active Directory.
Spicy take 🌶️ : Comparing Active Directory to Microsoft Entra ID is like comparing a 2001 Subaru Outback to a Tesla.
Active Directory is reliable and capable of letting you do what you need to do to configure your environment. The important stuff is there. It’s served many sysadmins well through the years.
But you can make (or destroy) the world in Microsoft Entra ID.
You have an overwhelming number of tools at your disposal when you log in to Microsoft Entra. Finding the basics in Microsoft Entra ID isn’t the same navigational process you could do blindfolded in Active Directory. But just like learning how to use the fancy displays in a Tesla, once you figure out what lives where, Microsoft Entra ID is a powerful tool.
It’s also worth explicitly stating that Microsoft Entra ID is Microsoft’s entry (is that where “Entra” came from?!) into the identity-as-a-service (IDaaS) space. We’ll get to that in just a moment.
Why the name change from Azure AD to Entra ID?
Your guess is as good as mine, my sysadmin friend.
Just kidding. In July 2023, Microsoft’s James Casey blogged about the rebrand, stating that it’s “part of our commitment to simplify secure access experiences for everyone.”
So anyway, there’s your daily belly laugh. And if you really want your coworkers to think you’ve lost your mind because you’re cackling so hard, scroll down to the comments on the blog. Have an inhaler handy. You’ll need it.
What is Active Directory?
Active Directory is any sysadmin’s old friend. It’s a Windows domain services tool (based on Lightweight Directory Access Protocol, or LDAP) that allows you to set permissions and make groups for the users and assets in your environment. Using LDAP enables you to control the sharing of network resources.
For example, when a user logs on to their work computer, they enter credentials that Active Directory (or more specifically, the domain controller) checks to make sure the user ID matches the user attributes stored in Active Directory. If the credentials are valid, the domain controller gives the login a thumbs up, letting the user access their desktop.
What’s the difference between Active Directory and Microsoft Entra ID?
There are quite a few notable differences between Active Directory and Microsoft Entra ID — in fact, Microsoft produced a handy table to describe some of the key differences between the two. (Clear as mud? That's “chef’s kiss” in Microsoft!)
For example, let’s go back to our password/MFA scenario. Both Microsoft Entra ID and Active Directory offer credential management — but in different ways. Active Directory works with your on-prem domain controller to verify passwords or certificates.
Microsoft Entra ID, on the other hand, offers a few more security measures for credential management. It supports MFA and even passwordless logins (such as through an authentication app) to make logging in more secure. You can also configure more sophisticated parameters around passwords with Microsoft Entra ID. (No more solarwinds123 passwords for us. Yay!)
You shall not pass
Our on-prem friend, Active Directory, is your friendly but strict neighborhood nightclub bouncer (physical layer of security). He checks the IDs (user attributes) of everyone who wishes to enter against the approved guest list (domain controller). If they match, the door opens (you can log in). If they don’t match, you’re turned away (you can’t log in). And if they don’t match enough times, you might get kicked to the curb (locked out of your account).
Compare that to the poor bouncer who services the global nightclub (Microsoft Entra ID). Because users may not be physically present (they're remotely logging in), the bouncer needs a few more security checks (methods of authentication) to make sure folks are who they say they are. His brass knuckles (geolocation) help him spot and quickly turn away unusual guests trying to enter from a weird location (the employee from Ireland tries to connect with an IP address from New York). His grizzly Rottweiler (conditional access policies) helps him sniff out oddities that aren’t allowed in the club (Windows 2000 and below). And his stylish earpiece (compliance policies) helps him listen to see who gives the right password to enter (not using password123 as your password).
Active Directory versus Microsoft Entra ID FAQ
Why did Microsoft rebrand Azure Active Directory to Microsoft Entra ID?
Microsoft rebranded Azure Active Directory to Microsoft Entra ID to maintain consistency with its Entra product line, released in 2022.
Now that you’ve spit your coffee out, let me elaborate. Microsoft bundles all its identity and access management features under the Entra product line, so it changed the name of Azure Active Directory to Microsoft Entra ID to minimize confusion. (I know, I know.)
Is Azure Active Directory the same as Active Directory?
No, Azure Active Directory is not the same as Active Directory. (Stay with me here!) Azure Active Directory (now Microsoft Entra ID) is a Microsoft product with cloud capabilities. Active Directory, on the other hand, is an on-prem tool used to configure access within a local network (e.g., giving users access to a local printer).
For example, you can set user permissions for Microsoft 365 using Azure Active Directory — but not with Active Directory, unless you use a syncing tool (AD Connect) that helps Azure Active Directory and Active Directory “talk” to each other.
What are the differences between Microsoft Entra ID and Azure Active Directory?
According to Microsoft, the only difference between Microsoft Entra ID and Azure Active Directory is the name. What used to be known as Azure Active Directory is now Microsoft Entra ID.
(Only the little troll who changes the names of everything weekly knows the real answer, though.)
PDQ Connect and Microsoft Entra ID
If you’re a PDQ Connect user (and if you’re not, you should totally check it out if you’re a cloud or hybrid shop), you may be excited to learn that we now integrate seamlessly with Microsoft Entra ID! You can integrate PDQ Connect with Microsoft Entra ID to capture the information in your Active Directory — giving you one less thing to worry about in your already worry-filled day.
