Azure Active Directory is now Microsoft Entra ID — Microsoft’s cloud identity service for users, sign-in, SSO, MFA and access control. A scalable design rests on a few habits: one well-planned tenant, access through groups, least-privilege admin roles with PIM, MFA for everyone, Conditional Access, clean hybrid sync and regular access reviews.
📑 On this page · 6 sections
What is Microsoft Entra ID?
Identity
Users, groups, devices, service principals and managed identities.
Authentication
Passwords, passwordless, MFA and SSO.
Authorisation
Who can access which apps and Azure resources.
Security
Conditional Access, risk policies, sign-in logs.
Entra ID works with Microsoft 365, Azure and thousands of SaaS applications.
Scalability challenges and trade-offs
✕ Managing users, groups and apps by hand
✕ Inconsistent permissions across teams
✕ Too many Global Administrators
✕ Messy on-premises AD to cloud connection
✕ Slow, unsafe onboarding and offboarding
✕ Weak audit and compliance trail
• Central identity for cloud and SaaS apps
• SSO and MFA built in
• Conditional Access policies
• Scales to very large organisations
• Integrates with Microsoft 365 and Azure
• Conditional Access and PIM need P1/P2 licences
• Hybrid setups add complexity
• Poor early design is hard to clean up
8 steps to a scalable Entra ID design
Tenant strategy
One production tenant for most organisations; separate tenants only for strong isolation.
Groups, not individuals
Assign access to groups. Dynamic groups add and remove members automatically.
Least-privilege admins
Specific roles instead of Global Admin; PIM for just-in-time access.
Strong authentication
MFA for everyone, moving towards passwordless.
Conditional Access
Policies by user, device, location and risk; block legacy auth.
Hybrid identity
Entra Connect or Cloud Sync, with password hash sync where possible.
Governance
Access reviews, entitlement management and lifecycle workflows.
Apps and workloads
Register apps properly, use managed identities, avoid long-lived secrets.
🪪 Want to practise Entra ID, RBAC, Conditional Access and PIM in labs? Join a free Azure Admin demo class.
Book a free demoExample designs by size and industry
Small business
One tenant, groups per team, MFA for all, security defaults or basic Conditional Access.
Growing company
Dynamic groups, SSO for SaaS apps, Conditional Access by device and location.
Enterprise
Hybrid sync, PIM for admins, access reviews, administrative units for regional IT.
| Industry | Focus |
|---|---|
| Banking, healthcare | Strict Conditional Access, PIM, logging, regular access reviews |
| Education | Many student accounts; automate provisioning from school systems |
| Tech & start-ups | Fast onboarding, SSO for many SaaS apps, strong developer access controls |
Monitoring and measuring your identity design
• Review sign-in and audit logs regularly
• Track the identity secure score and follow its recommendations
• Monitor risky sign-ins and risky users (Entra ID Protection, P2)
• Send logs to Log Analytics or Microsoft Sentinel for alerting
✅ ✅ Remember: Good identity design is a habit, not a one-time project. Review roles, groups and policies every quarter.
Related reading
See Azure Admin roles and responsibilities, Key Vault explained and Azure Admin certification.
Frequently asked questions
Is Azure Active Directory the same as Microsoft Entra ID?
Yes. Microsoft renamed Azure AD to Microsoft Entra ID. Features and concepts are the same.
How many tenants should I have?
Most organisations need one production tenant. Use extra tenants only for strong isolation needs.
What is Conditional Access?
Policies that allow, block or require extra checks (like MFA) based on user, device, location and risk.
What is PIM?
Privileged Identity Management gives admins just-in-time, time-limited access to roles instead of permanent rights.
Do I need Entra ID P1 or P2?
P1 is needed for Conditional Access; P2 adds PIM and Identity Protection. Basic features are free.