What Microsoft Entra ID Is — Tenants, Subscriptions and Identities

Azure Basics · Identity – Microsoft Entra ID (Azure AD), Users and Groups · Lesson 1 of 5

Entra ID (formerly Azure AD) manages identities in the cloud; the tenant is the organisation's "directory", the subscription is the billing unit for resources.

Microsoft Entra ID (formerly Azure AD, renamed in 2023) is Microsoft's cloud identity and access service. It handles sign-in (authentication), application management and SSO, device management, and hybrid identity (sync with on-premises AD).

Term	Meaning
Identity	Something that can authenticate: a user, an application (service principal), a managed identity
Account	An identity plus its data (profile, groups, licences)
Tenant (= directory)	One dedicated Entra ID instance for an organisation, with a tenant ID and a domain such as `example.com`
Subscription	The billing agreement for Azure resources; each subscription trusts exactly one tenant

flowchart TB
  T["Tenant example.com<br/>(users, groups, apps)"] --> S1["Subscription sub-devops-lab"]
  T --> S2["Subscription sub-prod"]
  S1 --> RG1["Resource group rg-devops-lab"]
  S2 --> RG2["Resource group rg-web-prod"]

A tenant is created when an organisation signs up for a Microsoft cloud service; an organisation can have several tenants (a test tenant, for example).
A tenant has many subscriptions; a subscription belongs to one tenant at a time.
Common trap: a tenant is not a subscription. The tenant answers "who are you", the subscription answers "who pays for this resource".

Command	Meaning
`az account show`	The default subscription and its `tenantId`
`az account list -o table`	Every subscription you can access

Objects in a tenant

Object	What it represents
User	A person, internal (member) or invited (guest)
Group	A set of users, devices, or service principals
App registration	The global definition of an application you build
Enterprise application (service principal)	The app's instance in one tenant, where you grant access and assign users
Managed identity	An identity Azure creates for a resource such as a VM or Function, with no secret to store
Device	A registered or joined computer or phone

A system-assigned managed identity lives and dies with one resource; a user-assigned one is a standalone resource you can attach to several. Prefer managed identities over storing client secrets in code.

Domains

Every tenant starts with a domain like contoso.onmicrosoft.com. You add a custom domain such as example.com by creating a TXT or MX record that Entra ID asks for, which proves you own the DNS zone. Users then sign in as alice@example.com.

Securing sign-in

Multi-factor authentication (MFA) asks for a second proof, such as the Authenticator app. Security defaults switch on baseline MFA for the whole tenant at no cost. Conditional Access (P1) builds rules such as "require MFA from outside the office" or "block legacy authentication".

Command	Meaning
`az login --tenant example.com`	Sign in to a specific tenant
`az ad sp list --display-name myapp`	Find a service principal
`az identity create -g rg-devops-lab -n id-app`	Create a user-assigned managed identity