DevOps PeachEditions
| Edition | What it adds (cumulative) |
|---|---|
| Free | Users/groups, SSO to unlimited apps, MFA through security defaults, B2B; 50,000 objects by default (300,000 with a verified domain) |
| Included with Microsoft 365 | Extra identity features for Microsoft 365 |
| P1 | Conditional Access, advanced hybrid, dynamic groups, group-based licensing, SSPR with writeback to on-prem AD |
| P2 | Identity Protection (sign-in risk), Privileged Identity Management, access reviews |
flowchart LR F["Free"] --> P1["P1<br/>+ Conditional Access<br/>+ dynamic groups"] --> P2["P2<br/>+ Identity Protection<br/>+ PIM"]
Microsoft Entra join
Joins Windows devices directly to the tenant (no domain controller): sign-in with company accounts, SSO to SaaS apps, Windows Hello for Business, Enterprise State Roaming (settings sync), only compliant devices reach apps (with Conditional Access), and on-premises resources stay reachable.
Self-Service Password Reset (SSPR)
- Choose who may use it: nobody, a group, or everyone.
- Choose the number of methods required (1 or 2) and the methods: Authenticator app, email, SMS/phone, security questions.
- Require users to register their methods at next sign-in.
Traps: Conditional Access needs P1; Identity Protection is P2 only. The Free limit is on objects, not on SSO apps.
| Command | Meaning |
|---|---|
az ad signed-in-user show |
The account you are signed in as (check before configuring SSPR for yourself) |
Three ways a device relates to Entra ID
| State | Typical device | Sign-in |
|---|---|---|
| Microsoft Entra registered | Personal phone or laptop (BYOD) | Personal account on the device, work account added for apps |
| Microsoft Entra joined | Company-owned Windows device, cloud-first | Work account signs in to Windows |
| Microsoft Entra hybrid joined | Existing domain-joined PC | Joined to AD DS and registered in Entra ID at the same time |
Devices managed by Intune can report compliance (encryption on, OS up to date), and Conditional Access can require a compliant device before opening company apps.
Authentication methods
Beyond passwords, Entra ID supports the Microsoft Authenticator app (push or passwordless), FIDO2 security keys, Windows Hello for Business, SMS and voice, and temporary access passes for onboarding. Microsoft recommends phishing-resistant methods such as FIDO2 and Windows Hello for admins. SMS is the weakest option.
More on SSPR
- Password writeback (P1) sends a reset done in the cloud back to on-premises AD, so hybrid users have one password.
- Administrators always have SSPR enabled with stronger requirements, regardless of your settings.
- The combined registration page lets users set up MFA and SSPR methods in one step.
Licensing in practice
Licences can be assigned per user or, with P1, to a group so new members get them automatically. Microsoft Entra ID Governance is a further add-on for entitlement management and lifecycle workflows.