Microsoft Entra

Microsoft Entra is a collection of services that answers a single question: Who is allowed in here? When an employee switches on their company laptop in the morning and enters their password, a service like this checks in the background whether the person really belongs to the company. Afterward, the same service decides which programs and files this person may open. The head of accounting can access salary lists, an intern cannot. You can picture Entra as the digital reception desk of a large office building. It knows all the badges, checks them at the entrance, and knows exactly which doors each badge opens.

The Badge for Half the Office World

Microsoft estimates that several hundred million people sign in via Entra every day. Nearly every company that uses Microsoft 365 — that is, Word, Excel, Outlook, and Teams as an online service — is automatically connected to Entra. This makes the service one of the most important control points in the daily work of many companies and government agencies.

This central role is both practical and risky at the same time. Practical, because an employee only has to sign in once and can then use all programs. Risky, because an attacker with a stolen login gains access not just to one program, but to all of them at once. This is precisely why criminals prefer to attack sign-in services rather than individual applications.

For investors and observers of the tech industry, Entra is also a business model. The better security features are found in more expensive subscription tiers. For Microsoft, security is thus a revenue driver, not merely a mandatory feature. Critics consider it problematic that basic protective functions cost money.

From Password to Access Decision

At the center is a directory — that is, a large list of all user accounts, groups, and devices of an organization. This directory is called Entra ID and was named Azure Active Directory until 2023. In older guides and news articles, you will therefore often still read Azure AD, referring to the same product.

When someone signs in, Entra ID checks the details and then issues a digital ticket, known in technical jargon as a token. The program sends this ticket along with every request, similar to a wristband at a festival. The individual service then never has to see the password itself. It only checks whether the ticket is genuine and still valid.

So that a stolen password alone is not enough, Entra usually requires a second proof. This is often a confirmation via a smartphone app. There are also rules that assess the circumstances of the sign-in: a known company device and the usual country mean few additional prompts, while an unfamiliar computer from abroad means additional hurdles or a block instead. Microsoft calls these rules conditional access.

Entra in School, Work, and Headlines

Many schools and universities use Microsoft 365. Anyone who signs in there with a school address to Teams or OneDrive is using Entra without knowing the name. The Sign in with Microsoft button on third-party websites also leads to this service.

In the news, Entra mainly appears in connection with security incidents. In 2023, attackers gained access to the email accounts of US government agencies via a stolen signing key. Cases like this show how much depends on a single sign-in service. They are also the reason why regulators are scrutinizing Microsoft’s security practices more closely.

A common misconception is that Entra is antivirus software. It is not. Entra takes care of identities and permissions — that is, the question of who is allowed to do what. Other products fight malware on a computer, at Microsoft that would be Defender, for instance. Entra’s direct competitor is called Okta and essentially does the same thing, just without its own Office suite in the background.