What Is Microsoft Entra ID? A Guide for Business Owners

Microsoft Entra ID is the identity service behind Microsoft 365. Every time someone signs in to Outlook, Teams or SharePoint, Entra ID checks who they are, applies your sign-in rules and decides what they can reach. It was called Azure Active Directory until Microsoft renamed it in 2023; the service, features and licensing did not change. If you have Microsoft 365, you already have Entra ID.

Why it matters to a business owner

Your Entra ID directory is effectively the master key list for the firm. It holds every employee account, every guest from outside the company, every administrator and every app that has been given access to your data. If that list is wrong, out of date or too generous, the strongest firewall in the world does not help.

Many identity problems in small firms are housekeeping, not hacking: former employees whose accounts still work, too many people with full admin rights, and guests nobody remembers inviting. Entra ID is where you find and fix them.

What Entra ID does

Free, P1 and P2 at a high level

Microsoft sells Entra ID in tiers. The summary below reflects Microsoft's documentation as of this writing; features and bundles change, so confirm against Microsoft's current pricing pages.

Admin roles and least privilege

Global Administrator can change almost everything in your tenant. Microsoft recommends assigning it to fewer than five people and using narrower roles for day-to-day work, such as Helpdesk Administrator for password resets or User Administrator for creating accounts. That idea, giving people only the access they need, is called least privilege.

In practice, admins should also use a separate admin account for admin work, protected by strong MFA, rather than their everyday mailbox account. Microsoft also recommends two cloud-only emergency access accounts so a misconfigured sign-in rule cannot lock everyone out.

If you still have an on-premises server

Many firms that once ran a Windows server still have Active Directory on-premises and sync those accounts to Entra ID. That is called hybrid identity. Microsoft offers two sync tools: Microsoft Entra Connect Sync, an application installed on a server, and Microsoft Entra Cloud Sync, which uses lightweight agents managed from the cloud.

Microsoft recommends Cloud Sync for new setups and, as of this writing, is moving eligible organizations from Connect Sync to Cloud Sync in phases, notifying each organization when its turn comes. Very old Azure AD Connect version 1 installations are retired and unsupported. If your firm has moved files and email to the cloud, it may be worth asking whether you still need the on-premises directory at all.

A practical Entra ID checklist

Take a 20-person law firm that has been on Microsoft 365 for six years. A yearly review would cover:

Common mistakes

How NexJen can help

We offer a fixed-scope Microsoft Entra ID consulting engagement. It is advisory: a read-only review of your directory, admin roles, MFA coverage, guests, app consent and sync setup, followed by written, risk-rated findings, a roadmap and a readout call. We do not change your tenant under consulting; implementation is quoted separately or can be folded into our NexJen Essentials managed plan.

The engagement is open to any business, with no long-term contract. We quote it based on your tenant size and scope.

Common questions