Microsoft Entra ID
The cloud identity provider every Azure subscription trusts. Users, groups, service principals, devices and the tenant boundary all live here.
Readiness
0%
2h 30m baseline
Exam memorization points
- A tenant is a dedicated Entra ID instance. One tenant can trust many subscriptions, but a subscription trusts exactly one tenant at a time.
- Entra ID is not on-premises Active Directory: no OUs, no Group Policy, no LDAP. It speaks modern protocols (SAML, WS-Fed, OpenID Connect, OAuth 2.0).
- Editions: Free, P1 (Conditional Access, self-service group management, dynamic groups), P2 (adds Identity Protection and Privileged Identity Management).
- Member users vs guest users (B2B). Guests are invited and can be governed by access reviews and cross-tenant access policies.
- Custom domain names must be verified with a DNS TXT or MX record before the domain can be used.
- Security defaults give everyone free baseline MFA. Conditional Access requires at least P1 and is the exam's expected answer for granular policies.
Traps & distractors
- Treating Entra ID as a lift-and-shift of on-premises AD. Questions about GPO or OU delegation are about AD DS, not Entra ID.
- Assuming Global Administrator also grants Azure resource access. The role can elevate itself to User Access Administrator, but by default it has no data-plane or resource permissions.
- Forgetting that a tenant cannot be deleted while any subscription or active directory-dependent service still points at it.
- Dynamic groups are an Entra ID P1 feature - a rule cannot be created on the Free tier.
Suggested lab
Bootstrap a tenant with users, groups and self-service password reset
Practise the identity objects the exam expects you to create and reason about, and verify which features are licence-gated.
- 1Create a tenant-scoped resource group and five users: two member, one guest (invite an external address), one administrator, one break-glass account.
- 2Create a security group with an assigned membership, then a Microsoft 365 group, and note the difference in membership model.
- 3Enable self-service password reset for a group and register authentication methods.
- 4Create a Conditional Access policy (needs a trial P1 licence) that requires MFA for administrators, and report-only it first.
- 5Assign a custom domain and verify ownership with a DNS TXT record.
Microsoft Learn
- What is Microsoft Entra ID?doc
- Search Microsoft Learn: Microsoft Entra ID tenant licensing Conditional Accesssearch
Live Microsoft Learn ingestion is a Sprint 2 item; until then links are curated and the search fallback always resolves.
Status
No time invested yet. Baseline assumptions only.
Self-assessed mastery
0%
Critical priority
High-yield and still weak. Study this next.
- Exam importance100% × 30% = 30.0
Learner-agnostic frequency on the real exam (5/5).
- Blueprint weight100% × 25% = 25.0
This topic's domain carries 22.5% of the exam objectives.
- Dependency leverage100% × 20% = 20.0
29 later topics depend on it.
- Current gap100% × 25% = 25.0
Readiness is 0%, so 100% of the topic is still uncovered.
Exam Priority Score = 30% importance + 25% blueprint + 20% dependency + 25% gap. Importance is exam frequency, blueprint is the domain's official exam weight, dependency is how many later topics this one unlocks, and gap is how far you currently are from ready.
Prerequisites
Foundation topic - no prerequisites.
Baseline study time
2h 30m
Complexity
3 / 5
Remaining to target
2h 8m
Status weight
0%
Topics: tenant, directory, b2b, guest, licensing, conditional access, sspr
Weak neighbours in Identities