Azure Active Directory (Microsoft Entra ID) Interview Questions and Answers – 200 Questions Quick Revision (Part 1: Questions 1–100)

📘 Microsoft Entra ID Interview Questions and Answer Series

These questions and answers are designed for quick interview revision. The answers are intentionally concise and interview-focused, making them useful for last-minute preparation and refreshing important Microsoft Entra ID concepts.

This article is Part 1 of our 200 Microsoft Entra ID Interview Questions and Answers – Quick Revision series.

Part 1: Questions 1–100
Part 2: Questions 101–200

Part 1 covers Questions 1–100.

📚 Series Navigation

Part 1: Questions 1–100 | Part 2: Questions 101–200

📚 What You’ll Learn in Part 1

• Section 1 – Azure AD / Microsoft Entra ID Fundamentals
• Section 2 – Users and Groups
• Section 3 – Authentication & Identity
• Section 4 – Microsoft Entra Connect
• Section 5 – Conditional Access

📚 What You’ll Learn in Part 2

• Section 6 – Applications & Enterprise Applications
• Section 7 – Roles & RBAC
• Section 8 – External Identities
• Section 9 – Security
• Section 10 – Monitoring & Troubleshooting
• Section 11 – Scenario-Based Interview Questions
• Section 12 – Advanced Interview Questions

Section 1 — Azure AD / Microsoft Entra ID Fundamentals

1. What is Azure Active Directory?

Azure Active Directory (Azure AD) was Microsoft’s cloud-based identity and access management (IAM) service used to manage users, groups, applications, devices, authentication, and access to cloud resources.

Note: Azure AD was renamed Microsoft Entra ID in 2023.

2. What is Microsoft Entra ID?

Microsoft Entra ID is Microsoft’s cloud-based identity and access management service. It provides authentication, authorization, SSO, MFA, user and group management, application access, and identity-based security for Microsoft cloud services and other applications.

3. What is the difference between Azure AD and Microsoft Entra ID?

There is no separate service. Azure Active Directory (Azure AD) was renamed Microsoft Entra ID in 2023. The name and branding changed, while existing tenants, users, applications, and configurations continued to work.

4. What is a Microsoft Entra ID Tenant?

A Microsoft Entra tenant is a dedicated identity environment that represents an organization or organizational boundary. It contains identities such as users, groups, devices, applications, and other directory objects.

Each tenant has a unique Tenant ID.

5. What is an Azure AD Directory?

An Azure AD Directory was the former name for a Microsoft Entra ID directory. It is the directory within a tenant that stores and manages identity objects such as users, groups, devices, and applications.

6. What is the difference between a Tenant and a Directory?

In most practical Microsoft Entra ID contexts, Tenant and Directory refer to the same organization’s identity environment, which is why the terms are often used interchangeably.

For interview purposes:

Tenant = the overall Microsoft Entra identity environment
Directory = the directory containing the tenant’s identity objects

7. What is a Microsoft Entra ID domain?

A Microsoft Entra domain is a DNS-based namespace associated with a tenant, used primarily for identifying users and organizations. A tenant receives an initial onmicrosoft.com domain and can also have verified custom domains.

8. What is the default onmicrosoft.com domain?

When a Microsoft Entra tenant is created, Microsoft provides an initial domain such as:

contoso.onmicrosoft.com

It is used as the tenant’s initial namespace and can be used for users and other Microsoft 365 identities.

9. What is a custom domain in Microsoft Entra ID?

A custom domain is an organization’s own verified domain, such as:

contoso.com

It can be added to Microsoft Entra ID so users can sign in with familiar organizational names such as:

user@contoso.com

The domain must be verified before it can be used.

10. What is a Microsoft Entra ID User?

A Microsoft Entra ID User is an identity object representing a person or identity in the tenant. Users can authenticate to Microsoft services and applications and can be assigned permissions to access resources.

11. What is a Guest User?

A Guest User is an external identity invited into a Microsoft Entra tenant to collaborate with the organization.

For example, an external consultant can be invited as a guest and given access to specific applications or resources without becoming an internal employee identity.

12. What is a Member User?

A Member User is a user who is considered part of the organization’s internal directory membership. Member users typically represent employees or other users belonging to the organization.

The important distinction is:

Member = internal organizational identity
Guest = external identity invited for collaboration

13. What is a Microsoft Entra ID Group?

A Microsoft Entra ID Group is a collection of users or other supported directory objects that can be managed together.

Groups are commonly used to simplify access management, such as assigning application access or Azure RBAC permissions to a group instead of individual users.

14. What is the difference between Security Groups and Microsoft 365 Groups?

Security Groups are primarily used for access and permission management, such as assigning application access or Azure RBAC roles.

Microsoft 365 Groups are designed for collaboration and can provide shared resources such as a mailbox, calendar, files, and other Microsoft 365 services.

In short:

Security Group → Access control
Microsoft 365 Group → Collaboration

15. What is a Subscription?

An Azure Subscription is a logical and billing boundary for Azure resources. Azure resources such as virtual machines, storage accounts, and databases are created within subscriptions.

A subscription is also associated with a Microsoft Entra tenant for identity and access management.

16. What is the difference between an Azure Tenant and an Azure Subscription?

A Microsoft Entra Tenant is primarily an identity and access boundary, while an Azure Subscription is primarily a resource and billing boundary.

For example:

Tenant → Users, Groups, Applications, Identities
Subscription → VMs, Storage, Databases, Azure Resources

One tenant can be associated with multiple Azure subscriptions.

17. Can one tenant have multiple Azure subscriptions?

Yes. A single Microsoft Entra tenant can be associated with multiple Azure subscriptions.

Organizations commonly use multiple subscriptions for separating environments, departments, projects, billing, or administrative boundaries.

18. Can one Azure subscription be associated with multiple tenants?

No, not simultaneously. An Azure subscription can trust only one Microsoft Entra directory/tenant at a time.

However, the subscription’s directory association can be changed to another tenant when appropriate.

19. What is an Object ID?

An Object ID is a unique identifier assigned to a directory object in Microsoft Entra ID, such as a user, group, application, or service principal.

For example:

Tenant ID → identifies the tenant
Object ID → identifies an object within the tenant

20. What is a Tenant ID?

A Tenant ID is the unique identifier of a Microsoft Entra tenant. It is a globally unique identifier (GUID) used by Microsoft services and applications to identify the specific tenant.

For example, applications may use the Tenant ID to determine which Microsoft Entra organization they should authenticate against.

Section 2 — Users and Groups

21. What is a cloud-only user?

A cloud-only user is a user account that is created and managed directly in Microsoft Entra ID and is not synchronized from an on-premises Active Directory.

22. What is a synchronized user?

A synchronized user is a user account that originates from on-premises Active Directory and is synchronized to Microsoft Entra ID using a synchronization solution such as Microsoft Entra Connect.

23. What is a Guest User?

A Guest User is an external user who is invited into a Microsoft Entra tenant to collaborate or access specific resources, applications, or services.

Guest users typically have limited access based on the permissions assigned to them.

24. What is the difference between a Member and Guest user?

A Member user is generally an internal user belonging to the organization, while a Guest user is typically an external user invited to collaborate with the organization.

In short:

Member → Internal organizational user
Guest → External invited user

25. What are security groups?

Security Groups are groups primarily used to manage access and permissions.

Instead of assigning permissions to individual users, administrators can assign access to a Security Group and manage users through group membership.

26. What are Microsoft 365 groups?

Microsoft 365 Groups are collaboration groups that provide users with shared Microsoft 365 resources such as a shared mailbox, calendar, files, SharePoint site, and other collaboration services.

27. What is a dynamic group?

A dynamic group is a group where membership is automatically managed based on rules.

Microsoft Entra ID evaluates the rules and automatically adds or removes users or devices when their attributes match or no longer match the defined criteria.

28. What is dynamic membership?

Dynamic membership is the automatic process of adding or removing members from a group based on membership rules and directory attributes.

For example, all users with the Department attribute set to IT can automatically become members of an IT group.

29. What is group-based licensing?

Group-based licensing allows administrators to assign product licenses to a group instead of assigning licenses individually to each user.

Users automatically inherit eligible licenses based on their group membership.

30. Can licenses be assigned to groups?

Yes. Microsoft Entra ID supports assigning eligible licenses to supported groups, allowing users to receive licenses automatically through group membership.

This simplifies license management for large organizations.

31. What is nested group membership?

Nested group membership means adding one group as a member of another group.

However, support and behavior can vary depending on the group type and Microsoft service, so administrators should verify whether nested groups are supported for the specific scenario.

32. What is the difference between assigned and dynamic groups?

An assigned group has members manually added or removed by an administrator.

A dynamic group automatically manages membership based on rules and user or device attributes.

In short:

Assigned → Manual membership
Dynamic → Rule-based automatic membership

33. How do you create a user in Microsoft Entra ID?

You can create a user through the Microsoft Entra admin center, Microsoft Graph, PowerShell, or other supported administrative tools.

Typically, you provide information such as the user’s name, User Principal Name (UPN), and initial password.

34. How do you reset a user’s password?

An administrator can reset a user’s password through the Microsoft Entra admin center or supported administrative tools such as Microsoft Graph or PowerShell, depending on permissions and the identity configuration.

The administrator can assign a new password and may require the user to change it at their next sign-in.

35. What is Self-Service Password Reset (SSPR)?

Self-Service Password Reset (SSPR) is a Microsoft Entra ID feature that allows users to reset or change their passwords without contacting an administrator or help desk.

36. How does SSPR work?

SSPR allows users to verify their identity using configured authentication methods and then reset their password.

The user typically:

1. Starts the password reset process.
2. Verifies their identity.
3. Provides a new password.
4. Signs in using the new password.

37. What authentication methods are available for SSPR?

Depending on the organization’s configuration and available Microsoft Entra authentication methods, SSPR can use identity verification methods such as:

• Microsoft Authenticator
• Mobile phone
• Alternate authentication methods supported by the organization’s configuration

The available methods can change based on Microsoft’s current authentication policies and tenant configuration.

38. How do you block a user from signing in?

An administrator can block a user from signing in by disabling the user’s account/sign-in ability in Microsoft Entra ID.

This prevents the user from authenticating while allowing the administrator to retain the user object instead of immediately deleting it.

39. What happens when a user is deleted?

When a user is deleted from Microsoft Entra ID, the user is typically moved to the Deleted Users area, where it can be restored for a limited retention period.

After permanent deletion, the user object can no longer be restored.

40. What is the Microsoft Entra recycle bin?

The Microsoft Entra recycle bin refers to the Deleted Users/Deleted Objects area, where recently deleted directory objects may be retained temporarily before permanent deletion.

Administrators can restore eligible deleted objects during the retention period.

Section 3 — Authentication & Identity

41. What is authentication?

Authentication is the process of verifying the identity of a user, device, or application.

For example, Microsoft Entra ID verifies who you are when you sign in using your password, MFA, or another authentication method.

42. What is authorization?

Authorization is the process of determining what an authenticated user is allowed to access or do.

For example, after you sign in, authorization determines whether you can access a particular application, file, or Azure resource.

43. What is the difference between authentication and authorization?

Authentication verifies who you are, while authorization determines what you are allowed to access or do.

In short:

Authentication → Who are you?
Authorization → What can you access?

44. What is Multi-Factor Authentication (MFA)?

Multi-Factor Authentication (MFA) is a security method that requires users to provide more than one form of identity verification when signing in.

For example:

Password + Microsoft Authenticator approval

MFA provides additional security even if a password is compromised.

45. How does MFA work?

MFA requires a user to verify their identity using multiple authentication factors.

For example:

1. The user enters their username and password.
2. Microsoft Entra ID requests an additional verification.
3. The user approves the sign-in using Microsoft Authenticator or another configured method.
4. Access is granted if the verification is successful.

46. What are the different MFA authentication methods?

Depending on the organization’s Microsoft Entra ID configuration, MFA methods can include:

• Microsoft Authenticator
• FIDO2 security keys
• SMS or phone-based verification where enabled
• Passwordless phone sign-in
• Windows Hello for Business
• Other supported authentication methods

The available methods depend on the organization’s authentication policies and configuration.

47. What is passwordless authentication?

Passwordless authentication allows users to sign in without entering a traditional password.

Instead, users can authenticate using methods such as:

• Microsoft Authenticator
• FIDO2 security keys
• Windows Hello for Business

Passwordless authentication can improve security by reducing dependence on passwords.

48. What is Microsoft Authenticator?

Microsoft Authenticator is an authentication application that can be used to verify sign-ins, approve MFA requests, generate verification codes, and support passwordless authentication, depending on the organization’s configuration.

49. What is FIDO2 authentication?

FIDO2 authentication is a standards-based passwordless authentication method that uses cryptographic credentials.

It allows users to sign in using supported devices or security keys instead of traditional passwords.

50. What are security keys?

Security keys are physical devices used to authenticate users.

For example, a FIDO2 security key can allow a user to sign in securely without entering a traditional password.

51. What is Windows Hello for Business?

Windows Hello for Business is a passwordless authentication solution that allows users to sign in using methods such as:

• PIN
• Facial recognition
• Fingerprint

The authentication is protected using cryptographic credentials associated with the user’s device.

52. What is Single Sign-On (SSO)?

Single Sign-On (SSO) allows a user to sign in once and access multiple applications or services without repeatedly entering credentials.

This improves both user experience and centralized identity management.

53. How does SSO work with Microsoft Entra ID?

Microsoft Entra ID acts as an identity provider that authenticates the user and can provide authentication tokens to supported applications.

After the user signs in, supported applications can trust the Microsoft Entra ID authentication and allow access without requiring the user to sign in again.

54. What is Seamless SSO?

Seamless SSO is a feature commonly used in hybrid identity environments that allows users on corporate networks to automatically sign in to Microsoft Entra ID without repeatedly entering their credentials.

It is typically used with synchronized identities from on-premises Active Directory.

55. What is Federation?

Federation is an identity model in which an organization uses an external or on-premises identity provider to authenticate users.

Microsoft Entra ID trusts the external identity provider and accepts authentication claims from it.

56. What is a federated identity?

A federated identity is an identity that is authenticated by a trusted external identity provider rather than directly by Microsoft Entra ID.

For example, an organization may use Active Directory Federation Services (AD FS) as its federation service.

57. What is Password Hash Synchronization (PHS)?

Password Hash Synchronization (PHS) is a hybrid identity authentication method where a synchronized hash of a user’s password hash from on-premises Active Directory is stored in Microsoft Entra ID.

Users can then authenticate directly against Microsoft Entra ID.

The user’s actual plaintext password is not synchronized.

58. What is Pass-through Authentication (PTA)?

Pass-through Authentication (PTA) is a hybrid authentication method where Microsoft Entra ID validates sign-in requests by passing them to an on-premises authentication agent, which validates the credentials against on-premises Active Directory.

The password is not stored in Microsoft Entra ID for authentication in the same way as with Password Hash Synchronization.

59. What is the difference between PHS and PTA?

The main difference is where authentication is validated.

Password Hash Synchronization (PHS):
Authentication occurs primarily in Microsoft Entra ID using synchronized password hashes.

Pass-through Authentication (PTA):
Authentication validation occurs against the organization’s on-premises Active Directory through PTA agents.

In short:

PHS → Authentication in the cloud
PTA → Authentication validated against on-premises AD

60. What is Hybrid Identity?

Hybrid Identity is an identity architecture where on-premises Active Directory and Microsoft Entra ID work together.

User identities can be synchronized between on-premises AD and Microsoft Entra ID, allowing users to access both on-premises and cloud resources using a connected identity.

Common hybrid identity components include:

• Microsoft Entra Connect
• Password Hash Synchronization
• Pass-through Authentication
• Federation

Section 4 — Azure AD Connect / Microsoft Entra Connect

61. What is Azure AD Connect?

Azure AD Connect was Microsoft’s tool for synchronizing identities between on-premises Active Directory and Azure AD. It is now known as Microsoft Entra Connect.

62. What is Microsoft Entra Connect?

Microsoft Entra Connect is a synchronization tool that integrates on-premises Active Directory with Microsoft Entra ID.

63. Why do we use Microsoft Entra Connect?

Microsoft Entra Connect is used to synchronize users, groups, passwords, and other identity information between on-premises Active Directory and Microsoft Entra ID.

64. How does on-premises Active Directory integrate with Microsoft Entra ID?

On-premises Active Directory can integrate with Microsoft Entra ID using Microsoft Entra Connect or Microsoft Entra Cloud Sync, which synchronize selected identities and attributes to the cloud.

65. What is directory synchronization?

Directory synchronization is the process of synchronizing identity objects and their attributes between on-premises Active Directory and Microsoft Entra ID.

66. What is synchronization?

Synchronization is the process of keeping data consistent between two systems by transferring changes from one system to another.

67. What is Password Hash Synchronization?

Password Hash Synchronization (PHS) synchronizes a derived hash of the user’s on-premises password hash to Microsoft Entra ID, allowing authentication in the cloud.

68. What is Pass-through Authentication?

Pass-through Authentication (PTA) validates user sign-in requests against on-premises Active Directory using authentication agents.

69. What is Seamless SSO?

Seamless SSO allows users on corporate devices and networks to automatically sign in to Microsoft Entra ID without repeatedly entering their credentials.

70. What is Microsoft Entra Connect Cloud Sync?

Microsoft Entra Cloud Sync is a cloud-managed synchronization solution that uses lightweight agents to synchronize identities from on-premises Active Directory to Microsoft Entra ID.

71. What is the difference between Entra Connect and Cloud Sync?

Microsoft Entra Connect is a more feature-rich synchronization solution installed on-premises.

Microsoft Entra Cloud Sync is a lightweight, cloud-managed synchronization solution using provisioning agents.

72. How frequently does Microsoft Entra Connect synchronize by default?

Microsoft Entra Connect typically performs a delta synchronization every 30 minutes by default.

73. Can you manually start synchronization?

Yes. You can manually trigger synchronization using supported PowerShell commands or synchronization management tools.

74. What is the difference between Delta Sync and Initial Sync?

Initial Sync processes all selected objects during synchronization.

Delta Sync processes only the changes that occurred since the previous synchronization.

75. What is the Synchronization Service Manager?

Synchronization Service Manager is a management and troubleshooting tool used to monitor synchronization operations, connectors, and synchronization errors.

76. What is the Azure AD Connect database?

The Azure AD Connect database stores synchronization configuration, connector information, and synchronization data used by Microsoft Entra Connect.

77. What is staging mode?

Staging mode allows a secondary Microsoft Entra Connect server to synchronize and prepare data without actively exporting changes to Microsoft Entra ID.

It is commonly used for high availability and disaster recovery.

78. What is filtering in Azure AD Connect?

Filtering allows administrators to control which users, groups, devices, or other objects are synchronized from on-premises Active Directory to Microsoft Entra ID.

79. What is OU filtering?

OU filtering allows administrators to select which Organizational Units (OUs) and their objects should be synchronized to Microsoft Entra ID.

80. What is attribute-based filtering?

Attribute-based filtering controls synchronization based on specific attribute values.

For example, objects can be included or excluded based on configured attribute-based rules.

81. What happens if a user is deleted from on-premises AD?

If the user is synchronized from on-premises Active Directory, the deletion is typically synchronized to Microsoft Entra ID, and the corresponding cloud user is moved to a deleted state, subject to the synchronization configuration.

82. What happens if a user’s password changes on-premises?

If Password Hash Synchronization is enabled, the updated password information is synchronized to Microsoft Entra ID, allowing the user to sign in with their new password.

83. How would you troubleshoot a synchronization problem?

Check the Microsoft Entra Connect synchronization status, Synchronization Service Manager, connector status, synchronization errors, and event logs.

84. How would you troubleshoot a user who isn’t appearing in Entra ID?

Check whether the user is:

• Within the configured synchronization scope.
• Included in the selected OU.
• Excluded by filtering.
• Successfully synchronized without errors.

85. How would you troubleshoot password synchronization?

Check whether Password Hash Synchronization is enabled, review synchronization errors and logs, verify the user is included in synchronization, and confirm that password synchronization is functioning correctly.

Section 5 — Conditional Access

86. What is Conditional Access?

Conditional Access is a Microsoft Entra ID security feature that allows organizations to control access based on specific conditions and policies.

87. Why is Conditional Access used?

Conditional Access is used to protect applications and resources by enforcing security requirements such as MFA, compliant devices, location restrictions, or blocking access.

88. What are the main components of a Conditional Access policy?

The main components are:

• Assignments – Who and what the policy applies to.
• Conditions – When the policy applies.
• Access controls – What action is required, allowed, or blocked.
• Session controls – How access is controlled after sign-in.

89. What are users and workload identities in Conditional Access?

They define who the Conditional Access policy applies to.

This can include specific users, groups, directory roles, or workload identities such as service principals.

90. What are target resources?

Target resources define the applications, services, or resources that the Conditional Access policy protects.

For example, Microsoft 365 applications or other integrated cloud applications.

91. What are conditions?

Conditions define the circumstances under which a Conditional Access policy is applied.

Examples include location, device platform, sign-in risk, user risk, client applications, and device state.

92. What are grant controls?

Grant controls define the requirements a user must meet to gain access.

For example:

• Require MFA
• Require a compliant device
• Require a domain-joined device
• Block access

93. What are session controls?

Session controls define how a user’s session is managed after access is granted.

They can help control aspects such as sign-in frequency and application session behavior.

94. What is a Conditional Access policy in Report-only mode?

Report-only mode allows administrators to evaluate how a Conditional Access policy would affect users without actually enforcing the policy.

95. What happens when multiple Conditional Access policies apply?

When multiple policies apply, Microsoft Entra ID evaluates all applicable policies and enforces the required controls.

A user must satisfy the applicable requirements, and a block policy will block access.

96. How would you require MFA for administrators?

Create a Conditional Access policy that:

• Targets administrator roles.
• Targets the required applications or resources.
• Uses Require multi-factor authentication as the grant control.

97. How would you require MFA when users access Microsoft 365 from outside the corporate network?

Create a Conditional Access policy that:

• Targets the required users or groups.
• Targets Microsoft 365 applications.
• Excludes trusted corporate locations.
• Requires MFA for other locations.

98. How would you block access from a particular country?

Create a named location for the country or region and use it in a Conditional Access policy with Block access as the grant control.

99. How would you block legacy authentication?

Create a Conditional Access policy that:

• Targets the required users.
• Targets the appropriate applications.
• Selects legacy authentication clients under client app conditions.
• Uses Block access as the grant control.

100. How would you create a policy requiring compliant devices?

Create a Conditional Access policy that:

• Targets the required users or groups.
• Targets the required applications.
• Uses Require device to be marked as compliant as a grant control.

This typically works with device compliance information from Microsoft Intune.

🎉 Completed Part 1?

You have completed Questions 1–100 of our Microsoft Entra ID Interview Questions and Answers – Quick Revision series.

Continue Your Preparation

👉 Part 2: Questions 101–200

Continue with:

• Applications & Enterprise Applications
• Azure RBAC and Microsoft Entra Roles
• External Identities
• Security
• Monitoring & Troubleshooting
• Scenario-Based Questions
• Advanced Microsoft Entra ID Concepts

➡️ Continue to Part 2: Microsoft Entra ID Interview Questions and Answers (Questions 101–200)

Note: This article focuses on quick revision and interview preparation. For a deeper understanding of Microsoft Entra ID concepts, refer to the detailed articles and guides available on CloudNet0365 and official Microsoft documentation.