Azure Active Directory (Azure AD) was Microsoft’s cloud-based identity and access management (IAM) service. It allowed organizations to manage identities and control access to applications, services, and resources.

Azure Active Directory was renamed Microsoft Entra ID in 2023. The name changed, but the underlying service, capabilities, existing deployments, and integrations continued without interruption.

Today, the correct product name is Microsoft Entra ID.

What does Microsoft Entra ID actually do?

At a high level, Microsoft Entra ID answers two important questions:

1. Who are you?
This is authentication — verifying a user’s or application’s identity.

2. What are you allowed to access?
This is authorization — determining whether that identity has permission to access a particular resource.

For example, when an employee signs in to Microsoft 365:

User
  │
  │ Username + Authentication
  ▼
Microsoft Entra ID
  │
  ├── Authenticates the identity
  │
  ├── Checks applicable policies
  │
  ├── May require MFA
  │
  └── Determines access
          │
          ▼
     Microsoft 365

Microsoft describes Entra ID as a cloud-based identity and access management service that provides authentication, policy enforcement, and protection for users, devices, applications, and resources.

What can Microsoft Entra ID be used for?

Microsoft Entra ID provides a wide range of identity and access capabilities, including:

👤 User management
👥 Group management
🔐 Authentication
📱 Multi-Factor Authentication (MFA)
🔑 Single Sign-On (SSO)
🛡️ Conditional Access
🖥️ Device identities
📦 Application identities
🔗 Integration with Microsoft 365 and other cloud applications
🔎 Identity monitoring and protection
👨‍💼 Privileged access management

It is therefore much more than simply a place where usernames and passwords are stored.

Real-world example

Imagine a company called ABC Corporation with 2,000 employees.

The company uses Microsoft 365 for:

Outlook
Teams
SharePoint
OneDrive

Instead of maintaining a completely separate identity for every Microsoft cloud service, the organization can use Microsoft Entra ID as its central cloud identity platform.

For example:

John works in the IT department. His company account is john@abc.com.

When John signs in to Microsoft 365, Microsoft Entra ID can authenticate his identity and apply the organization’s access policies before allowing him to access the requested service.

If the organization requires MFA, John may also need to approve the sign-in using Microsoft Authenticator or another supported authentication method.

This is one of the reasons Microsoft Entra ID is fundamental to Microsoft 365 administration.

Is Microsoft Entra ID the same as Windows Server Active Directory?

No.

This is one of the most important points to understand for an interview.

Windows Server Active Directory (AD DS) is an on-premises directory and identity service.

Microsoft Entra ID is Microsoft’s cloud-based identity and access management service.

They can work together in a hybrid identity environment, but they are not the same product.

Windows Server Active Directory	Microsoft Entra ID
Primarily designed for on-premises environments	Cloud-based identity service
Uses domains, domain controllers and OUs	Uses Microsoft Entra tenants and directory objects
Commonly uses Kerberos/NTLM	Uses modern cloud authentication protocols
Group Policy is a core capability	Conditional Access is a key cloud access-control capability
Managed through domain controllers and AD tools	Managed through Microsoft Entra admin center, Microsoft Graph and other tools

Important: Microsoft did not rename Windows Server Active Directory to Microsoft Entra ID. Only Azure Active Directory (Azure AD) was renamed. Microsoft continues to support Windows Server Active Directory.

Why did Microsoft rename Azure AD?

Microsoft renamed Azure Active Directory to Microsoft Entra ID as part of the broader Microsoft Entra product family.

One reason for the change was to better distinguish the cloud identity service from Windows Server Active Directory and to reflect Microsoft’s broader focus on multicloud and multiplatform identity and access.

The rename does not mean that organizations had to rebuild their existing environments. Microsoft states that existing deployments, configurations, integrations, APIs and sign-in URLs continued to work.

⚠️ Common Interview Mistake

Don’t answer:

“Azure AD is Microsoft’s cloud version of Active Directory.”

That answer is too simplistic and can create confusion.

A better answer is:

“Microsoft Entra ID, formerly Azure Active Directory, is Microsoft’s cloud-based identity and access management service. It provides authentication, authorization, access control and identity management for users, applications, devices and resources.”

Also remember that Windows Server Active Directory and Microsoft Entra ID are different identity platforms, although they can be integrated in hybrid environments.

🎯 Interview Tip

If the interviewer asks:

“What is Azure AD?”

A strong 20–30 second response would be:

“Azure Active Directory, now called Microsoft Entra ID, is Microsoft’s cloud-based identity and access management service. It is used to manage identities and control access to applications and resources. It provides capabilities such as authentication, authorization, MFA, SSO and Conditional Access, and it is widely used with Microsoft 365, Azure and other cloud applications.”

If the interviewer then asks “How is it different from Active Directory?”, explain the difference between Microsoft Entra ID and Windows Server Active Directory rather than simply saying one is cloud and one is on-premises.

🔗 Related Interview Questions

After understanding this question, the next concepts you should understand are:

Q2. What is Microsoft Entra ID?
Q3. What is the difference between Azure AD and Microsoft Entra ID?
Q4. Why did Microsoft rename Azure AD to Microsoft Entra ID?
Q5. What is Identity and Access Management (IAM)?
Q6. What is a Microsoft Entra ID Tenant?

These questions build upon the foundation established here.

Q2. What is Microsoft Entra ID?

Interview-ready answer

Microsoft Entra ID is Microsoft’s cloud-based identity and access management (IAM) service. It helps organizations manage identities and securely control access to applications, data, services, and other resources.

It provides capabilities such as authentication, authorization, Single Sign-On (SSO), Multi-Factor Authentication (MFA), Conditional Access, application identity, device identity, and identity protection.

Microsoft Entra ID was previously known as Azure Active Directory (Azure AD). Microsoft renamed Azure AD to Microsoft Entra ID beginning in 2023; existing deployments and integrations continued to work without requiring organizations to migrate to a different identity service.

What does Microsoft Entra ID actually do?

At a basic level, Microsoft Entra ID helps an organization answer two questions:

Who is trying to access the resource?

and

Should this identity be allowed to access it?

This involves two fundamental concepts:

Authentication — verifying the identity.

Authorization — determining what that identity is allowed to access.

For example, when an employee signs in to Microsoft 365:

Employee
   │
   │ Sign-in request
   ▼
Microsoft Entra ID
   │
   ├── Authenticates the user
   │
   ├── Evaluates applicable policies
   │
   ├── May require MFA
   │
   └── Determines access
          │
          ▼
   Microsoft 365 / Application

Microsoft Entra ID acts as a central identity provider for many applications and services. It can provide users with a common sign-in experience and supports multiple authentication protocols, including SAML, OpenID Connect, and OAuth 2.0.

Why is Microsoft Entra ID important?

Modern organizations often use hundreds of cloud applications and services.

Without a centralized identity platform, users and administrators could end up managing separate accounts and access permissions across many different applications.

Microsoft Entra ID provides a centralized identity layer.

For example, an organization might use:

Microsoft 365
Azure
Salesforce
ServiceNow
Workday
Internal web applications
Other SaaS applications

Applications that integrate with Microsoft Entra ID can use it as an identity provider, allowing organizations to centrally manage access and authentication.

Real-world example

Imagine ABC Corporation has 2,000 employees.

The company uses Microsoft 365, Azure and several third-party SaaS applications.

Instead of creating and independently managing identities in every application, ABC Corporation can use Microsoft Entra ID as its central identity platform.

For example:

John → signs in with his company account

Microsoft Entra ID can:

Verify John’s identity.
Determine which authentication requirements apply.
Require MFA if necessary.
Evaluate Conditional Access policies.
Provide the appropriate authentication information to the application.
Allow or deny access based on the organization’s policies.

This centralized approach makes identity management easier to administer and helps organizations apply consistent security controls.

What can Microsoft Entra ID manage?

Microsoft Entra ID can work with different types of identities and objects, including:

👤 Users

Employee, administrator, guest and other user identities.

👥 Groups

Groups can be used to organize users and help manage access.

📱 Devices

Microsoft Entra ID can maintain identities for organizational devices and support scenarios such as Microsoft Entra joined devices.

📦 Applications

Applications can be integrated with Microsoft Entra ID for authentication and access management.

⚙️ Workload identities

Applications and services can also require identities to access resources.

Microsoft describes Entra ID as the foundational product in the broader Microsoft Entra family, providing authentication, policy enforcement and protection for users, devices, applications and resources.

Microsoft Entra ID and Microsoft 365

One of the most important things to understand for an interview is the relationship between Microsoft 365 and Microsoft Entra ID.

Microsoft 365 uses Microsoft Entra ID for identity and access management.

For example, when a user signs in to services such as:

Exchange Online
Microsoft Teams
SharePoint Online
OneDrive
Microsoft 365 admin services

Microsoft Entra ID plays a central role in authenticating the user’s identity and controlling access.

Microsoft states that Microsoft 365 subscribers are already using Microsoft Entra ID because each Microsoft 365 tenant is also a Microsoft Entra tenant.

Microsoft Entra ID and Azure

Microsoft Entra ID is also closely connected with Azure.

For example, an organization can use Microsoft Entra identities to access Azure resources and manage administrative permissions through Microsoft Entra roles and Azure RBAC.

This is why Azure administrators need to understand both:

Identity → Microsoft Entra ID

and

Azure resources → Azure subscriptions and resource management

These concepts are related, but they are not the same thing.

We will explore the difference between a Microsoft Entra tenant and an Azure subscription later in this section.

⚠️ Common Interview Mistake

A common mistake is saying:

“Microsoft Entra ID is Microsoft’s cloud version of Active Directory.”

That explanation is too simplistic.

A better answer is:

“Microsoft Entra ID is Microsoft’s cloud-based identity and access management service. It provides authentication, authorization, access control and identity management for users, applications, devices and resources.”

Microsoft Entra ID and Windows Server Active Directory Domain Services (AD DS) are different identity platforms, although organizations can integrate them to create hybrid identity environments.

🎯 Interview Tip

If the interviewer asks:

“What is Microsoft Entra ID?”

A strong answer would be:

“Microsoft Entra ID is Microsoft’s cloud-based identity and access management service, formerly known as Azure Active Directory. It is used to manage identities and control access to applications and resources. It provides capabilities such as authentication, authorization, SSO, MFA, Conditional Access and identity protection, and is widely used with Microsoft 365, Azure and third-party applications.”

If the interviewer then asks:

“Is Microsoft Entra ID the same as Active Directory?”

Don’t simply answer “yes” or “no.”

Explain the difference between Microsoft Entra ID and Windows Server Active Directory, and mention that they can be integrated in a hybrid environment.

🔗 Related Interview Questions

Continue with:

Q1. What is Azure Active Directory (Azure AD)?
Q3. What is the difference between Azure AD and Microsoft Entra ID?
Q4. Why did Microsoft rename Azure AD to Microsoft Entra ID?
Q5. What is Identity and Access Management (IAM)?
Q6. What is a Microsoft Entra ID Tenant?

Quick Revision

Microsoft Entra ID = Microsoft’s cloud-based identity and access management service.

Remember these four words:

Identity → Authentication → Access → Security

Q3. What is the difference between Azure AD and Microsoft Entra ID?

Interview-ready answer

There is no separate difference between Azure Active Directory (Azure AD) and Microsoft Entra ID in terms of the underlying identity service.

Azure Active Directory (Azure AD) was the former name of Microsoft Entra ID.

Microsoft renamed Azure AD to Microsoft Entra ID in 2023 as part of the Microsoft Entra family of identity and network access products.

In simple terms:

Azure AD = Microsoft Entra ID

The service itself did not become a completely different product because of the name change.

Why did the name change?

Microsoft Entra is Microsoft’s broader product family focused on identity and network access.

The Azure AD name could also cause confusion with Windows Server Active Directory, even though they are different technologies.

Microsoft therefore adopted Microsoft Entra ID as the current product name.

The broader Microsoft Entra family includes products and capabilities covering areas such as:

Identity management
Access management
Identity protection
Privileged access
External identities
Network access

Microsoft Entra ID is the identity and access management component within this broader family.

Did anything change for existing Azure AD customers?

The name changed, but organizations did not need to create a new identity environment simply because Azure AD was renamed.

Existing:

Users
Groups
Applications
Tenants
Configurations
Integrations
Authentication processes

continued to operate.

Microsoft also retained many existing technical names and terminology for compatibility.

This is important because administrators will still encounter Azure AD terminology in older scripts, documentation, tools and discussions.

Why do administrators still say “Azure AD”?

You may hear both terms in real-world IT environments.

For example, an administrator might say:

“Check the Azure AD Connect server.”

Another administrator might say:

“Check the Microsoft Entra Connect synchronization.”

They may be referring to the same general Microsoft identity ecosystem, although the current product terminology is Microsoft Entra ID and Microsoft Entra Connect.

You’ll also encounter older terminology in:

PowerShell modules and commands
Existing automation scripts
Older documentation
Older training courses
Company documentation
Legacy application configurations
Interview questions

Therefore, an Azure administrator should understand both the old and new terminology.

Azure AD vs Microsoft Entra ID vs Active Directory

This is where interview candidates sometimes become confused.

Term	What it means
Azure AD	Former name of Microsoft Entra ID
Microsoft Entra ID	Current name of Microsoft’s cloud identity and access management service
Windows Server Active Directory (AD DS)	Microsoft’s traditional directory service commonly deployed on-premises

So:

Azure AD → renamed Microsoft Entra ID

But:

Windows Server Active Directory → remains a separate product

They can, however, be integrated in a hybrid identity environment.

⚠️ Common Interview Mistake

Don’t say:

“Azure AD was replaced by Microsoft Entra ID.”

That can make it sound as though Microsoft created a completely new identity service and organizations had to migrate from one to the other.

A better explanation is:

“Azure Active Directory was renamed Microsoft Entra ID. It is the same underlying cloud identity service, with the new name reflecting Microsoft’s broader Entra identity and access portfolio.”

🎯 Interview Tip

If an interviewer asks:

“What is the difference between Azure AD and Microsoft Entra ID?”

Keep your answer simple:

“There is no separate service difference. Azure Active Directory, commonly called Azure AD, was renamed Microsoft Entra ID in 2023. Microsoft Entra ID is the current name for Microsoft’s cloud-based identity and access management service.”

Then, if the interviewer asks:

“Is it the same as Active Directory?”

That’s your opportunity to explain the difference between Microsoft Entra ID and Windows Server Active Directory Domain Services (AD DS).

🔗 Related Interview Questions

Q1. What is Azure Active Directory (Azure AD)?
Q2. What is Microsoft Entra ID?
Q4. Why did Microsoft rename Azure AD to Microsoft Entra ID?
Q5. What is Identity and Access Management (IAM)?
Q6. What is a Microsoft Entra ID Tenant?

Quick Revision

Azure AD → Old name

Microsoft Entra ID → Current name

Windows Server Active Directory → Separate on-premises directory service

Remember: Microsoft Entra ID is not simply “the new version of Windows Active Directory.” It is Microsoft’s cloud identity and access management service.

Q4. Why did Microsoft rename Azure AD to Microsoft Entra ID?

Interview-ready answer

Microsoft renamed Azure Active Directory (Azure AD) to Microsoft Entra ID in 2023 as part of a broader effort to bring Microsoft’s identity and access products under the Microsoft Entra brand.

The rename also helped distinguish the cloud identity service from Windows Server Active Directory, which is a separate technology.

In simple terms:

Azure Active Directory → Microsoft Entra ID

The name change did not mean that organizations had to migrate their existing Azure AD environments to a completely new identity service.

What was the main reason for the name change?

There were several reasons behind Microsoft’s decision.

1. To distinguish it from Windows Server Active Directory

The name “Active Directory” has traditionally been strongly associated with Windows Server Active Directory Domain Services (AD DS).

However, Microsoft Entra ID and Windows Server AD DS are different technologies.

For example:

Windows Server Active Directory

Primarily used for traditional on-premises identity management
Uses domain controllers
Supports technologies such as Kerberos and LDAP
Provides organizational structures such as Organizational Units (OUs)
Commonly used with Group Policy

Microsoft Entra ID

Cloud-based identity and access management
Designed for cloud and modern application environments
Provides capabilities such as Conditional Access and MFA
Integrates with Microsoft 365, Azure and many SaaS applications
Uses modern authentication and authorization technologies

The new name helps reduce the assumption that Microsoft Entra ID is simply a cloud-hosted version of Windows Server Active Directory.

2. Microsoft Entra is a broader identity and access family

Microsoft Entra is not limited to the traditional concept of a directory.

The Microsoft Entra product family covers a broader set of identity and access capabilities.

For example, the portfolio includes technologies and services related to:

Workforce identity
External identities
Identity protection
Privileged access
Application identities
Network access

Microsoft Entra ID is the core cloud identity and access management service within this ecosystem.

3. To reflect modern identity requirements

Modern organizations don’t only have employees accessing applications from corporate computers.

Users may work from:

Office networks
Home
Mobile devices
Public networks
Multiple cloud platforms

Organizations also need to manage identities for:

Applications
Services
Devices
External users
Workloads

Modern identity management therefore involves much more than simply maintaining usernames and passwords.

Microsoft Entra ID provides capabilities designed for these modern identity and access scenarios.

Did the rename change existing Azure AD environments?

No major migration was required simply because of the name change.

Organizations that were already using Azure AD did not need to create a new tenant or recreate their users and applications just because the product was renamed.

Existing environments continued to operate.

You may therefore still encounter the older terminology in existing environments, scripts, documentation and administrative tools.

What terminology should an administrator use today?

When writing new documentation or communicating about the current service, use:

Microsoft Entra ID

Instead of:

Azure Active Directory / Azure AD

However, you should still understand the old terminology because it remains common in the industry.

For example:

Older terminology	Current terminology
Azure Active Directory	Microsoft Entra ID
Azure AD	Microsoft Entra ID
Azure AD Connect	Microsoft Entra Connect
Azure AD B2B	Microsoft Entra B2B / External ID terminology depending on the scenario

Note: Not every Microsoft product or technical term was renamed in exactly the same way, so administrators should check current Microsoft documentation rather than assuming every occurrence of “Azure AD” has simply been replaced word-for-word.

⚠️ Common Interview Mistake

A common incorrect answer is:

“Microsoft created Microsoft Entra ID to replace Azure AD, so companies had to migrate.”

That’s incorrect.

The important point is:

Azure AD was renamed Microsoft Entra ID.

The name change did not require organizations to create a new tenant or perform a traditional migration from Azure AD to Entra ID.

🎯 Interview Tip

If the interviewer asks:

“Why did Microsoft change the name from Azure AD to Entra ID?”

A strong answer would be:

“Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023 as part of the broader Microsoft Entra family. The new branding helps distinguish the cloud identity service from Windows Server Active Directory and reflects Microsoft’s broader identity and access capabilities. Existing Azure AD environments continued to work; the rename itself did not require a tenant migration.”

🔗 Related Interview Questions

Q1. What is Azure Active Directory (Azure AD)?
Q2. What is Microsoft Entra ID?
Q3. What is the difference between Azure AD and Microsoft Entra ID?
Q5. What is Identity and Access Management (IAM)?
Q6. What is a Microsoft Entra ID Tenant?

Quick Revision

Azure AD was renamed Microsoft Entra ID in 2023.

The rename was primarily about Microsoft’s broader identity and access strategy and clearer product positioning, not about replacing an existing Azure AD tenant with a new service.

Q5. What is Identity and Access Management (IAM)?

Interview-ready answer

Identity and Access Management (IAM) is the set of technologies, processes, and policies used by an organization to manage digital identities and control who or what can access resources.

In simple terms, IAM helps an organization answer three questions:

Who are you?
What are you allowed to access?
Under what conditions can you access it?

Microsoft Entra ID is Microsoft’s cloud-based identity and access management service and provides many of the capabilities organizations use to implement IAM in Microsoft cloud environments.

What are the main components of IAM?

IAM can be understood through several core functions.

1. Identity

An identity represents a person, application, device, service, or other entity that needs to interact with a resource.

Examples include:

An employee
An administrator
A guest user
A laptop
An application
A service or workload

For example:

john@abc.com

could represent an employee’s identity in Microsoft Entra ID.

2. Authentication

Authentication verifies that an identity is actually who or what it claims to be.

For example, when John signs in, Microsoft Entra ID may verify his identity using:

Password
Microsoft Authenticator
FIDO2 security key
Windows Hello for Business
Other supported authentication methods

A simple way to remember it:

Authentication = “Who are you?”

3. Authorization

After authentication, the organization needs to determine what the identity is allowed to do.

This is authorization.

For example:

John may be allowed to:

Read a SharePoint site
Access Microsoft Teams
Manage certain Azure resources

But he may not be allowed to:

Delete the organization’s Azure resources
Modify Conditional Access policies
Assign himself administrative roles

A simple way to remember it:

Authorization = “What are you allowed to do?”

4. Access Control

IAM also determines under what circumstances an identity can access a resource.

For example, an organization could require:

“Users must perform MFA when accessing sensitive applications from an untrusted location.”

Microsoft Entra Conditional Access can be used to implement this type of policy.

This introduces another important IAM question:

“Under what conditions should access be allowed?”

5. Identity Lifecycle Management

IAM isn’t only about signing users in.

Organizations also need to manage identities throughout their lifecycle.

For example:

Employee joins company
        ↓
User account created
        ↓
Access assigned
        ↓
Employee changes department
        ↓
Access updated
        ↓
Employee leaves company
        ↓
Account disabled / access removed

This helps organizations ensure that users have appropriate access throughout their employment.

Authentication vs Authorization

This is one of the most frequently tested IAM concepts in interviews.

Authentication	Authorization
Verifies identity	Determines permissions
“Who are you?”	“What can you access?”
Happens when identity is verified	Determines permitted actions/resources
Example: password + MFA	Example: permission to access an application

Simple example

Imagine an employee signs into Microsoft 365.

Step 1 — Authentication

Microsoft Entra ID verifies the employee’s identity.

Step 2 — Access evaluation

Microsoft Entra ID and other Microsoft services evaluate applicable access controls.

Step 3 — Authorization

The employee receives access to the resources they are permitted to use.

So:

Authentication gets you identified. Authorization determines what you’re allowed to access.

How does Microsoft Entra ID fit into IAM?

Microsoft Entra ID provides many IAM capabilities for cloud environments.

For example:

Identity management

→ Users, groups, devices, applications

Authentication

→ Passwords, MFA, passwordless authentication

Access control

→ Conditional Access and role-based access

Application access

→ Enterprise applications and Single Sign-On

Privileged access

→ Microsoft Entra roles and Privileged Identity Management

Identity protection

→ Detection and response to identity-related risks

This is why Microsoft Entra ID is an important component of an organization’s overall IAM strategy.

Real-world example

Consider an organization with 5,000 employees.

The organization wants to ensure that:

Employees can access Microsoft 365.
Administrators use MFA.
Users can access applications according to their job roles.
Former employees lose access when they leave.
High-risk sign-ins are restricted.
External users have controlled access.
Privileged administrators receive only the permissions they need.

These requirements fall under the broader Identity and Access Management discipline.

Microsoft Entra ID can provide many of the capabilities required to implement these controls in Microsoft’s cloud ecosystem.

IAM vs Microsoft Entra ID

Another common interview question is:

“Is IAM the same as Microsoft Entra ID?”

No.

IAM is a broader concept/discipline.

Microsoft Entra ID is a specific Microsoft service that provides identity and access management capabilities.

Think of it this way:

IAM = the overall discipline

Microsoft Entra ID = Microsoft’s cloud service used to implement many IAM capabilities

Other vendors also provide IAM solutions.

⚠️ Common Interview Mistake

Don’t say:

“IAM is only about usernames and passwords.”

IAM is much broader.

It includes areas such as:

Identity lifecycle
Authentication
Authorization
Access control
Privileged access
Application identities
Device identities
Identity security

Modern IAM is about ensuring that the right identity gets the right access to the right resource under the right conditions.

🎯 Interview Tip

If an interviewer asks:

“What is IAM?”

A strong answer would be:

“Identity and Access Management, or IAM, is the framework of technologies, processes and policies used to manage digital identities and control access to resources. It includes identity management, authentication, authorization, access control and identity lifecycle management. Microsoft Entra ID is Microsoft’s cloud-based identity and access management service.”

If they then ask:

“What is the difference between authentication and authorization?”

Answer:

“Authentication verifies who the user or identity is, while authorization determines what that authenticated identity is allowed to access or do.”

🔗 Related Interview Questions

Q2. What is Microsoft Entra ID?
Q6. What is a Microsoft Entra ID Tenant?
Q15. What is a Microsoft Entra ID User?
Q16. What is a Microsoft Entra ID Group?
Q27. What is Conditional Access?
Q44. What is Multi-Factor Authentication (MFA)?
Q121. What is Azure RBAC?

Quick Revision

IAM = Managing identities + controlling access

Remember:

Identity → Authentication → Authorization → Access Control → Lifecycle

Q6. What is a Microsoft Entra ID Tenant?

Interview-ready answer

A Microsoft Entra ID tenant is a dedicated instance of Microsoft Entra ID that represents an organization’s identity environment in the Microsoft cloud.

It acts as an identity and access management boundary for the organization and contains objects such as users, groups, applications, devices, service principals, and other directory objects.

Every Microsoft Entra tenant has a unique Tenant ID, which identifies that tenant.

Simple definition

A Microsoft Entra tenant is an organization’s dedicated identity environment in Microsoft Entra ID.

Think of a Tenant as an Organization’s Identity Boundary

One of the easiest ways to understand a tenant is to think of it as a separate identity environment belonging to an organization.

For example, suppose ABC Corporation creates a Microsoft cloud environment.

It might have:

              ABC Corporation
                     │
                     ▼
          Microsoft Entra Tenant
                     │
       ┌─────────────┼─────────────┐
       ▼             ▼             ▼
     Users         Groups      Applications
       │             │             │
       ▼             ▼             ▼
   Employees      IT Group     SaaS Apps
   Admins         HR Group     Enterprise Apps
   Guests         Finance

The tenant provides the identity environment in which these objects are managed.

For example, ABC Corporation might have:

5,000 employee accounts
200 groups
50 enterprise applications
3,000 registered devices
Several administrators
Multiple custom domains

All of these can be managed within the organization’s Microsoft Entra tenant.

What does a Tenant contain?

A Microsoft Entra tenant can contain many different types of identity-related objects.

👤 Users

User accounts represent people or other supported user identities.

For example:

john@abc.com

john@abc.com can be an identity within ABC Corporation’s tenant.

👥 Groups

Groups allow organizations to organize users and manage access more efficiently.

For example:

IT Administrators
        │
        ├── John
        ├── Sarah
        └── David

A group can be used for access management, licensing, application assignment, and other administrative purposes depending on the scenario.

📱 Devices

Microsoft Entra ID can maintain device identities and support scenarios such as:

Microsoft Entra joined devices
Microsoft Entra registered devices
Hybrid Microsoft Entra joined devices

This allows organizations to incorporate device identity into their access and security decisions.

📦 Applications

Applications can be integrated with Microsoft Entra ID for authentication and access management.

Examples include:

Microsoft 365 applications
Internal applications
SaaS applications
Custom web applications

⚙️ Service Principals

Applications and services can have identities in Microsoft Entra ID through service principals.

These identities can be granted appropriate permissions to access resources.

We’ll cover application registrations and service principals in much more detail later in the interview guide.

Does Every Organization Have Its Own Tenant?

Generally, organizations create one or more Microsoft Entra tenants according to their identity and organizational requirements.

For example:

Company A
   │
   └── Tenant A

Company B
   │
   └── Tenant B

Company C
   │
   └── Tenant C

These are separate Microsoft Entra environments.

Objects belonging to one tenant are not automatically part of another tenant.

This separation is an important aspect of the tenant model.

What is a Tenant ID?

Every Microsoft Entra tenant has a unique identifier called the Tenant ID.

It is a globally unique identifier, typically represented as a GUID.

For example:

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

The Tenant ID is used to identify a specific Microsoft Entra tenant in various administrative, authentication, API, and application scenarios.

Why is Tenant ID important?

Administrators and developers may encounter the Tenant ID when working with:

Microsoft Entra applications
Microsoft Graph
Azure CLI
PowerShell
Authentication configurations
Application registrations
Azure resources
Automation
APIs

For example, an application may need to know which Microsoft Entra tenant it should authenticate against.

Tenant vs Azure Subscription

This is one of the most important interview concepts.

A Microsoft Entra tenant and an Azure subscription are not the same thing.

Microsoft Entra Tenant

Primarily represents the identity environment.

It contains identities and identity-related objects.

Azure Subscription

Provides a boundary for Azure resource management, billing, quotas, and access management.

For example, an organization might have:

ABC Corporation
       │
       ▼
Microsoft Entra Tenant
       │
       ├───────────────┐
       ▼               ▼
Azure Subscription 1  Azure Subscription 2
       │               │
       ▼               ▼
   VMs / Storage     VMs / Networking

A single Microsoft Entra tenant can be associated with multiple Azure subscriptions.

This is why you should never answer:

“A tenant is an Azure subscription.”

They are different concepts.

Can one Tenant have multiple Azure subscriptions?

Yes.

This is a very common real-world scenario.

For example, a company could have:

Production subscription
Development subscription
Testing subscription
Security subscription

All of these subscriptions can be associated with the organization’s Microsoft Entra tenant.

This allows the organization to maintain a central identity environment while separating Azure resources into different subscriptions.

Can multiple organizations use the same Tenant?

This depends on the organizational arrangement and scenario, but the important interview concept is that a Microsoft Entra tenant is an identity boundary.

Organizations that operate independently generally maintain separate tenants.

However, organizations with complex structures—such as subsidiaries, mergers, acquisitions, or separate business units—may choose different tenant architectures based on their requirements.

Don’t assume that:

One company = exactly one tenant

In real-world environments, an organization can have multiple tenants.

Tenant and Microsoft 365

If an organization uses Microsoft 365, it also has a Microsoft Entra tenant associated with its Microsoft 365 environment.

For example:

ABC Corporation
       │
       ▼
Microsoft Entra Tenant
       │
       ├── Users
       ├── Groups
       ├── Devices
       ├── Applications
       │
       └── Microsoft 365 Services
              ├── Exchange Online
              ├── SharePoint Online
              ├── Teams
              └── OneDrive

This is why Microsoft Entra ID knowledge is extremely important for Microsoft 365 administrators.

What is the default domain of a Tenant?

When a Microsoft Entra tenant is created, Microsoft provides an initial domain ending in:

.onmicrosoft.com

For example:

abccompany.onmicrosoft.com

The organization can later add one or more custom domains, such as:

abccompany.com

We will cover default domains and custom domains in greater detail in later questions.

What happens when a user signs in?

The tenant plays an important role in determining where the user’s identity exists.

For example:

john@abccompany.com

may be associated with ABC Corporation’s Microsoft Entra tenant.

When John signs in to a Microsoft cloud application, Microsoft Entra ID can identify the relevant tenant and authenticate his identity.

Depending on the application and configuration, additional policies such as MFA or Conditional Access may also be evaluated.

Real-World Administrator Example

Imagine you join an organization as a Microsoft 365 / Azure Administrator.

Your company has:

3,000 employees
4 Azure subscriptions
Microsoft 365
20 SaaS applications
3,000 company devices

You might have:

                 Company
                    │
                    ▼
          Microsoft Entra Tenant
                    │
      ┌─────────────┼──────────────┐
      ▼             ▼              ▼
    Users         Groups       Applications
      │
      ▼
 Microsoft 365

                    │
                    ▼
          Azure Subscriptions
          ┌────────┬────────┐
          ▼        ▼        ▼
        Prod      Dev      Test

The tenant provides the organization’s identity foundation, while the Azure subscriptions organize the organization’s Azure resources.

This distinction becomes extremely important when troubleshooting permissions, authentication, subscriptions, and access problems.

⚠️ Common Interview Traps

Trap 1: Tenant = Subscription

❌ Incorrect:

“A tenant is an Azure subscription.”

✅ Correct:

A tenant is an identity boundary, while a subscription is an Azure resource and billing boundary.

Trap 2: Tenant = Domain

❌ Incorrect:

“The tenant is abccompany.com.”

A domain is an identity namespace associated with the tenant.

The tenant itself has its own unique Tenant ID.

Trap 3: Tenant = Windows Active Directory Domain

A Microsoft Entra tenant should not be confused with an on-premises Active Directory domain.

They are different identity concepts.

Trap 4: One organization can only have one tenant

Not necessarily.

Organizations can have multiple Microsoft Entra tenants depending on their business, security, administrative, merger/acquisition, or other requirements.

🎯 Interview Tip

If the interviewer asks:

“What is a Microsoft Entra ID tenant?”

A strong answer would be:

“A Microsoft Entra ID tenant is a dedicated instance of Microsoft Entra ID that represents an organization’s identity environment. It acts as an identity boundary and contains objects such as users, groups, applications, devices and service principals. Every tenant has a unique Tenant ID, and a tenant can be associated with multiple Azure subscriptions.”

If the interviewer follows up with:

“What is the difference between a tenant and a subscription?”

Answer:

“The tenant is primarily an identity and directory boundary, while an Azure subscription is primarily a boundary for Azure resource management, billing and quotas. A single Entra tenant can be associated with multiple Azure subscriptions.”

Quick Revision

Remember these three concepts:

Tenant → Identity boundary

Subscription → Azure resource/billing boundary

Domain → Naming/namespace associated with the tenant

And remember:

One tenant can have multiple Azure subscriptions.

🔗 Related Interview Questions

Q7. What is a Microsoft Entra ID Directory?
Q8. What is the difference between a Tenant and a Directory?
Q9. What is a Tenant ID?
Q11. What is a Microsoft Entra ID domain?
Q12. What is the default onmicrosoft.com domain?
Q13. What is a custom domain?
Q19. What is the difference between a Microsoft Entra Tenant and an Azure Subscription?
Q20. Can one Microsoft Entra tenant have multiple Azure subscriptions?

Q7. What is a Microsoft Entra ID Directory?

Interview-ready answer

A Microsoft Entra ID directory is the identity directory associated with a Microsoft Entra tenant. It stores and manages identity-related objects such as users, groups, applications, devices, and service principals.

In simple terms:

The tenant represents the organization’s Microsoft Entra environment, while the directory contains and manages the identities and directory objects within that environment.

For most practical Microsoft 365 and Azure administration tasks, you’ll often hear “tenant” and “directory” used almost interchangeably.

What does a Microsoft Entra directory contain?

A Microsoft Entra directory can contain many types of objects.

👤 Users

User objects represent people or supported user identities.

For example:

john@abccompany.com

👥 Groups

Groups allow administrators to organize users and manage access more efficiently.

For example:

IT Administrators
       │
       ├── John
       ├── Sarah
       └── David

Groups can be used for access management, application assignment, licensing, and other organizational purposes.

📱 Devices

Microsoft Entra ID can maintain device identities.

Examples include:

Microsoft Entra joined devices
Microsoft Entra registered devices
Microsoft Entra hybrid joined devices

Device identity can also be used as part of an organization’s access and security strategy.

📦 Applications

Applications can be represented in Microsoft Entra ID and integrated with it for authentication and authorization.

Examples include:

SaaS applications
Internal web applications
Custom applications
Microsoft cloud services

⚙️ Service Principals

Applications and services can have identities represented by service principal objects in a Microsoft Entra directory.

These identities allow applications or workloads to authenticate and access resources according to their assigned permissions.

We’ll cover application registrations and service principals in detail later in this guide.

Simple Directory Structure

You can visualize a Microsoft Entra directory like this:

          Microsoft Entra Tenant
                   │
                   ▼
        Microsoft Entra Directory
                   │
       ┌───────────┼────────────┐
       ▼           ▼            ▼
     Users       Groups      Applications
       │
       ├── John
       ├── Sarah
       └── David

                   │
                   ▼
                Devices

                   │
                   ▼
            Service Principals

The directory provides the identity data that Microsoft Entra ID uses for authentication, authorization, access management, and other identity-related operations.

Is a Microsoft Entra Directory the same as a Tenant?

This is where the terminology can become confusing.

In everyday Microsoft administration, tenant and directory are frequently used to refer to the same organization’s Microsoft Entra environment.

However, they emphasize different concepts.

Tenant generally emphasizes the organization’s dedicated Microsoft Entra environment and identity boundary.

Directory emphasizes the directory service and the collection of identity objects within that environment.

For an interview, you can say:

“A Microsoft Entra tenant is the organization’s dedicated identity environment, while the directory is the identity store associated with that tenant. In practical administration, the terms are often used interchangeably.”

Directory vs Windows Active Directory

Don’t confuse a Microsoft Entra directory with a traditional Windows Server Active Directory domain.

They are different identity platforms.

Windows Server Active Directory

Typically includes:

Domain Controllers
Organizational Units (OUs)
Group Policy
LDAP
Kerberos
NTLM

Microsoft Entra ID

Provides cloud identity and access capabilities such as:

Cloud identities
MFA
Conditional Access
Single Sign-On
Application identities
Device identities
Identity protection

Organizations can integrate Windows Server Active Directory with Microsoft Entra ID to create a hybrid identity environment.

Real-World Example

Suppose ABC Corporation has a Microsoft Entra tenant.

Inside that environment, the directory could contain:

ABC Corporation
      │
      ▼
Microsoft Entra Directory
      │
      ├── 5,000 Users
      ├── 300 Groups
      ├── 3,500 Devices
      ├── 40 Enterprise Applications
      └── Service Principals

When an administrator creates a new employee account, that identity becomes an object in the organization’s Microsoft Entra directory.

When the employee signs in to a supported Microsoft cloud service, Microsoft Entra ID uses information associated with that identity to authenticate the user and evaluate access.

Why is the Directory important?

The directory is fundamental because Microsoft Entra ID needs a place to maintain information about identities and resources.

For example, administrators may use directory information to:

Create and manage users
Create and manage groups
Assign application access
Manage device identities
Configure administrative roles
Configure authentication methods
Investigate sign-in activity
Manage application identities

In other words, the directory provides much of the identity information that the Microsoft Entra service operates on.

⚠️ Common Interview Mistake

Don’t say:

“The Microsoft Entra directory is the same thing as an on-premises Active Directory domain.”

That’s incorrect.

A Microsoft Entra directory and Windows Server Active Directory are different technologies with different architectures and capabilities.

Also avoid saying:

“A tenant contains many unrelated directories.”

For normal Microsoft Entra terminology, an organization’s tenant is associated with its directory.

🎯 Interview Tip

If asked:

“What is a Microsoft Entra ID directory?”

A good answer is:

“A Microsoft Entra ID directory is the identity directory associated with a Microsoft Entra tenant. It contains objects such as users, groups, applications, devices, and service principals and provides identity information used for authentication and access management.”

If the interviewer asks:

“Is a directory the same as a tenant?”

You can explain:

“The terms are closely related and are often used interchangeably in administration. A tenant emphasizes the organization’s dedicated Microsoft Entra environment and identity boundary, while a directory emphasizes the identity store and its objects.”

🔗 Related Interview Questions

Q6. What is a Microsoft Entra ID Tenant?
Q8. What is the difference between a Tenant and a Directory?
Q9. What is a Tenant ID?
Q10. What is a Directory ID?
Q15. What is a Microsoft Entra ID User?
Q16. What is a Microsoft Entra ID Group?

Quick Revision

Tenant = Organization’s dedicated Microsoft Entra environment

Directory = Identity directory associated with that tenant

Directory objects = Users, groups, applications, devices, service principals, and other supported objects

The easiest way to remember it:

Tenant → Directory → Identity Objects

Q8. What is the difference between a Microsoft Entra Tenant and a Directory?

Interview-ready answer

A Microsoft Entra tenant and a Microsoft Entra directory are closely related concepts and are often used interchangeably in everyday administration.

The easiest way to distinguish them is:

Tenant = the organization’s dedicated Microsoft Entra environment and identity boundary

Directory = the identity directory associated with that tenant, containing identity objects

A tenant has a directory associated with it, and that directory contains objects such as users, groups, applications, and devices.

Simple way to understand it

Think of a company called ABC Corporation.

            ABC Corporation
                   │
                   ▼
          Microsoft Entra Tenant
                   │
                   ▼
         Microsoft Entra Directory
                   │
       ┌───────────┼───────────┐
       ▼           ▼           ▼
     Users       Groups    Applications
       │
       ├── John
       ├── Sarah
       └── David

The tenant represents ABC Corporation’s dedicated Microsoft Entra environment.

The directory is the identity directory associated with that environment where the organization’s directory objects are maintained.

Tenant vs Directory

Tenant	Directory
Represents the organization’s dedicated Microsoft Entra environment	Represents the identity directory associated with the tenant
Emphasizes the identity boundary	Emphasizes the identity store and its objects
Has a unique Tenant ID	Contains objects such as users, groups, devices and applications
Associated with Azure subscriptions and Microsoft cloud services	Provides identity information used by Microsoft Entra ID
Used frequently in organizational and architectural discussions	Used frequently when discussing directory objects and identity data

Why do people use the terms interchangeably?

Microsoft’s terminology can sometimes make this confusing because the tenant and its directory are tightly connected.

For example, an administrator might say:

“I need to switch to another tenant.”

Another administrator might say:

“I need to switch to another directory.”

In many Azure and Microsoft 365 contexts, both may be referring to changing the Microsoft Entra environment they’re working with.

This is why you will often hear phrases such as:

Tenant ID
Directory ID
Microsoft Entra directory
Microsoft Entra tenant

used in closely related contexts.

What about Directory ID and Tenant ID?

In Microsoft Entra ID, Directory ID and Tenant ID generally refer to the same unique identifier for the tenant.

You may see both terms used in different Microsoft portals, documentation, APIs, or configuration screens.

For example:

Tenant ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

The same identifier may be referred to as the Directory ID.

We’ll examine this in more detail in Q9 and Q10.

⚠️ Common Interview Mistake

Don’t describe the relationship as:

“A tenant contains multiple completely separate directories.”

That is not the normal Microsoft Entra tenant model.

For an organization, its Microsoft Entra tenant is associated with its directory.

Also don’t confuse a Microsoft Entra directory with a Windows Server Active Directory domain. They are different technologies.

🎯 Interview Tip

If asked:

“What is the difference between a tenant and a directory?”

A concise answer is:

“A tenant represents an organization’s dedicated Microsoft Entra environment and identity boundary, while the directory refers to the identity directory associated with that tenant. The directory contains objects such as users, groups, applications, and devices. In practice, the terms are often used interchangeably.”

That’s enough for most administrator-level interviews. If the interviewer wants more detail, then explain the tenant’s relationship with subscriptions and directory objects.

🔗 Related Interview Questions

Q6. What is a Microsoft Entra ID Tenant?
Q7. What is a Microsoft Entra ID Directory?
Q9. What is a Tenant ID?
Q10. What is a Directory ID? Is it different from a Tenant ID?
Q19. What is the difference between a Microsoft Entra Tenant and an Azure Subscription?

Quick Revision

Tenant → Dedicated identity environment / boundary

Directory → Identity directory associated with the tenant

Tenant ID / Directory ID → Generally the same unique tenant identifier

Q9. What is a Microsoft Entra Tenant ID?

Interview-ready answer

A Microsoft Entra Tenant ID is a unique identifier assigned to a Microsoft Entra tenant.

It identifies a specific Microsoft Entra environment and is typically represented as a GUID (Globally Unique Identifier).

For example:

12345678-abcd-1234-abcd-123456789abc

Every Microsoft Entra tenant has its own unique Tenant ID.

Why is Tenant ID important?

The Tenant ID is used to identify the correct Microsoft Entra environment in many Microsoft cloud and application scenarios.

You may encounter it when working with:

Microsoft Entra applications
Microsoft Graph
Azure CLI
PowerShell
Application authentication
API configurations
Azure resources
Automation scripts
Enterprise applications

For example, when configuring an application to authenticate users against a specific Microsoft Entra tenant, the application’s configuration may include the Tenant ID.

Tenant ID vs Tenant Name

Don’t confuse the Tenant ID with the organization’s name or domain.

For example:

Organization:
ABC Corporation

Domain:
abccompany.com

Tenant:
ABC Corporation's Microsoft Entra environment

Tenant ID:
12345678-abcd-1234-abcd-123456789abc

The organization may change its display name or add/remove domains, but the Tenant ID remains the unique identifier for that tenant.

Where can you find the Tenant ID?

Administrators can find the Tenant ID in the Microsoft Entra administration experience, including the tenant’s properties/overview information.

It can also be retrieved using Microsoft tools such as:

Microsoft Entra admin center
Azure portal
Azure CLI
PowerShell
Microsoft Graph

The exact location and interface can change as Microsoft updates its portals, so administrators should refer to the current Microsoft documentation when following a specific procedure.

Real-world example

Suppose an organization has:

Company: ABC Corporation

Tenant: ABC Corporation’s Microsoft Entra tenant

Tenant ID: 12345678-abcd-1234-abcd-123456789abc

ABC Corporation may have several Azure subscriptions associated with that tenant.

When an application or administrative process needs to identify which Microsoft Entra tenant it should work with, the Tenant ID provides an unambiguous identifier.

⚠️ Common Interview Mistake

Don’t confuse these three:

Tenant ID → Identifies the Microsoft Entra tenant.

Object ID → Identifies a specific directory object, such as a user or application-related object.

Subscription ID → Identifies an Azure subscription.

They are different identifiers used for different purposes.

🎯 Interview Tip

If asked:

“What is a Tenant ID?”

A strong answer is:

“A Microsoft Entra Tenant ID is a unique GUID that identifies a specific Microsoft Entra tenant. It is commonly used in application authentication, APIs, automation, and Azure administration to identify the target identity environment.”

🔗 Related Interview Questions

Q6. What is a Microsoft Entra ID Tenant?
Q8. What is the difference between a Tenant and a Directory?
Q10. What is a Directory ID? Is it different from a Tenant ID?
Q17. What is an Object ID?
Q19. What is the difference between a Microsoft Entra Tenant and an Azure Subscription?

Quick Revision

Tenant ID = Unique identifier of a Microsoft Entra tenant

Think:

Tenant → Tenant ID

User/Object → Object ID

Azure Subscription → Subscription ID

Q10. What is a Directory ID? Is it different from a Tenant ID?

Interview-ready answer

In Microsoft Entra ID, Directory ID and Tenant ID generally refer to the same unique identifier of a Microsoft Entra tenant.

In other words:

Directory ID = Tenant ID

Both identify the specific Microsoft Entra directory/tenant.

The identifier is typically represented as a GUID, for example:

12345678-abcd-1234-abcd-123456789abc

Why are there two names?

The different terminology comes from the fact that Microsoft Entra ID is commonly described using both tenant and directory terminology.

You may therefore encounter:

Tenant ID
Directory ID
Directory (tenant) ID
Tenant identifier

When working with a Microsoft Entra environment, these generally point to the same unique tenant identifier.

For example, Microsoft documentation or a configuration screen might show:

Directory (tenant) ID: 12345678-abcd-1234-abcd-123456789abc

Another application or administrator might refer to the same value as the:

Tenant ID

Simple example

Imagine ABC Corporation has a Microsoft Entra tenant.

ABC Corporation
       │
       ▼
Microsoft Entra Tenant
       │
       └── Tenant / Directory ID
              │
              ▼
   12345678-abcd-1234-abcd-123456789abc

The identifier tells Microsoft services and applications which Microsoft Entra tenant is being referenced.

Where might you see Directory ID?

You may encounter the term Directory ID in:

Azure portal
Microsoft Entra admin center
Application configurations
Microsoft Graph
Azure CLI
PowerShell
OAuth/OpenID Connect configurations
Azure-related documentation

For example, when registering or configuring an application, you may be asked for the Directory (tenant) ID.

That is referring to the tenant’s unique identifier.

Directory ID vs Object ID

This is another distinction that is important in interviews.

Suppose your organization has:

Tenant ID:

11111111-2222-3333-4444-555555555555

And a user has:

Object ID:

aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee

These identifiers refer to completely different things.

Identifier	Identifies
Tenant ID / Directory ID	The Microsoft Entra tenant
Object ID	A specific directory object
Subscription ID	An Azure subscription

So:

Tenant/Directory ID → Which tenant?

Object ID → Which object inside the tenant?

Subscription ID → Which Azure subscription?

⚠️ Common Interview Mistake

A common misconception is:

“Tenant ID and Directory ID are two different IDs.”

For normal Microsoft Entra terminology, that’s not correct.

When you see:

Directory (tenant) ID

you should understand that Microsoft is referring to the unique identifier of that Microsoft Entra tenant.

🎯 Interview Tip

If the interviewer asks:

“Is Directory ID different from Tenant ID?”

A strong answer is:

“No. In Microsoft Entra ID, Directory ID and Tenant ID generally refer to the same unique identifier of the tenant. You may see the terminology Directory ID, Tenant ID, or Directory (tenant) ID depending on the Microsoft portal, documentation, or application configuration.”

Then, if they ask:

“What is the difference between Tenant ID and Object ID?”

Answer:

“Tenant ID identifies the Microsoft Entra tenant, whereas Object ID identifies a specific object within that tenant, such as a user or other directory object.”

🔗 Related Interview Questions

Q6. What is a Microsoft Entra ID Tenant?
Q7. What is a Microsoft Entra ID Directory?
Q8. What is the difference between a Tenant and a Directory?
Q9. What is a Tenant ID?
Q17. What is an Object ID?
Q19. What is the difference between a Microsoft Entra Tenant and an Azure Subscription?

Quick Revision

Remember:

Tenant ID = Directory ID

Both identify the Microsoft Entra tenant.

Don’t confuse them with:

Object ID → identifies an object

Subscription ID → identifies an Azure subscription

Q11. What is a Microsoft Entra ID Domain?

Interview-ready answer

A Microsoft Entra ID domain is a domain name that is associated with a Microsoft Entra tenant and can be used as part of users’ sign-in names, email addresses, and other identity-related configurations.

A tenant can have an initial domain provided by Microsoft and can also have one or more custom domains added by the organization.

For example:

Microsoft Entra Tenant
        │
        ├── Initial domain
        │     └── abccompany.onmicrosoft.com
        │
        └── Custom domain
              └── abccompany.com

What is an Initial Domain?

When a Microsoft Entra tenant is created, Microsoft provides an initial domain ending in:

.onmicrosoft.com

For example:

abccompany.onmicrosoft.com

This domain is associated with the tenant and is available for use even if the organization has not yet added its own custom domain.

The initial domain is useful when setting up the tenant and creating initial users and identities.

What is a Custom Domain?

An organization can add its own domain to Microsoft Entra ID.

For example, instead of users signing in with:

john@abccompany.onmicrosoft.com

the organization may configure:

john@abccompany.com

Here:

abccompany.com is the organization’s custom domain.

Custom domains make the Microsoft cloud identity environment align with the organization’s existing business identity and email domain.

Why do organizations add custom domains?

Suppose a company called ABC Corporation owns:

abccompany.com

When the company first creates its Microsoft Entra tenant, it may receive:

abccompany.onmicrosoft.com

However, the organization probably wants employees to use:

john@abccompany.com

rather than:

john@abccompany.onmicrosoft.com

Adding and verifying the organization’s custom domain allows the company to use its own domain for identities.

This provides a more familiar and professional sign-in experience.

Can a tenant have multiple domains?

Yes.

A Microsoft Entra tenant can have multiple domain names associated with it.

For example:

ABC Corporation – Microsoft Entra Tenant
│
├── abccompany.onmicrosoft.com
├── abccompany.com
├── abccompany.co.uk
└── subsidiary.com

This can be useful for organizations that operate with:

Multiple business domains
Different brands
Subsidiaries
Different geographic regions
Multiple email namespaces

However, adding a domain to a tenant does not automatically mean that every user will use that domain.

Administrators can assign appropriate domain names when creating or configuring identities.

How is a Custom Domain Added?

At a high level, the process is:

Organization owns abccompany.com
              ↓
Add abccompany.com to Entra ID
              ↓
Microsoft provides verification information
              ↓
Add required DNS record
              ↓
Verify ownership
              ↓
Domain becomes verified
              ↓
Domain can be used in Entra ID

Microsoft requires domain ownership verification before a custom domain can be used as a verified domain in the tenant.

The exact DNS record and administration steps can vary depending on the verification method and Microsoft’s current portal experience.

Domain vs Tenant

A domain should not be confused with a tenant.

For example:

Tenant:
ABC Corporation's Microsoft Entra environment

Tenant ID:
12345678-abcd-1234-abcd-123456789abc

Domains:
abccompany.onmicrosoft.com
abccompany.com

The tenant is the identity environment.

The domains are names associated with that tenant.

A tenant can therefore have multiple domains.

Domain vs Email Address

Another common source of confusion is the difference between a domain and a user’s email/sign-in address.

For example:

john@abccompany.com

can be broken into:

Username: john

Domain: abccompany.com

The domain itself is not the user account.

It is the namespace used as part of the user’s identity.

Real-World Example

Imagine a company called Contoso Technologies.

When it creates a Microsoft Entra tenant, it might receive:

contoso123.onmicrosoft.com

The company already owns:

contoso.com

The administrator adds and verifies contoso.com in Microsoft Entra ID.

The organization can then use identities such as:

john@contoso.com

admin@contoso.com

rather than relying solely on the initial onmicrosoft.com domain.

The tenant remains the same.

Only the domain namespace being used for identities has been added.

⚠️ Common Interview Mistakes

Mistake 1:

“The custom domain is the Microsoft Entra tenant.”

❌ Incorrect.

The domain is associated with the tenant.

Mistake 2:

“Every tenant can have only one domain.”

❌ Incorrect.

A tenant can have multiple associated domains.

Mistake 3:

“Adding a custom domain automatically migrates users.”

❌ Incorrect.

Adding and verifying a domain does not automatically migrate all identities or change every user’s sign-in address.

Mistake 4:

“The .onmicrosoft.com domain is optional.”

The tenant receives an initial onmicrosoft.com domain as part of tenant creation. Organizations can add custom domains in addition to it.

🎯 Interview Tip

If asked:

“What is a Microsoft Entra ID domain?”

A strong answer would be:

“A Microsoft Entra ID domain is a domain name associated with a Microsoft Entra tenant. A tenant receives an initial onmicrosoft.com domain when it is created, and an organization can add and verify custom domains such as company.com for user sign-in names and other identity-related purposes.”

If the interviewer asks:

“Can one tenant have multiple domains?”

Answer:

“Yes. A Microsoft Entra tenant can have multiple associated domains, including the initial onmicrosoft.com domain and one or more verified custom domains.”

🔗 Related Interview Questions

Q6. What is a Microsoft Entra ID Tenant?
Q9. What is a Tenant ID?
Q12. What is the default onmicrosoft.com domain?
Q13. What is a custom domain in Microsoft Entra ID?
Q14. Why would an organization add a custom domain?
Q15. What is a Microsoft Entra ID User?

Quick Revision

Tenant = Identity environment

Domain = Namespace associated with the tenant

Initial domain = onmicrosoft.com

Custom domain = Organization’s own domain, such as company.com

And remember:

One Microsoft Entra tenant can have multiple domains.

Q12. What is the default `onmicrosoft.com` domain in Microsoft Entra ID?

Interview-ready answer

When a Microsoft Entra tenant is created, Microsoft provides an initial domain that ends with:

.onmicrosoft.com

For example:

contoso.onmicrosoft.com

This initial domain is automatically associated with the tenant and can be used for identities and other tenant-related purposes.

It provides an organization with a usable domain namespace before it adds and verifies its own custom domain.

Simple example

Suppose a company called ABC Corporation creates a Microsoft Entra tenant.

During tenant creation, it may receive an initial domain such as:

abccompany.onmicrosoft.com

The organization can then have a user such as:

john@abccompany.onmicrosoft.com

Later, the company can add and verify its own domain:

abccompany.com

The same tenant could then use:

john@abccompany.com

The important point is:

Adding a custom domain does not create a new tenant.

The custom domain is simply associated with the existing Microsoft Entra tenant.

Why does Microsoft provide an `onmicrosoft.com` domain?

The initial domain gives the tenant a Microsoft-managed namespace immediately after the tenant is created.

This is useful because an organization may not have configured its own domain yet.

For example:

New Microsoft Entra Tenant
          │
          ▼
Initial domain assigned
          │
          ▼
companyname.onmicrosoft.com
          │
          ▼
Users and tenant configuration
          │
          ▼
Optional custom domain
          │
          ▼
company.com

The organization can therefore start configuring its Microsoft cloud environment before adding a custom domain.

Can the `onmicrosoft.com` domain be removed?

The initial domain has a special role in the tenant and should not be treated like an ordinary custom domain.

An organization can add additional custom domains, but the initial onmicrosoft.com domain remains associated with the tenant.

Therefore, administrators should not think of the custom domain process as replacing the tenant’s underlying Microsoft-provided identity namespace.

Can users continue using the `onmicrosoft.com` domain?

Yes, depending on the organization’s configuration and requirements.

For example, a tenant might contain:

john@company.com
sarah@company.com
admin@company.onmicrosoft.com

However, organizations generally prefer their custom domain for employee-facing identities because it aligns with their corporate identity.

The onmicrosoft.com domain may still appear in administrative, technical, or tenant-related scenarios.

Is `onmicrosoft.com` the same as a custom domain?

No.

The distinction is:

Initial `onmicrosoft.com` domain	Custom domain
Provided as part of tenant creation	Added by the organization
Microsoft-managed namespace	Organization’s own domain
Associated with the tenant from the beginning	Must be added and verified
Example: `contoso.onmicrosoft.com`	Example: `contoso.com`

Real-world example

Suppose XYZ Technologies creates a Microsoft Entra tenant.

Its initial domain might be:

xyztechnologies.onmicrosoft.com

The organization already owns:

xyztechnologies.com

The administrator adds and verifies:

xyztechnologies.com

The tenant can then use identities such as:

john@xyztechnologies.com

while the original:

xyztechnologies.onmicrosoft.com

remains associated with the tenant.

So the organization now has one tenant with multiple domains.

⚠️ Common Interview Mistakes

Mistake 1:

“onmicrosoft.com is the tenant.”

❌ Incorrect.

The onmicrosoft.com name is a domain associated with the tenant.

Mistake 2:

“Adding a custom domain creates another tenant.”

❌ Incorrect.

The custom domain is added to the existing tenant.

Mistake 3:

“The initial domain is the same as the company’s actual domain.”

Not necessarily.

The initial domain is provided through Microsoft’s tenant creation process, while the organization can later add its own verified domain.

🎯 Interview Tip

If asked:

“What is the onmicrosoft.com domain?”

A strong answer is:

“When a Microsoft Entra tenant is created, Microsoft provides an initial domain ending in onmicrosoft.com. It provides the tenant with an initial namespace that can be used for identities and tenant-related configuration. The organization can later add and verify custom domains such as company.com without creating a new tenant.”

🔗 Related Interview Questions

Q6. What is a Microsoft Entra ID Tenant?
Q11. What is a Microsoft Entra ID Domain?
Q13. What is a Custom Domain in Microsoft Entra ID?
Q14. Why would an organization add a Custom Domain?
Q15. What is a Microsoft Entra ID User?

Quick Revision

onmicrosoft.com = Initial Microsoft-provided domain associated with the tenant

company.com = Custom domain added and verified by the organization

And remember:

Adding a custom domain does not create a new Microsoft Entra tenant.

Q13. What is a Custom Domain in Microsoft Entra ID?

Interview-ready answer

A custom domain in Microsoft Entra ID is an organization’s own domain name that is added to and verified within a Microsoft Entra tenant.

For example, Microsoft provides an initial domain such as:

contoso.onmicrosoft.com

If the organization owns:

contoso.com

it can add contoso.com as a custom domain to its Microsoft Entra tenant.

After the domain is verified, the organization can use it for identities and other supported Microsoft cloud scenarios.

Simple definition: A custom domain allows an organization to use its own domain name with its Microsoft Entra identity environment.

Why is domain verification required?

Microsoft needs to confirm that the organization actually owns or controls the domain before allowing it to be associated as a verified domain in the tenant.

For example, suppose an organization claims ownership of:

contoso.com

Another person should not be able to simply add contoso.com to their Microsoft Entra tenant.

Therefore, Microsoft provides a verification method involving a DNS record.

The administrator adds the required record to the organization’s DNS configuration.

Microsoft then checks the DNS information to verify control of the domain.

How does the custom-domain process work?

At a high level:

Organization owns
    contoso.com
        │
        ▼
Add domain to
Microsoft Entra ID
        │
        ▼
Microsoft provides
verification information
        │
        ▼
Add DNS verification
record
        │
        ▼
Microsoft verifies
domain ownership
        │
        ▼
Domain becomes
verified
        │
        ▼
Can be used in
supported scenarios

The exact DNS record and portal steps can change as Microsoft updates its services, so administrators should follow the current Microsoft documentation when performing the configuration.

Example

Imagine ABC Corporation owns:

abccompany.com

Its Microsoft Entra tenant initially has:

abccompany.onmicrosoft.com

The administrator adds:

abccompany.com

to the tenant.

Microsoft provides the required verification information.

The administrator adds the appropriate DNS record to the organization’s DNS provider.

After Microsoft verifies the domain:

Microsoft Entra Tenant
        │
        ├── abccompany.onmicrosoft.com
        │       Initial domain
        │
        └── abccompany.com
                Custom domain
                ✓ Verified

The organization can then use the custom domain for supported identity-related configurations.

For example, users can have sign-in names such as:

john@abccompany.com

instead of:

john@abccompany.onmicrosoft.com

Can a tenant have multiple custom domains?

Yes.

A Microsoft Entra tenant can have multiple verified custom domains.

For example:

ABC Corporation
       │
       ▼
Microsoft Entra Tenant
       │
       ├── abccompany.onmicrosoft.com
       ├── abccompany.com
       ├── abccompany.co.uk
       └── abcsubsidiary.com

This can be useful for organizations that have:

Multiple business domains
Subsidiaries
Multiple brands
Different geographic domains
Different organizational namespaces

The exact design depends on the organization’s identity requirements.

Custom Domain vs Initial Domain

This distinction is important.

Initial Domain	Custom Domain
Provided when the tenant is created	Added by the organization
Ends in `onmicrosoft.com`	Uses the organization’s own domain
Already associated with the tenant	Must be added and verified
Example: `abccompany.onmicrosoft.com`	Example: `abccompany.com`

Both can coexist in the same tenant.

Does adding a custom domain automatically change existing users?

Not necessarily.

Adding and verifying a custom domain does not automatically mean every existing user’s sign-in name is changed.

For example, if a user currently has:

john@abccompany.onmicrosoft.com

adding:

abccompany.com

doesn’t automatically mean the user becomes:

john@abccompany.com

The administrator must configure the appropriate identity properties according to the organization’s requirements.

This is an important distinction in real-world administration.

Does a Custom Domain Create a New Tenant?

No.

This is one of the most important points to remember.

Suppose you already have:

Tenant:
ABC Corporation

Tenant ID:
12345678-abcd-1234-abcd-123456789abc

and you add:

abccompany.com

You still have:

One Microsoft Entra tenant

You have simply added another verified domain to that tenant.

⚠️ Common Interview Mistakes

Mistake 1:

“A custom domain is the same thing as a tenant.”

❌ Incorrect.

A custom domain is associated with a tenant.

Mistake 2:

“You can add any domain without verification.”

❌ Incorrect.

Microsoft requires domain verification to establish control of the domain.

Mistake 3:

“Adding a custom domain automatically changes every user’s username.”

❌ Incorrect.

Adding the domain and changing user identities are separate administrative actions.

Mistake 4:

“One tenant can have only one domain.”

❌ Incorrect.

A tenant can have multiple associated domains, subject to Microsoft’s current service limits and configuration rules.

🎯 Interview Tip

If asked:

“What is a custom domain in Microsoft Entra ID?”

A strong answer is:

“A custom domain is an organization’s own domain that is added to and verified within a Microsoft Entra tenant. For example, an organization can add company.com to its tenant and use it for supported identity-related scenarios. Microsoft requires domain verification, typically through DNS, to confirm that the organization controls the domain.”

If the interviewer asks:

“Does adding a custom domain create a new tenant?”

Answer:

“No. The custom domain is added to the existing Microsoft Entra tenant. It does not create a new tenant.”

🔗 Related Interview Questions

Q6. What is a Microsoft Entra ID Tenant?
Q9. What is a Tenant ID?
Q11. What is a Microsoft Entra ID Domain?
Q12. What is the default onmicrosoft.com domain?
Q14. Why would an organization add a custom domain?
Q15. What is a Microsoft Entra ID User?

Quick Revision

Custom Domain = Organization’s own domain added to Microsoft Entra ID

Example:

Initial domain: company.onmicrosoft.com

Custom domain: company.com

Remember:

Add → Verify → Configure → Use

Q14. Why Would an Organization Add a Custom Domain to Microsoft Entra ID?

Interview-ready answer

Organizations add a custom domain to Microsoft Entra ID so that they can use their own organizational domain name for identities and supported Microsoft cloud services.

For example, instead of using:

john@contoso.onmicrosoft.com

an organization may want its users to use:

john@contoso.com

A custom domain provides a more familiar identity experience and allows the organization’s Microsoft cloud identities to align with its existing business domain.

1. To Use the Organization’s Existing Domain

Most organizations already own a domain name.

For example:

contoso.com

After adding and verifying this domain in Microsoft Entra ID, the organization can use it within its Microsoft cloud identity environment.

Organization's existing domain
          │
          ▼
      contoso.com
          │
          ▼
Add to Microsoft Entra ID
          │
          ▼
Verify ownership
          │
          ▼
Use for supported
identity scenarios

This allows the organization’s cloud identities to use a familiar corporate namespace.

2. To Provide a Professional Sign-In Experience

Compare:

Without custom domain:

john@contoso.onmicrosoft.com

With custom domain:

john@contoso.com

The second address is generally easier for employees, customers, and partners to recognize as belonging to the organization.

For companies already using contoso.com for email and other services, using the same domain for Microsoft Entra identities provides a more consistent identity experience.

3. To Align Microsoft 365 with the Organization’s Identity

Microsoft Entra ID is closely integrated with Microsoft 365.

An organization may already use its custom domain for services such as:

Corporate email
Company website
User identities
Microsoft 365
Other business applications

Using the organization’s domain in Microsoft Entra ID helps maintain a consistent identity namespace.

For example:

                 contoso.com
                      │
       ┌──────────────┼──────────────┐
       ▼              ▼              ▼
   Microsoft       Email         Business Apps
   Entra ID
       │
       ▼
   Microsoft 365

4. To Support Multiple Business Domains

Large organizations may have more than one domain.

For example:

Microsoft Entra Tenant
       │
       ├── contoso.com
       ├── contoso.co.uk
       ├── contoso.de
       └── subsidiary.com

Different domains may represent:

Different countries
Different brands
Subsidiaries
Acquired companies
Different business units

Microsoft Entra ID allows organizations to associate multiple domains with a tenant.

5. To Make User Sign-In Names Easier to Understand

A custom domain can make users’ sign-in names more recognizable.

For example:

john@contoso.com

is immediately recognizable as a corporate identity.

This can also make administrative tasks easier because administrators can quickly identify which organization or domain a user belongs to.

6. To Support Existing Identity and Email Naming Conventions

Organizations often have established naming standards.

For example:

firstname.lastname@contoso.com

When Microsoft cloud identities are configured, the organization may want to maintain the same naming convention.

This can provide consistency across:

Microsoft Entra ID
Microsoft 365
Exchange Online
Other applications

The exact configuration depends on the organization’s environment.

Important: A Custom Domain Does Not Replace the Tenant

Adding a custom domain does not create a new Microsoft Entra tenant.

For example:

Microsoft Entra Tenant
       │
       ├── contoso.onmicrosoft.com
       │
       └── contoso.com

There is still only one tenant.

The organization has simply added another verified domain to that tenant.

Custom Domain vs Tenant

This distinction is worth remembering for interviews.

Tenant = Identity environment

Custom domain = Domain namespace associated with the tenant

For example:

Tenant: Contoso’s Microsoft Entra environment

Tenant ID: 12345678-abcd-1234-abcd-123456789abc

Custom domain: contoso.com

They are three different concepts.

⚠️ Common Interview Mistakes

Mistake 1:

“The custom domain is required to create a Microsoft Entra tenant.”

❌ Incorrect.

A tenant receives an initial Microsoft-provided domain when it is created.

Mistake 2:

“Adding a custom domain creates another tenant.”

❌ Incorrect.

It is added to the existing tenant.

Mistake 3:

“Custom domains are only used for email.”

❌ Incorrect.

They can be used for supported Microsoft Entra identity and Microsoft cloud scenarios; they are not simply an email feature.

🎯 Interview Tip

If asked:

“Why would an organization add a custom domain to Microsoft Entra ID?”

A strong answer would be:

“Organizations add a custom domain so they can use their own verified domain, such as company.com, with their Microsoft Entra environment. This provides a consistent and recognizable identity namespace, supports organizational naming conventions, and can accommodate multiple business domains. The custom domain is added to the existing tenant; it does not create a new tenant.”

🔗 Related Interview Questions

Q6. What is a Microsoft Entra ID Tenant?
Q11. What is a Microsoft Entra ID Domain?
Q12. What is the default onmicrosoft.com domain?
Q13. What is a Custom Domain in Microsoft Entra ID?
Q15. What is a Microsoft Entra ID User?

Quick Revision

Organizations add custom domains mainly to:

Use their own domain → Provide recognizable identities → Maintain naming consistency → Support multiple organizational domains

Example:

john@contoso.com

instead of:

john@contoso.onmicrosoft.com

Q15. What is a Microsoft Entra ID User?

Interview-ready answer

A Microsoft Entra ID user is an identity object that represents a person or user account within a Microsoft Entra tenant.

Organizations use user identities to provide employees, administrators, guests, and other users with access to applications, services, and resources according to their assigned permissions and policies.

For example:

john@contoso.com

can represent a user identity in the organization’s Microsoft Entra tenant.

A Microsoft Entra user can be created directly in the cloud or, in a hybrid identity environment, synchronized from an on-premises Active Directory environment.

What information does a User object contain?

A Microsoft Entra user object contains information and properties associated with the identity.

Depending on the user and configuration, this can include:

Display name
User principal name (UPN)
Object ID
Tenant information
Account status
Authentication-related information
Group memberships
Assigned licenses
Directory roles
Application access
Device associations
Other directory attributes

For example:

Microsoft Entra User
       │
       ├── Display Name
       │      John Smith
       │
       ├── UPN
       │      john@contoso.com
       │
       ├── Object ID
       │      Unique identifier
       │
       ├── Group Memberships
       │      IT-Users
       │      Microsoft-365-Users
       │
       └── Access
              Microsoft 365
              Applications
              Azure resources

The exact properties available depend on the identity type and Microsoft Entra configuration.

What is a User Principal Name (UPN)?

The User Principal Name (UPN) is a sign-in name associated with a user.

For example:

john@contoso.com

The UPN typically follows the format:

username@domain

The domain portion must be an appropriate domain associated with the tenant.

UPNs are commonly used when users sign in to Microsoft cloud services.

What types of Microsoft Entra users can you encounter?

From an administrator’s perspective, two important categories are:

1. Member User

A Member user generally represents a user belonging to the organization’s tenant.

For example:

Employees
Internal administrators
Organizational users

A member user might have:

john@contoso.com

as their sign-in name.

2. Guest User

A Guest user is typically an external identity invited to collaborate with an organization.

For example, a company might invite:

partner@example.com

to access a specific application, SharePoint site, or other resource.

Guest users are commonly associated with Microsoft Entra External ID / B2B collaboration scenarios.

We’ll cover external identities in more detail later in this guide.

Cloud-only User vs Synchronized User

Another important distinction is where the user identity is managed.

Cloud-only user

A cloud-only user is created and managed directly in Microsoft Entra ID.

For example:

Administrator
     │
     ▼
Microsoft Entra ID
     │
     ▼
Creates User
     │
     ▼
Cloud-only User

The identity does not originate from an on-premises Active Directory synchronization process.

Synchronized User

A synchronized user originates from an organization’s on-premises Active Directory and is synchronized to Microsoft Entra ID using a supported hybrid identity solution.

For example:

On-premises Active Directory
          │
          │ Synchronization
          ▼
Microsoft Entra ID
          │
          ▼
Cloud representation
of the user

This allows organizations to maintain a hybrid identity environment.

We’ll cover Microsoft Entra Connect and synchronization in much greater detail later in the article.

User Object vs User Account

These terms are often used interchangeably, but there is a useful distinction.

A user object is the directory object representing the identity in Microsoft Entra ID.

A user account generally refers to the identity and its ability to sign in and access resources.

For practical administration, you’ll often hear:

“Create a user.”

This means creating the appropriate user object in Microsoft Entra ID.

How does a Microsoft Entra User get access to resources?

Creating a user does not automatically give the user access to everything in the organization.

Access can be determined through various mechanisms, such as:

Group membership
Application assignments
Microsoft Entra roles
Azure RBAC
Conditional Access
Resource permissions
Licenses
Application-specific authorization

For example:

John
 │
 ▼
Microsoft Entra User
 │
 ├── Member of IT Group
 │
 ├── Assigned Microsoft 365 License
 │
 ├── Assigned Application
 │
 └── Azure RBAC Role
          │
          ▼
    Authorized Resources

This is an important concept:

Having an identity does not automatically mean having permission to access every resource.

What happens when a user is disabled?

An administrator can disable a user’s ability to sign in.

This can be useful when:

An employee leaves the organization
An account is suspected of compromise
Access needs to be temporarily suspended
Security policy requires the account to be blocked

Disabling an account and deleting an account are not the same operation.

A disabled user remains in the directory but cannot sign in while the account is disabled.

Real-world example

Imagine Contoso Corporation has 2,000 employees.

The organization uses Microsoft Entra ID for identity management.

A new employee, Sarah, joins the IT department.

Her account might be:

Sarah@contoso.com

The administrator can:

Create or synchronize her identity.
Add her to appropriate groups.
Assign required licenses.
Provide access to necessary applications.
Apply appropriate security policies.
Assign administrative permissions only if required.

When Sarah leaves the company, the organization can disable her account and remove or adjust her access according to its offboarding process.

This demonstrates that identity management involves the entire identity lifecycle, not simply creating a username and password.

⚠️ Common Interview Mistakes

Mistake 1:

“Every Microsoft Entra user is created directly in the cloud.”

❌ Incorrect.

Users can also originate from on-premises Active Directory and be synchronized to Microsoft Entra ID.

Mistake 2:

“Creating a user automatically gives them access to Azure.”

❌ Incorrect.

Access depends on roles, permissions, group membership, resource permissions, and applicable policies.

Mistake 3:

“Guest users are normal employees.”

❌ Not necessarily.

Guest users generally represent external identities participating in collaboration or external-access scenarios.

Mistake 4:

“Deleting a user and disabling a user are the same.”

❌ Incorrect.

Disabling prevents sign-in while retaining the user object; deletion removes the user object from the directory, subject to Microsoft’s recovery mechanisms and retention behavior.

🎯 Interview Tip

If asked:

“What is a Microsoft Entra ID user?”

A strong answer is:

“A Microsoft Entra ID user is an identity object representing a person or user account within a Microsoft Entra tenant. Users can be cloud-only or synchronized from on-premises Active Directory, and their access to applications and resources is controlled through permissions, groups, roles, licenses, and security policies.”

If the interviewer asks:

“What is the difference between a cloud-only and synchronized user?”

Answer:

“A cloud-only user is created and managed directly in Microsoft Entra ID, whereas a synchronized user originates from on-premises Active Directory and is synchronized to Microsoft Entra ID through a hybrid identity solution.”

🔗 Related Interview Questions

Q6. What is a Microsoft Entra ID Tenant?
Q11. What is a Microsoft Entra ID Domain?
Q16. What is a Microsoft Entra ID Group?
Q22. What is Microsoft Entra Connect?
Q23. What is Directory Synchronization?
Q24. What is Password Hash Synchronization?
Q136. What is Microsoft Entra External ID?

Quick Revision

Microsoft Entra User = Identity object representing a user in the tenant

Remember the two important sources:

Cloud-only → Created in Microsoft Entra ID

Synchronized → Originates from on-premises AD and is synchronized to Microsoft Entra ID

And remember:

Identity ≠ Permission

A user can exist in the directory without automatically having access to every resource.

Q16. What is a Microsoft Entra ID Group?

Interview-ready answer

A Microsoft Entra ID group is a collection of users or other supported directory objects that can be managed together.

Groups help administrators simplify access management, application assignment, licensing, and organization of identities.

Instead of assigning permissions or access individually to hundreds or thousands of users, an administrator can assign the appropriate access to a group and manage membership centrally.

Simple example

Suppose a company has 500 employees in its IT department.

Instead of assigning access to an application one user at a time:

Application
     │
     ├── John
     ├── Sarah
     ├── David
     ├── Ahmed
     ├── Priya
     └── ... 500 users

the administrator can create:

IT-Employees Group
       │
       ├── John
       ├── Sarah
       ├── David
       ├── Ahmed
       └── Priya
              │
              ▼
       Application Access

Now access can be managed through the group.

What are Microsoft Entra groups used for?

Groups can be useful for several administrative purposes.

1. Access Management

Groups can help manage access to applications and resources.

For example:

Finance Users → Finance Application

Instead of assigning application access individually, administrators can manage membership in the Finance group.

2. Application Assignment

Organizations can assign supported enterprise applications to groups.

For example:

Salesforce
    │
    ▼
Sales Group
    │
    ├── John
    ├── Sarah
    └── David

Members of the appropriate group can receive access according to the application’s configuration.

3. Group-Based Licensing

Organizations can use groups to assign supported Microsoft licenses.

For example:

Microsoft 365 License
        │
        ▼
Microsoft 365 Users Group
        │
        ├── John
        ├── Sarah
        └── David

When users are added to or removed from the group, license assignment can be managed automatically according to the group’s configuration.

4. Conditional Access

Groups can be used to target users in Conditional Access policies.

For example, an organization may have:

IT Administrators Group

and create a Conditional Access policy targeting that group.

This can be useful when an organization wants stronger authentication requirements for administrators.

We will cover Conditional Access in detail later in this guide.

What types of groups are available?

Two important Microsoft Entra group types are:

Security Groups

Security groups are commonly used to manage access to resources and applications.

For example:

IT-Admins

Finance-Users

HR-Employees

Security groups can be used in many identity and access management scenarios.

Microsoft 365 Groups

Microsoft 365 Groups are designed primarily for collaboration across Microsoft 365 services.

Depending on the configuration, a Microsoft 365 Group can be associated with services such as:

Outlook
SharePoint
Microsoft Teams
Planner

The purpose is different from simply using a security group for access control.

Security Group vs Microsoft 365 Group

This is a common interview question.

Security Group	Microsoft 365 Group
Primarily used for access and permission management	Primarily designed for collaboration
Can be used to manage access to resources	Provides a collaboration membership model
Commonly used with applications and access policies	Integrates with Microsoft 365 collaboration services
Can be used for group-based licensing	Can also be used for supported group-based licensing scenarios

Simple way to remember

Security Group → Access

Microsoft 365 Group → Collaboration

There are cases where a Microsoft 365 Group can also participate in access-related scenarios, so this is a useful rule of thumb rather than an absolute limitation.

Assigned vs Dynamic Group Membership

Microsoft Entra groups can use different membership approaches.

Assigned Membership

With assigned membership, an administrator directly adds or removes users from the group.

Example:

IT Group
 │
 ├── John ← Added manually
 ├── Sarah ← Added manually
 └── David ← Added manually

The administrator manages membership directly.

Dynamic Membership

With dynamic membership, Microsoft Entra ID automatically evaluates users against membership rules.

For example, an organization might have a rule based on an attribute such as:

Department = Finance

Users who meet the rule can automatically become members of the group.

User Attributes
      │
      ▼
Membership Rule
      │
      ▼
Microsoft Entra ID
      │
      ▼
Dynamic Group
      │
      ├── Finance User 1
      ├── Finance User 2
      └── Finance User 3

This can be especially useful in large organizations where manually maintaining group membership would be difficult.

Can Groups Contain Other Groups?

Microsoft Entra ID supports certain group nesting scenarios, but the exact behavior and supported combinations depend on the group type and feature being used.

For interview purposes, remember that group nesting is not universally interchangeable across every Microsoft Entra group scenario.

If an interviewer asks about nested groups, be specific about the group type and the resource or application consuming the membership.

Real-World Example

Imagine an organization has:

1,000 employees

and three departments:

IT
Finance
HR

The administrator creates:

IT-Users
Finance-Users
HR-Users

The Finance application can then be assigned to:

Finance-Users

instead of individually assigning 200 Finance employees.

If an employee moves from Finance to IT, the administrator can update the appropriate group membership.

With dynamic groups, membership may even be automatically updated based on defined user attributes.

This demonstrates one of the major benefits of groups:

Manage access based on groups rather than individual users wherever appropriate.

Group-Based Access vs Individual Access

Consider an organization with 5,000 employees.

Individual approach

Application
 ├── User 1
 ├── User 2
 ├── User 3
 ├── ...
 └── User 5000

This can become difficult to manage.

Group-based approach

Application
       │
       ▼
Department Group
       │
       ▼
     Users

This makes administration more scalable and can make access reviews and changes easier.

However, administrators should still follow least privilege and avoid giving groups broader access than necessary.

⚠️ Common Interview Mistakes

Mistake 1:

“A group is only used to organize users.”

❌ Too limited.

Groups can also be used for access management, application assignment, licensing, Conditional Access targeting, and other scenarios.

Mistake 2:

“Security groups and Microsoft 365 groups are exactly the same.”

❌ Incorrect.

They have different primary purposes and capabilities.

Mistake 3:

“Dynamic groups are manually maintained.”

❌ Incorrect.

Dynamic membership is evaluated automatically based on configured membership rules.

Mistake 4:

“Giving a group access means every user automatically has unrestricted access to everything.”

❌ Incorrect.

Access depends on what permission or assignment was given to the group and what other policies apply.

🎯 Interview Tip

If asked:

“What is a Microsoft Entra ID group?”

A strong answer would be:

“A Microsoft Entra ID group is a collection of users or other supported directory objects that can be managed together. Groups are commonly used to simplify access management, application assignment, licensing, and policy targeting. Microsoft Entra supports security groups and Microsoft 365 groups, and group membership can be assigned directly or managed dynamically using rules.”

If asked:

“What is the advantage of using groups?”

Answer:

“Groups make access management more scalable. Instead of assigning access individually to many users, administrators can manage access through group membership and then control membership centrally.”

🔗 Related Interview Questions

Q15. What is a Microsoft Entra ID User?
Q28. What are the main components of Conditional Access?
Q29. What is a Conditional Access policy?
Q30. What is Report-only mode?
Q84. How would you troubleshoot a synchronization problem?
Q129. What is the Principle of Least Privilege?

Quick Revision

Group = Collection of identities managed together

Remember:

Security Group → Primarily access management

Microsoft 365 Group → Primarily collaboration

Assigned Membership → Administrator manages membership

Dynamic Membership → Rules determine membership

The key benefit is:

Manage access through groups instead of managing every user individually.

Q17. What is an Object ID in Microsoft Entra ID?

Interview-ready answer

An Object ID is a unique identifier assigned to a directory object within a Microsoft Entra tenant.

A directory object can be a:

User
Group
Application-related object
Service principal
Device
Other supported directory object

The Object ID is typically represented as a GUID.

For example:

8f7c1234-56ab-4d89-9012-abcdef123456

The Object ID allows Microsoft Entra ID and applications to uniquely identify a particular object.

Simple Example

Suppose an organization has a user:

Name: John Smith

UPN: john@contoso.com

Tenant ID:

11111111-2222-3333-4444-555555555555

Object ID:

aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee

The two IDs identify different things:

Microsoft Entra Environment
          │
          │
      Tenant ID
          │
          ▼
    Identifies the tenant
          │
          │
          ▼
       User: John
          │
          ▼
       Object ID
          │
          ▼
    Identifies John's
      directory object

So:

Tenant ID identifies the tenant.

Object ID identifies a specific object inside that tenant.

Why is Object ID important?

Administrators and developers may use Object IDs when working with:

Microsoft Entra users
Groups
Applications
Service principals
Devices
Microsoft Graph
Azure CLI
PowerShell
Automation
Access-control configurations

An Object ID is useful because names and other properties can change, while the unique identifier provides an unambiguous way to reference the object.

For example, two users might have similar display names:

John Smith
John Smith

Their Object IDs will still be different.

Object ID vs User Principal Name (UPN)

These are not the same thing.

UPN

Example:

john@contoso.com

The UPN is a user sign-in name.

Object ID

Example:

aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee

The Object ID is the unique identifier of the directory object.

UPN	Object ID
Human-readable identity/sign-in name	Unique object identifier
Can potentially be changed	Used as a stable unique identifier for the object
Example: `john@contoso.com`	Example: GUID

Object ID vs Tenant ID

This is another common interview question.

Tenant ID	Object ID
Identifies the Microsoft Entra tenant	Identifies a specific directory object
One per tenant	Each directory object has its own identifier
Identifies the identity environment	Identifies an object within that environment
Example: GUID	Example: GUID

Think of it as:

Tenant ID → Which organization/environment?

Object ID → Which object?

Real-World Example

Suppose you are creating an automation script that needs to modify a specific user.

Using only:

John Smith

would not necessarily be sufficient because display names are not guaranteed to be unique.

The script can instead reference the user’s Object ID.

This gives the automation an unambiguous identifier for the directory object.

Similarly, administrators and developers may encounter Object IDs when working with Microsoft Graph and other Microsoft cloud APIs.

⚠️ Common Interview Mistakes

Mistake 1:

“Object ID is the user’s username.”

❌ Incorrect.

The UPN is commonly used as a sign-in name; the Object ID uniquely identifies the directory object.

Mistake 2:

“Every user in different tenants has the same Object ID.”

❌ Incorrect.

Object IDs are unique identifiers for objects within their respective directory/tenant contexts.

Mistake 3:

“Tenant ID and Object ID identify the same thing.”

❌ Incorrect.

Tenant ID → Tenant

Object ID → Directory object

🎯 Interview Tip

If asked:

“What is an Object ID in Microsoft Entra ID?”

A strong answer would be:

“An Object ID is a unique identifier assigned to a directory object in Microsoft Entra ID, such as a user, group, device, or service principal. It is typically represented as a GUID and is used to uniquely reference that object in administrative, API, and automation scenarios.”

If asked:

“What is the difference between Object ID and Tenant ID?”

Answer:

“Tenant ID identifies the Microsoft Entra tenant, while Object ID identifies a specific directory object within the tenant.”

🔗 Related Interview Questions

Q9. What is a Tenant ID?
Q10. What is a Directory ID?
Q15. What is a Microsoft Entra ID User?
Q16. What is a Microsoft Entra ID Group?
Q18. What are Directory Objects in Microsoft Entra ID?
Q108. What is a Client ID?

Quick Revision

Tenant ID → Identifies the tenant

Object ID → Identifies a directory object

UPN → Commonly used as a user’s sign-in name

The easiest way to remember:

Tenant = Environment

Object = Identity/resource inside the environment

Q18. What are Directory Objects in Microsoft Entra ID?

Interview-ready answer

Directory objects are the identities and resources that are represented and managed within a Microsoft Entra directory.

They are the individual objects that make up an organization’s identity environment.

Common examples include:

👤 Users
👥 Groups
📱 Devices
📦 Applications
⚙️ Service principals
🏢 Organizational objects and other supported identity resources

Each directory object has properties that Microsoft Entra ID uses to identify and manage it.

Many objects also have a unique Object ID.

Simple Example

Imagine that Contoso Corporation has a Microsoft Entra tenant.

Its directory might contain:

           Contoso
               │
               ▼
      Microsoft Entra Directory
               │
     ┌─────────┼──────────┐
     ▼         ▼          ▼
   Users     Groups     Devices
     │         │
     ▼         ▼
  John       IT-Admins

               │
               ▼
          Applications
               │
               ▼
        Service Principals

Each of these represents a directory object managed within the organization’s Microsoft Entra environment.

Common Types of Directory Objects

1. User Objects

A user object represents a person or supported user identity.

Example:

john@contoso.com

A user object can have properties such as:

Display name
UPN
Object ID
Account status
Group memberships
Assigned licenses
Authentication-related configuration

2. Group Objects

A group object represents a collection of users or other supported objects.

Examples:

IT-Admins

Finance-Users

HR-Employees

Groups can be used for access management, application assignment, licensing, and other scenarios.

3. Device Objects

A device object represents a device identity in Microsoft Entra ID.

For example:

John's Laptop
       │
       ▼
Microsoft Entra Device
       │
       ├── Device Identity
       ├── Device Information
       └── Device State

Device identity can be used as part of authentication and access-control scenarios.

4. Application Objects

Applications can be represented in Microsoft Entra ID so that they can participate in authentication and authorization.

For example, an organization might register a custom web application with Microsoft Entra ID.

The application registration represents the application’s identity configuration in the directory.

Application registrations and their relationship with service principals are covered in much greater detail later in this guide.

5. Service Principal Objects

A service principal represents an application’s or workload’s identity within a particular Microsoft Entra tenant.

It allows an application or service to authenticate and operate according to the permissions assigned to it.

For example:

Application
     │
     ▼
Service Principal
     │
     ▼
Microsoft Entra Tenant
     │
     ▼
Assigned Permissions

This is an important concept for application authentication and automation.

Do all Directory Objects have an Object ID?

Most Microsoft Entra directory resources that are represented as directory objects have a unique identifier that can be used to identify them.

For common interview examples, remember:

User → Object ID

Group → Object ID

Device → Object ID

Service Principal → Object ID

The exact identifier properties available depend on the specific object type.

Why are Directory Objects Important?

Directory objects provide the identities and resources that Microsoft Entra ID manages.

For example, an administrator might:

Create a user
Add a user to a group
Register an application
Manage a device
Assign permissions to an application identity
Assign licenses through groups
Apply access policies to users and groups

All of these operations involve objects represented within the Microsoft Entra environment.

Directory Objects vs Azure Resources

This distinction can be useful in Azure interviews.

A directory object belongs to the identity/directory side of the Microsoft cloud environment.

An Azure resource is a resource deployed in Azure, such as:

Virtual machine
Storage account
Virtual network
Azure SQL database

For example:

Microsoft Entra ID
       │
       ├── User
       ├── Group
       ├── Device
       └── Service Principal
              │
              │ Authorization
              ▼
       Azure Subscription
              │
              └── Azure Resources
                    ├── VM
                    ├── Storage
                    └── Network

This distinction becomes particularly important when discussing Azure RBAC.

A user or service principal can be represented in Microsoft Entra ID and then receive permissions to Azure resources through Azure RBAC.

Real-World Example

Suppose Contoso has:

5,000 users

300 groups

3,500 devices

100 enterprise applications

Hundreds of service principals

These are represented through identity-related objects in the organization’s Microsoft Entra environment.

An administrator can manage these objects and use them as part of the organization’s identity and access strategy.

For example:

A user belongs to a group → the group is assigned access to an application → Microsoft Entra ID helps authenticate the user → the application authorizes the user’s access.

This shows how different directory objects can work together.

⚠️ Common Interview Mistakes

Mistake 1:

“A directory object is only a user.”

❌ Incorrect.

Users are just one type of directory object.

Mistake 2:

“An Azure VM is a Microsoft Entra directory object.”

❌ Not in the same sense as a user, group, or service principal.

An Azure VM is primarily an Azure resource, although it can have an associated identity/device representation depending on its configuration.

Mistake 3:

“Every object has the same properties.”

❌ Incorrect.

Different object types have different properties and capabilities.

Mistake 4:

“Object ID and Tenant ID are the same.”

❌ Incorrect.

Tenant ID → identifies the tenant

Object ID → identifies a particular directory object

🎯 Interview Tip

If asked:

“What are directory objects in Microsoft Entra ID?”

A strong answer is:

“Directory objects are identities and resources represented and managed within a Microsoft Entra directory. Common examples include users, groups, devices, applications, and service principals. These objects have properties used by Microsoft Entra ID for identity and access management, and commonly have unique object identifiers.”

If the interviewer asks:

“Give me some examples.”

A quick answer is:

“Users, groups, devices, applications, and service principals.”

🔗 Related Interview Questions

Q15. What is a Microsoft Entra ID User?
Q16. What is a Microsoft Entra ID Group?
Q17. What is an Object ID?
Q19. What is the difference between a Microsoft Entra Tenant and an Azure Subscription?
Q101. What is an App Registration?
Q104. What is a Service Principal?
Q121. What is Azure RBAC?

Quick Revision

Directory Objects = Identities/resources represented in the Microsoft Entra directory

Remember the common examples:

User + Group + Device + Application + Service Principal

Q19. What is the Difference Between a Microsoft Entra Tenant and an Azure Subscription?

Interview-ready answer

A Microsoft Entra tenant and an Azure subscription are two different boundaries within the Microsoft cloud.

The simplest way to remember the difference is:

Microsoft Entra Tenant → Identity boundary

Azure Subscription → Azure resource and billing boundary

A Microsoft Entra tenant primarily manages identities and directory objects, while an Azure subscription is used to organize and manage Azure resources, billing, quotas, and access to those resources.

Simple Example

Imagine Contoso Corporation has a Microsoft Entra tenant and several Azure subscriptions.

                 Contoso Corporation
                         │
                         ▼
              Microsoft Entra Tenant
                         │
             ┌───────────┼───────────┐
             ▼           ▼           ▼
           Users       Groups    Applications
                         │
                         │
                         ▼
                Azure Subscriptions
             ┌──────────┼──────────┐
             ▼          ▼          ▼
        Production   Development   Testing
        Subscription Subscription  Subscription
             │          │           │
             ▼          ▼           ▼
           VMs        VMs         VMs
         Storage     Storage     Storage
        Networks     Networks    Networks

The tenant manages the organization’s identity environment.

The subscriptions contain and organize the organization’s Azure resources.

What is a Microsoft Entra Tenant?

A Microsoft Entra tenant is a dedicated instance of Microsoft Entra ID for an organization.

It contains identity-related objects such as:

Users
Groups
Devices
Applications
Service principals
Domains
Directory roles

It provides the organization’s cloud identity and access management environment.

For example:

contoso.com users and groups can exist in Contoso’s Microsoft Entra tenant.

The tenant has a unique Tenant ID.

What is an Azure Subscription?

An Azure subscription is a logical boundary used for managing Azure resources and associated billing.

An Azure subscription can contain resources such as:

Virtual machines
Storage accounts
Virtual networks
Azure SQL databases
App Services
Key Vaults
Other Azure services

A subscription has its own unique Subscription ID.

For example:

Production Subscription
        │
        ├── Virtual Machines
        ├── Storage Accounts
        ├── Virtual Networks
        └── Azure SQL

Key Differences

Microsoft Entra Tenant	Azure Subscription
Identity and directory boundary	Azure resource management boundary
Contains users, groups, devices, applications, etc.	Contains Azure resources
Has a Tenant ID	Has a Subscription ID
Manages cloud identities	Manages Azure resources and billing
Provides identity and access capabilities	Provides resource deployment and management
Can be associated with multiple subscriptions	Is associated with a Microsoft Entra tenant for identity

Can a Tenant Have Multiple Subscriptions?

Yes.

This is one of the most important relationships to understand.

An organization can have:

Microsoft Entra Tenant
        │
        ├── Production Subscription
        │
        ├── Development Subscription
        │
        ├── Testing Subscription
        │
        └── Security Subscription

All of these subscriptions can use identities from the same Microsoft Entra tenant for authentication and authorization.

This allows an organization to separate Azure resources while maintaining a centralized identity environment.

Why Would an Organization Use Multiple Subscriptions?

There are many reasons.

1. Environment Separation

An organization might separate:

Production
Development
Testing

into different subscriptions.

This can help with management, governance, access control, and billing.

2. Billing Separation

Different subscriptions can help organizations separate costs between:

Departments
Projects
Business units
Environments
Customers

3. Access and Governance

Subscriptions provide an important management boundary for Azure resources.

For example:

The Development team may receive access to the Development subscription but not the Production subscription.

Azure RBAC can then be used to control access to resources within the appropriate scope.

4. Resource Limits and Management

Subscriptions also provide boundaries for Azure service limits, quotas, and resource organization.

The exact limits depend on the Azure service and current Microsoft limits.

Can a User in the Tenant Access Every Subscription?

No.

Simply having a user account in a Microsoft Entra tenant does not automatically give the user access to every Azure subscription associated with that tenant.

The user must have appropriate permissions.

For example:

John
 │
 ▼
Microsoft Entra User
 │
 ├── Subscription A
 │       └── Reader
 │
 └── Subscription B
         └── No Access

John may therefore be able to view resources in Subscription A while having no access to Subscription B.

This is an important concept when discussing Azure RBAC.

What is the Relationship Between Tenant and Subscription?

A useful way to visualize it is:

              Microsoft Entra Tenant
                       │
             Identity / Authentication
                       │
          ┌────────────┼────────────┐
          ▼            ▼            ▼
    Subscription A  Subscription B  Subscription C
          │            │            │
          ▼            ▼            ▼
       Azure         Azure         Azure
      Resources      Resources     Resources

The tenant provides the identity foundation.

The subscriptions provide the Azure resource-management boundaries.

Users from the tenant can be granted access to resources in subscriptions through appropriate roles and permissions.

Tenant ID vs Subscription ID

This is another common interview question.

Tenant ID

Identifies the Microsoft Entra tenant.

Example:

11111111-2222-3333-4444-555555555555

Subscription ID

Identifies an Azure subscription.

Example:

aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee

Both are usually represented as GUIDs, but they identify completely different things.

Tenant ID → Which identity environment?

Subscription ID → Which Azure resource/billing boundary?

Real-World Example

Imagine you work as an Azure Administrator for Contoso.

Your organization has:

Microsoft Entra Tenant

contoso.onmicrosoft.com

and three Azure subscriptions:

Contoso Microsoft Entra Tenant
              │
       ┌──────┼──────┐
       ▼      ▼      ▼
      PROD   DEV    TEST
       │      │      │
       ▼      ▼      ▼
      VMs    VMs    VMs
      SQL    SQL    SQL

You may have a user account:

admin@contoso.com

That account exists in the Microsoft Entra tenant.

Your administrator account might have:

Owner → Production subscription

Contributor → Development subscription

Reader → Testing subscription

This demonstrates that identity and resource permissions are separate concepts.

An Important Azure Concept: Management Groups

In larger organizations, you may also encounter Azure Management Groups.

Management Groups provide a higher-level organizational layer for Azure subscriptions.

A simplified hierarchy can look like:

        Microsoft Entra Tenant
                │
                ▼
        Management Groups
                │
        ┌───────┴────────┐
        ▼                ▼
   Production         Non-Production
        │                │
        ▼                ▼
  Subscriptions      Subscriptions
        │                │
        ▼                ▼
   Azure Resources   Azure Resources

Management Groups are an Azure governance concept and should not be confused with Microsoft Entra security groups.

We’ll cover Azure RBAC and governance concepts separately later.

⚠️ Common Interview Mistakes

Mistake 1:

“Tenant and subscription are the same.”

❌ Incorrect.

They have different purposes.

Mistake 2:

“Every user in the tenant automatically gets access to Azure.”

❌ Incorrect.

Users need appropriate permissions.

Mistake 3:

“A subscription can contain users and groups.”

Be careful with this statement.

Users and groups are managed in Microsoft Entra ID. Azure subscriptions use those identities when assigning access to Azure resources.

Mistake 4:

“One tenant can have only one subscription.”

❌ Incorrect.

A Microsoft Entra tenant can be associated with multiple Azure subscriptions.

🎯 Interview Tip

If asked:

“What is the difference between a Microsoft Entra tenant and an Azure subscription?”

A strong answer is:

“A Microsoft Entra tenant is primarily an identity and directory boundary that manages identities such as users, groups, applications, and devices. An Azure subscription is primarily a boundary for Azure resource management, billing, quotas, and access control. A single Microsoft Entra tenant can be associated with multiple Azure subscriptions.”

If the interviewer asks:

“Does creating a subscription create a new tenant?”

Answer:

“Not necessarily. An Azure subscription is associated with a Microsoft Entra tenant, and organizations can have multiple subscriptions associated with the same tenant.”

🔗 Related Interview Questions

Q6. What is a Microsoft Entra ID Tenant?
Q9. What is a Tenant ID?
Q20. Can one Microsoft Entra Tenant have multiple Azure Subscriptions?
Q121. What is Azure RBAC?
Q122. What is Microsoft Entra role-based access control?
Q130. Why shouldn’t everyone be given Global Administrator?

Quick Revision

Remember the three boundaries:

Tenant → Identity

Subscription → Azure resources + billing

Management Group → Organizes subscriptions for governance

The most important interview statement:

One Microsoft Entra tenant can be associated with multiple Azure subscriptions, and users do not automatically have access to every subscription simply because they exist in the tenant.

Q20. Can One Microsoft Entra Tenant Have Multiple Azure Subscriptions?

Interview-ready answer

Yes. A single Microsoft Entra tenant can be associated with multiple Azure subscriptions.

This is a very common architecture in organizations that need to separate Azure resources for different environments, departments, projects, business units, or billing requirements.

Simple example

Suppose Contoso Corporation has one Microsoft Entra tenant:

          Contoso Microsoft Entra Tenant
                       │
          ┌────────────┼────────────┐
          ▼            ▼            ▼
     Production    Development    Testing
     Subscription  Subscription   Subscription
          │            │             │
          ▼            ▼             ▼
        Azure         Azure         Azure
       Resources     Resources     Resources

The same Microsoft Entra tenant provides the identity environment used to authenticate users and other identities, while the subscriptions provide separate Azure resource-management boundaries.

Why would an organization use multiple subscriptions?

There are several common reasons.

1. Separate environments

An organization may maintain separate subscriptions for:

Production
Development
Testing
Disaster recovery

This helps isolate resources and apply different management and governance requirements.

2. Separate departments or business units

For example:

Microsoft Entra Tenant
        │
        ├── Finance Subscription
        ├── HR Subscription
        ├── IT Subscription
        └── Marketing Subscription

Different teams can then receive appropriate access to their respective subscriptions.

3. Separate billing

Organizations may use different subscriptions to track costs for:

Projects
Departments
Customers
Business units
Environments

This can make cost management and reporting easier.

4. Different access requirements

Different subscriptions can have different administrators and RBAC assignments.

For example:

                  Entra Tenant
                       │
          ┌────────────┴────────────┐
          ▼                         ▼
     Production                  Development
     Subscription                Subscription
          │                         │
          ▼                         ▼
    Admin Team A              Developer Team

A developer might have Contributor access to the Development subscription but no access to Production.

Does every user in the tenant get access to every subscription?

No.

This is a very important point.

A user existing in the Microsoft Entra tenant does not automatically receive permissions to every Azure subscription associated with that tenant.

Access must be granted through appropriate roles and permissions.

For example:

John
 │
 ▼
Microsoft Entra User
 │
 ├── Production → Reader
 │
 ├── Development → Contributor
 │
 └── Testing → No Access

This allows organizations to follow the principle of least privilege.

Can different subscriptions use the same Microsoft Entra users?

Yes.

The same user identity can be assigned different roles in different subscriptions.

For example:

john@contoso.com

could have:

Reader → Production
Contributor → Development
No access → Testing

The user’s identity remains in the same Microsoft Entra tenant, while the user’s permissions can vary at the subscription or resource scope.

Can a Subscription be associated with another Tenant?

A subscription is associated with a Microsoft Entra tenant for identity and access management, and the subscription’s directory association can be changed under supported scenarios.

However, changing a subscription’s directory association is an administrative operation with important implications and prerequisites.

For interview purposes, the key point to remember is:

A subscription has an associated Microsoft Entra tenant, and Azure RBAC uses identities from that tenant to control access to resources.

⚠️ Common Interview Mistakes

Mistake 1:

“One tenant can have only one Azure subscription.”

❌ Incorrect.

A tenant can be associated with multiple subscriptions.

Mistake 2:

“If a user exists in the tenant, they can access all subscriptions.”

❌ Incorrect.

They need appropriate permissions.

Mistake 3:

“Each subscription requires its own Microsoft Entra tenant.”

❌ Incorrect.

Multiple subscriptions can use the same Microsoft Entra tenant.

🎯 Interview Tip

If asked:

“Can one Microsoft Entra tenant have multiple Azure subscriptions?”

A strong answer is:

“Yes. A single Microsoft Entra tenant can be associated with multiple Azure subscriptions. Organizations commonly use multiple subscriptions to separate production and development environments, departments, projects, billing, governance, and access requirements. Users from the tenant can be assigned different Azure RBAC permissions in each subscription.”

🔗 Related Interview Questions

Q6. What is a Microsoft Entra ID Tenant?
Q19. What is the difference between a Microsoft Entra Tenant and an Azure Subscription?
Q121. What is Azure RBAC?
Q129. What is the Principle of Least Privilege?
Q130. Why shouldn’t everyone be given Global Administrator?

Quick Revision

One Microsoft Entra tenant → Multiple Azure subscriptions

And remember:

Being a user in the tenant does not automatically grant access to every subscription.

Access is assigned through appropriate roles and permissions.