Microsoft Azure Identity

Azure identity starts with two questions. Who or what is making this request? What may that identity do?

Microsoft Entra ID answers the first question as Azure's cloud identity provider. Azure role-based access control, Microsoft Entra roles, application permissions, and resource-specific controls answer the second. Keeping those questions separate is the foundation of sound access design.

The tenant is the identity boundary

A Microsoft Entra tenant is a dedicated directory instance. It stores users, groups, applications, devices, and other identity objects. Azure subscriptions trust a tenant for their identities.

That relationship matters. A subscription contains Azure resources and billing boundaries. A tenant contains the identities that can receive access. One tenant can support several subscriptions, but a subscription trusts one tenant at a time.

Think of the tenant as the identity control plane. It issues tokens, stores directory objects, and holds identity policies. The subscription and its resource hierarchy provide scopes where Azure permissions apply.

Four kinds of identity

Human identities represent employees, administrators, guests, customers, and partners. They sign in interactively and often need multifactor authentication.

Workload identities represent applications, services, scripts, and containers. They should authenticate without pretending to be a person.