Microsoft Entra ID is one of the most heavily tested topics on the AZ-900 exam, yet it’s also one of the most misunderstood by beginners. If you’ve opened Microsoft Learn and felt overwhelmed by terms like tenant, conditional access, and multi-factor authentication, you’re not alone. This guide breaks Microsoft Entra ID down in plain English so AZ-900 beginners can understand exactly what it does, why Microsoft built it, and how identity, authentication and security questions actually show up on exam day.
What Is Microsoft Entra ID? (Formerly Azure Active Directory)
Microsoft Entra ID is Microsoft’s cloud-based identity and access management service. It was previously called Azure Active Directory (Azure AD), and Microsoft rebranded it in 2023 as part of a wider Microsoft Entra identity product family — so if your study material still says “Azure AD”, know that it’s the same service under a new name. At its core, Microsoft Entra ID answers one simple question for every sign-in attempt: is this really who they say they are, and should they be allowed in? For the AZ-900 exam, you need to understand that Microsoft Entra ID manages users, groups, devices and applications, and controls access to Microsoft 365, Azure resources, and thousands of third-party apps through a single identity.
Why Microsoft Entra ID Matters for the AZ-900 Exam
The AZ-900 exam dedicates a meaningful portion of its “Describe general security and network security features” domain to identity concepts, and Microsoft Entra ID sits at the centre of almost every question in that area. Examiners expect beginners to recognise the difference between identity, authentication and authorisation, understand why identity is called the new security perimeter, and know which Microsoft Entra ID features (MFA, Conditional Access, Identity Protection) solve which problem. Getting comfortable with Microsoft Entra ID early makes the rest of the security domain far easier to learn.
Core Identity Concepts Every AZ-900 Beginner Should Know
Users, Groups and Tenants in Microsoft Entra ID
A Microsoft Entra ID tenant is a dedicated, isolated instance of the service created for one organisation think of it as your company’s own private identity directory in the cloud. Inside a tenant, administrators create user accounts and organise them into groups, which makes it far easier to assign access to applications, licences and Azure resources in bulk rather than one user at a time. Every AZ-900 beginner should remember: one organisation typically equals one Microsoft Entra ID tenant, even if that organisation uses multiple Azure subscriptions.
Identity as the New Security Perimeter
Traditional IT security relied on firewalls protecting an office network but once employees work from anywhere on any device, that perimeter disappears. Microsoft Entra ID represents the shift to identity as the new security perimeter: instead of asking “are you inside our network,” modern security asks “can we verify who you are, on this device, from this location, right now.” This concept appears repeatedly across AZ-900 security questions, so it’s worth memorising the phrase itself.
Authentication vs Authorisation in Microsoft Entra ID
These two terms are commonly confused, and the AZ-900 exam loves testing the difference. Authentication is proving who you are usually with a username and password, a PIN, or a biometric scan. Authorisation happens after authentication and determines what you’re allowed to do once you’re in, such as which files you can open or which Azure resources you can manage. Microsoft Entra ID handles authentication directly, while authorisation in Azure is typically enforced through role-based access control (RBAC).
Multi-Factor Authentication (MFA)
Multi-Factor Authentication adds a second proof of identity on top of a password typically a phone app approval, a text message code, or a biometric check. Microsoft Entra ID Multi-Factor Authentication is one of the most exam-relevant features because it dramatically reduces account takeover risk even if a password is stolen. Expect at least one AZ-900 question asking you to identify MFA as the correct security control for a given scenario.
Single Sign-On (SSO)
Single Sign-On lets a user authenticate once with Microsoft Entra ID and then access multiple applications without logging in again for each one. For AZ-900 beginners, the key point is that SSO improves both security and user experience: fewer passwords to manage means fewer weak or reused passwords, while IT retains centralised control over every connected application.
Security Features Built Into Microsoft Entra ID
- Conditional Access — applies if/then rules, such as requiring MFA when a sign-in comes from an unfamiliar country.
- Identity Protection — uses risk signals to automatically detect and respond to suspicious sign-ins.
- Role-Based Access Control (RBAC) — controls what an authenticated identity is authorised to do in Azure.
- Self-Service Password Reset (SSPR) — lets users securely reset their own password without an IT help-desk call.
- Passwordless authentication — supports Windows Hello, security keys and the Microsoft Authenticator app.
Microsoft Entra ID vs Traditional Active Directory
A common AZ-900 exam trap is confusing Microsoft Entra ID with the on-premises Windows Server Active Directory Domain Services (AD DS) that many beginners have heard about. Traditional Active Directory manages identities within a local network using domain controllers, while Microsoft Entra ID is a cloud-native identity platform accessed over the internet using open standards like OAuth and SAML. Many organisations run both together using Microsoft Entra Connect to synchronise on-premises accounts into the cloud a hybrid identity setup the AZ-900 exam expects you to at least recognise by name.
Real-World Example: How Organisations Use Microsoft Entra ID
Picture a mid-sized company rolling out Microsoft 365 and Azure across its business. IT creates a single Microsoft Entra ID tenant, adds every employee as a user, and groups them by department. Sales staff get access to a CRM app through SSO, finance staff are required to complete MFA before accessing payroll systems, and Conditional Access blocks sign-ins from outside Australia unless a manager approves an exception. This exact pattern is used by organisations training staff through instructor-led AZ-900 classes in Melbourne, Sydney, Brisbane, Perth, Adelaide and Canberra the underlying Microsoft Entra ID concepts don’t change no matter which city the business operates from.
Common AZ-900 Exam Questions About Microsoft Entra ID
Expect scenario-based questions such as: “Which Microsoft Entra ID feature would you use to require a one-time code for risky sign-ins?” (MFA or Conditional Access), or “What is the term for Microsoft Entra ID’s isolated instance of an organisation’s directory?” (a tenant). Other frequent questions test whether you know that Microsoft Entra ID is an identity service, not a network security tool, and that RBAC not Microsoft Entra ID itself controls resource-level permissions inside Azure.
How to Study Microsoft Entra ID for the AZ-900 Exam
Reading alone rarely sticks most successful AZ-900 candidates combine self-study with structured, instructor-led practice. An AZ-900 Certification Training course walks you through Microsoft Entra ID, core Azure services, pricing and governance with hands-on labs rather than just slides, and gives you direct access to trainers who can answer the identity questions self-paced learners usually get stuck on. You can check course details and timings or browse the full FAQ page if you’re still deciding whether AZ-900 is the right starting point for your cloud career.
Instructor-led classes run both online and in person, with local training available for learners based in Melbourne, Sydney, Brisbane and Perth. For more beginner-friendly breakdowns of Azure fundamentals topics like this one, check the AZ-900 blog for regularly updated study guides.
FAQs: Microsoft Entra ID for AZ-900
Is Microsoft Entra ID the same as Azure Active Directory?
Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023; the underlying service and AZ-900 exam concepts are unchanged.
Do I need hands-on Azure experience to understand Microsoft Entra ID for AZ-900?
No. AZ-900 tests conceptual understanding, so knowing what Microsoft Entra ID does and why is more important than configuring it yourself.
What’s the difference between Microsoft Entra ID and RBAC?
Microsoft Entra ID authenticates who you are; role-based access control (RBAC) authorises what that identity can do inside Azure resources.
Is Microsoft Entra ID free?
Microsoft Entra ID has a free tier included with any Azure or Microsoft 365 subscription, with paid tiers (P1/P2) unlocking features like Conditional Access and Identity Protection.
Final Thoughts
Microsoft Entra ID isn’t just an exam topic it’s the identity layer behind almost everything you’ll do in Azure and Microsoft 365 once you’re working in the field. Understanding tenants, authentication, MFA, SSO and Conditional Access now will make every later Azure certification easier to learn. If you’d rather learn it properly with an instructor than piece it together from scattered articles, explore AZ-900 Certification Training or get in touch with the team to find a class time that suits you.
