Entra ID is the front door to Microsoft 365.
Every Microsoft 365 tenant is also a Microsoft Entra tenant. When an employee signs in to Outlook, joins a Teams meeting, or opens a file in SharePoint, Microsoft Entra ID is the service that checks the password, asks for the second factor, and decides whether the sign-in is allowed. It is the directory of your accounts and the policy engine in front of them.
Until 2023 it was called Azure Active Directory, and plenty of vendors and documents still say Azure AD. Microsoft announced the rename on July 11, 2023 and changed the license names on October 1, 2023; features, terms, and pricing stayed the same.
Most Microsoft 365 compromises are not a software flaw. They are a valid sign-in with a stolen password, followed by quiet mailbox rules and a fraudulent payment request. Microsoft Entra ID is the layer that either stops that sign-in or lets it through.
What it does for a small business.
Strip away the vocabulary and it does five jobs:
- Holds the accounts. Every user, group, and admin role lives here. Onboarding and offboarding are identity operations, which is why a former employee's access lingers when nobody owns this layer.
- Runs the sign-in. Passwords, MFA, and passwordless methods like the Authenticator app or a security key are enforced here — not in Outlook, not on the laptop.
- Applies policy. Rules about where, when, and from which devices people may sign in are evaluated on every request.
- Gates other apps. Single sign-on to your line-of-business, accounting, or payroll software means one identity to protect and one place to revoke it.
- Keeps the record. Sign-in and audit logs record who signed in from where and what an admin changed. After an incident, the investigation starts here.
The settings an owner should insist on.
You do not need to configure any of this yourself, but you need to know it exists so you can ask whether it is done.
1) MFA on every account, enforced by policy
Microsoft's own figure is that MFA plus blocking legacy authentication stops more than 99.9% of common identity attacks. The free way to get there is security defaults: one switch that requires every user to register for MFA, requires it for admins on every sign-in and for other users when Microsoft judges the sign-in risky, blocks the old mail protocols (POP, IMAP, SMTP AUTH) that skip MFA, and blocks device code flow, a sign-in method attackers abuse in phishing. New tenants have it on by default. With P1, the same protections move into Conditional Access, where they can be tuned — including MFA on every sign-in for every user, which security defaults cannot promise.
Separately, Microsoft itself has required MFA for the Azure portal and the Microsoft Entra admin center since October 2024, and for the Microsoft 365 admin center since February 2025.
2) Legacy authentication blocked, with exceptions written down
Legacy protocols do not support MFA, so an attacker with a password can use them to walk around it. Block them tenant-wide. If a copier or a line-of-business app still needs one, the exception should have an owner, a reason, and a retirement date.
3) Admin roles kept small and separate
Microsoft recommends fewer than five Global Administrators per tenant and fewer than ten privileged role assignments in total. Global Administrator can read and change almost everything in Microsoft 365, so it should never be someone's everyday mail account. Insist on separate admin accounts, least-privilege roles for routine tasks, and at least two cloud-only emergency access accounts, never used day to day, protected by a security key rather than a phone, and tested at least every 90 days.
4) Guest access deliberately configured
By default, everyone in a tenant — including existing guests — can invite outside people in, and guests can see the membership of every non-hidden group. Limit invitations to specific admin roles, set guest access to the most restrictive level, allow or block partner domains explicitly, and review the guest list on a schedule. A guest from a project that ended two years ago is still a sign-in path.
5) Sign-in logs retained and actually reviewed
On the free tier, Microsoft Entra ID keeps sign-in and audit logs for seven days. On P1 and P2, 30 days. An upgrade is not retroactive. Either window is short for an investigation, so logs should be exported to longer storage and reviewed weekly for failed sign-ins, unfamiliar countries, and new MFA registrations.
6) One named person who owns the tenant
The most common gap is not a missing setting but a missing owner. Someone — in-house or your IT provider — should be able to say, on the spot, who the Global Administrators are and whether legacy authentication is blocked.
Free, P1, and P2 in plain terms.
Microsoft Entra ID comes in three tiers, priced on Microsoft's Entra pricing page.
- Free is included with every Microsoft 365 subscription. It covers the accounts, the sign-in, MFA, and security defaults — a real baseline, not a trial.
- P1 adds Conditional Access, the rules engine. It is included in Microsoft 365 Business Premium and E3, or sold on its own at $7.00 per user per month on an annual commitment.
- P2 adds Microsoft Entra ID Protection — risk-based policies that react to leaked credentials or anonymous-network sign-ins automatically — and Privileged Identity Management, which grants admin rights just in time instead of permanently. It is included in E5, sold inside the Microsoft Defender Suite add-on for Business Premium, or $10.00 per user per month standalone.
| Capability | Free | P1 | P2 |
|---|---|---|---|
| Standalone price, per user per month (annual) | $0 | $7.00 | $10.00 |
| Included in | Every Microsoft 365 plan | Business Premium, E3 | E5 |
| MFA and security defaults | Yes | Yes | Yes |
| Conditional Access (custom sign-in rules) | No | Yes | Yes |
| Sign-in and audit log retention | 7 days | 30 days | 30 days |
| Risk-based policies (ID Protection) | No | No | Yes |
| Just-in-time admin (Privileged Identity Management) | No | No | Yes |
Conditional Access is why most small businesses end up on P1, usually by way of Business Premium. Policies are if-then statements: if a user tries to reach email, then require MFA; if the sign-in comes from a country you never operate in, then block it; if the device is not company-managed, then deny access to files. For a business with remote staff or regulated data, those three rules are worth the license.
P2 is a harder case at small scale: a 12-person office with a well-run P1 tenant rarely needs risk-based policies or just-in-time admin first. Buy it when a compliance framework, an insurance questionnaire, or an incident makes the case.
What your IT provider should own.
Identity is the first of the seven layers in the Micro-IT security stack, and it is built on Microsoft Entra ID with MFA enforced on every account and phishing-resistant MFA for finance and admin roles. Whoever runs your environment should own this layer the same way — configuration, monitoring, and evidence:
- Security defaults or Conditional Access, in enforced mode, with the policies documented.
- Legacy authentication blocked and every exception listed with an owner.
- Admin roles reviewed quarterly; emergency access accounts tested on the same calendar.
- Guest settings locked down and the guest list reviewed.
- Logs exported beyond the built-in window and reviewed weekly, with a named recipient for alerts.
- Offboarding as a same-day identity action, not a ticket that waits.
What stays with you is the judgment: who is an admin, which outside organizations get guest access, and who gets the call when a sign-in looks wrong. A good provider puts that line in writing.
Three questions to ask this week.
- How many Global Administrators do we have, and are they separate from everyday accounts?
- Is legacy authentication blocked, and what exceptions exist?
- How long are our sign-in logs kept, and who reviews them?
If the answers take more than a day to come back, that is the finding. For a second set of eyes on your tenant, book a 20-minute intro call — we walk through the six settings above and say plainly which ones are done.
Frequently asked questions.
Is Microsoft Entra ID the same thing as Azure Active Directory?
Do we already have Microsoft Entra ID?
Do we need to pay for P1 to enforce MFA?
What should an IT provider own in Microsoft Entra ID, and what stays with the owner?
Related reading.
- Microsoft 365 security settings to turn on first
- What MFA actually buys you
- How to enable MFA for a small business
- Business email compromise: the attack that doesn’t need malware
Your next step
Reading is the easy part — the gap closes when someone owns it. Book a free 20-minute call and we’ll walk through how this applies to your environment, in plain English.