Azure AD vs Microsoft Entra ID: What Changed

In mid-2023, Microsoft announced a significant rebranding initiative, renaming Azure Active Directory (Azure AD) to Microsoft Entra ID. This change, while…

In mid-2023, Microsoft announced a significant rebranding initiative, renaming Azure Active Directory (Azure AD) to Microsoft Entra ID. This change, while primarily a nomenclature update for the core identity service, also served to consolidate a broader family of identity and access management (IAM) products under the Microsoft Entra portfolio. Understanding the scope of this rebranding, what truly changed under the hood, and how it impacts existing deployments and future strategies is crucial for IT professionals managing Microsoft-centric environments.

This article details the transition from Azure AD to Microsoft Entra ID, clarifies the architectural implications, and outlines the expanded capabilities now offered within the unified Microsoft Entra family.

The Renaming: Azure AD to Microsoft Entra ID

The most immediate and obvious change is the name itself. Azure Active Directory is now officially called Microsoft Entra ID. This rebranding affects all public-facing aspects of the service:

  • Product Name: All documentation, marketing materials, and UI elements now refer to "Microsoft Entra ID."
  • Documentation URLs: The primary documentation portal for identity services has shifted from docs.microsoft.com/azure/active-directory to learn.microsoft.com/entra/identity. It's imperative to update bookmarks and internal runbook references to reflect these new paths.
  • Azure Portal Labels: Within the Azure portal, the "Azure Active Directory" blade has been renamed to "Microsoft Entra ID." All associated menu items and configuration screens now use the new terminology.

Despite the name change, the underlying service architecture, APIs, and PowerShell cmdlets for the core identity platform remain unchanged for backward compatibility. This means existing applications, scripts, and integrations built against Azure AD continue to function without modification.

# Example: Azure AD PowerShell module (still works, although cmdlets may use AAD prefix)
Install-Module -Name AzureAD
Connect-AzureAD -TenantId "yourtenant.onmicrosoft.com"

# Example: Microsoft Graph API endpoint (unchanged)
GET https://graph.microsoft.com/v1.0/users/{id | userPrincipalName}
Authorization: Bearer <access_token>

Microsoft's commitment to maintaining API stability is critical for enterprises with extensive existing deployments and custom integrations.

The Broader Microsoft Entra Product Family

The renaming of Azure AD is part of a larger strategy to unify all of Microsoft's identity and access management solutions under the single "Microsoft Entra" brand. This family now encompasses several distinct products, providing a more cohesive identity security posture.

Microsoft Entra ID (formerly Azure AD)

This remains the core identity service, providing single sign-on (SSO), multifactor authentication (MFA), conditional access, device management, and hybrid identity capabilities for Microsoft 365, Azure, and thousands of SaaS applications. Its SKUs (Free, P1, P2) and their included features are unchanged:

  • Free: Cloud user & group management, single sign-on for up to 10 apps per user, basic security reports.
  • P1: Hybrid identity capabilities (Azure AD Connect), Conditional Access, advanced group management, passwordless authentication, advanced usage reports.
  • P2: All P1 features plus Azure AD Identity Protection (risk-based Conditional Access, vulnerability detection), Azure AD Privileged Identity Management (PIM) for just-in-time access, Entitlement Management.

Microsoft Entra Permissions Management (formerly CloudKnox)

This is a Cloud Infrastructure Entitlement Management (CIEM) solution acquired by Microsoft. It provides granular visibility, remediation, and monitoring of permissions across multi-cloud environments (Azure, AWS, GCP). It helps organizations enforce the principle of least privilege by identifying and right-sizing excessive permissions given to identities (both human and workload).

Key features include:

  • Discovery of all permissions granted across IaaS platforms.
  • Analysis of permissions usage (e.g., "Permissions Creep Index").
  • Automated remediation to reduce over-privileged identities.
  • Continuous monitoring for policy violations.

Microsoft Entra Verified ID (formerly Decentralized Identity)

This service enables organizations to issue and verify tamper-proof digital credentials based on open standards (Decentralized Identifiers and Verifiable Credentials). This allows individuals to own and control their digital identity, sharing specific verified attributes with relying parties without over-sharing personal information.

Use cases include:

  • Streamlining onboarding processes for new employees or contractors.
  • Securely verifying educational qualifications or professional certifications.
  • Enhancing secure access for B2B or B2C scenarios.

Microsoft Entra Workload Identities

While workload identities themselves existed within Azure AD (service principals, managed identities), Microsoft Entra Workload Identities is a specific product offering focused on securing and governing these non-human identities. It provides advanced capabilities beyond basic service principal management, specifically for detecting and remediating risks associated with service principals and managed identities.

Features include:

  • Risk detection for workload identities (e.g., credential leaks, anomalous behavior).
  • Conditional Access for workload identities (preview feature as of late 2023).
  • Auditing and reporting specific to workload identity usage and security.

Microsoft Entra Internet Access & Microsoft Entra Private Access (Global Secure Access)

These two components form Microsoft's Security Service Edge (SSE) solution, positioned to compete with offerings like Zscaler or Palo Alto Prisma Access. This is a significant expansion of Microsoft's security portfolio.

  • Microsoft Entra Internet Access: Secures user access to the internet, SaaS apps, and Microsoft 365 services by routing traffic through Microsoft's global network, providing advanced threat protection, content filtering, and compliance.
  • Microsoft Entra Private Access: Provides secure, zero-trust access to private applications and resources (on-premises or in any cloud) without requiring a VPN, using per-app access based on user and device context.

These services leverage Microsoft's vast global network presence and integrate deeply with Microsoft Entra ID for identity-driven access policies. They are currently in public preview or early general availability, requiring specific configuration and potentially new client software (Global Secure Access client).

Impact on Existing Implementations and Future Planning

For organizations already using Azure AD, the immediate impact of the renaming to Microsoft Entra ID is minimal on day-to-day operations. The core identity service functions identically, and no migration of tenants or data is required. However, there are strategic considerations:

  • Documentation & Training: Update all internal documentation, training materials, and support guides to reflect the new nomenclature and URL structures. This ensures consistency and avoids confusion.
  • Integration Points: Verify that any custom scripts, automation, or third-party integrations that reference "Azure AD" in their display names or descriptive text are updated for clarity. The underlying API calls remain stable.
  • Expanded Capabilities: Evaluate the new Entra family services (Permissions Management, Verified ID, Workload Identities, Global Secure Access). These services address critical security and compliance challenges and offer opportunities to consolidate vendors or enhance security posture within the Microsoft ecosystem. For instance, moving from a third-party CIEM to Entra Permissions Management could streamline management and reporting.
  • Budgeting & Licensing: Understand the licensing models for the new Entra products. While Microsoft Entra ID (P1/P2) licensing is well-established, services like Entra Permissions Management and Entra Workload Identities have separate licensing requirements, often based on the number of monitored resources or identities.

Common Pitfalls and Troubleshooting

  • Confusing Renaming with Feature Removal: Azure AD's core features are all present in Microsoft Entra ID. No existing functionality has been removed due only to the rebranding.
  • Outdated Bookmarks: Users or administrators might encounter "page not found" errors if they rely on old docs.microsoft.com/azure/active-directory URLs. Redirect them to learn.microsoft.com/entra.
  • Searching for "Azure AD" in New Portals: While the old name still works in search bars within the Azure portal, encourage the use of "Microsoft Entra ID" or "Entra" for future-proofing and consistency.
  • Expecting Automatic Feature Upgrades: The new Entra family services are separate products. While they integrate with Entra ID, they require explicit activation, configuration, and often separate licensing. For example, Permissions Management is not automatically included with an Entra ID P2 license.
  • Assuming API Changes: Stress that Graph API endpoints (e.g., graph.microsoft.com) and PowerShell module cmdlets generally remain stable, typically using AzureAD prefixes for the core service. Avoid unnecessary refactoring of working code.

Back to the knowledge base · Ask the AI assistant