Microsoft Entra ID Concepts
The Entra ID vocabulary SC-300 and SC-900 test, from tenant objects to Conditional Access controls and governance features. SC-900 candidates need the first three tables; SC-300 needs all seven.
Identity fundamentals
| Term | What it means |
|---|---|
| Authentication | Proving who you are |
| Authorization | Deciding what you are allowed to do once you are authenticated |
| Identity provider | The service that verifies an identity and issues the token |
| Single sign-on | Authenticate once, then reach many applications without signing in again |
| Federation | A trust between identity providers in different domains so one accepts the other's tokens |
| Zero Trust principles | Verify explicitly, use least privilege access, assume breach |
| Tenant | One organization's dedicated instance of Entra ID |
| Directory objects | Users, groups, devices, applications and service principals |
| Service principal | The identity an application uses inside a specific tenant |
| Managed identity | A service principal that Azure creates and rotates, so no credential is stored in code |
| System vs user assigned | System assigned lives and dies with one resource; user assigned is shared across resources |
Users, groups and devices
| Object | What it means |
|---|---|
| Member user | An account that belongs to the tenant, created in the cloud or synced from on-premises |
| Guest user | An external identity invited through B2B collaboration; userType is Guest |
| Cloud-only identity | Exists only in Entra ID, with no on-premises counterpart |
| Hybrid identity | Synced from Active Directory Domain Services by Entra Connect Sync or Cloud Sync |
| Password hash sync | A hash of the on-premises password hash is synced so Entra ID authenticates the user |
| Pass-through authentication | An agent validates the password against the on-premises domain controller |
| Security group | Grants access to resources and applications |
| Microsoft 365 group | Collaboration group that also creates a mailbox, a SharePoint site and Teams membership |
| Assigned membership | Members are added and removed by hand |
| Dynamic membership | Membership is a rule evaluated against user or device attributes |
| Administrative unit | Restricts an admin role assignment to a subset of users, groups or devices |
| Entra registered device | Personal device signed in with a work account, common for bring your own device |
| Entra joined device | Joined to Entra ID only, with no on-premises domain join |
| Hybrid joined device | Joined to both on-premises Active Directory and Entra ID |
Authentication methods
| Method | What to know |
|---|---|
| Password | Something you know; the weakest factor on its own |
| SMS or voice call | Something you have, but exposed to SIM swapping and interception |
| Authenticator push notification | Number matching makes the user type digits from the sign-in screen, so blind approval fails |
| Authenticator one-time code | Time-based code that works without network access on the phone |
| FIDO2 security key | Passwordless and phishing resistant; the key never releases a shared secret |
| Windows Hello for Business | Phishing resistant; biometric or PIN unlocks a key bound to that device |
| Certificate-based authentication | Phishing resistant; the user presents an X.509 certificate |
| Temporary Access Pass | Time-limited passcode for onboarding or recovering a passwordless account |
| Self-service password reset | Users reset their own password after verifying with registered methods |
| Password writeback | Sends a cloud password change back to on-premises Active Directory |
| Password protection | Blocks weak passwords using the global banned list plus your custom list |
| Smart lockout | Locks out repeated failed sign-ins while still recognizing the legitimate user |
Conditional Access building blocks
| Element | Examples |
|---|---|
| Users assignment | Include or exclude users, groups, directory roles, and guest or external users |
| Target resources | Cloud apps, or user actions such as registering security information |
| Network condition | Named locations defined by IP range or by country |
| Device platform condition | Windows, macOS, iOS, Android, Linux |
| Client apps condition | Browser, mobile and desktop clients, and legacy authentication clients |
| Device state filter | Compliant device, hybrid joined device, or a filter on device properties |
| Sign-in risk condition | Risk that this particular sign-in is not the real user (Identity Protection, P2) |
| User risk condition | Risk that the account itself is compromised (Identity Protection, P2) |
| Grant controls | Block, or require MFA, authentication strength, compliant device, approved client app, app protection policy, terms of use |
| Session controls | Sign-in frequency, persistent browser session, app enforced restrictions, Conditional Access App Control |
| Evaluation order | Policies run after the first factor succeeds, and any policy that blocks wins |
| Report-only mode | Logs what the policy would have done without enforcing it |
| Break-glass accounts | Exclude two emergency access accounts so a bad policy cannot lock everyone out |
Application access and SSO
| Concept | What it means |
|---|---|
| App registration | The application object that defines the app, its redirect URIs and its permissions |
| Enterprise application | The service principal, which is the local instance used for sign-in and user assignment |
| SAML SSO | Token-based sign-on for applications that speak SAML 2.0 |
| OpenID Connect | Sign-in layer built on OAuth 2.0, used by modern applications |
| Password-based SSO | Entra ID stores credentials and replays them into the app's sign-in form |
| Application proxy | Publishes an internal web application for remote access without a VPN |
| Delegated permission | The app acts for the signed-in user; effective access is the lesser of the two |
| Application permission | The app acts as itself with no user present, and always needs admin consent |
| User consent | A user approves an app's access to their own data, within the consent policy you set |
| Admin consent | An administrator approves for the whole tenant, required for higher privilege permissions |
| Admin consent workflow | Users request access to an app and a named reviewer approves or denies |
Identity governance
| Feature | What it does |
|---|---|
| Privileged Identity Management | Just-in-time, time-bound and approval-based activation of privileged roles (P2) |
| Eligible assignment | The user holds the role only after they activate it, for a limited window |
| Active assignment | The user holds the role permanently for the life of the assignment |
| Access reviews | Recurring attestation of group membership, app access or role assignments (P2) |
| Entitlement management | Access packages bundle groups, apps and sites behind a request and approval workflow (P2) |
| Lifecycle workflows | Automates joiner, mover and leaver tasks against attribute changes |
| Terms of use | Requires acceptance of a document before access, enforced through Conditional Access |
| Identity Protection | Detects risky users and risky sign-ins and can act on them automatically (P2) |
| Identity Secure Score | Scores your identity configuration against Microsoft's recommendations |
Entra ID admin roles
| Role | What it can do |
|---|---|
| Global Administrator | Everything in Entra ID, including reading and managing every other role; keep the count small |
| Global Reader | Read-only view of everything a Global Administrator can see |
| Privileged Role Administrator | Manage role assignments and Privileged Identity Management settings |
| User Administrator | Create and manage users and groups, and reset passwords within limits |
| Groups Administrator | Create and manage groups and group settings |
| Authentication Administrator | Set or reset authentication methods for non-administrator users |
| Privileged Authentication Administrator | Set or reset authentication methods for any user, including administrators |
| Application Administrator | Manage app registrations and enterprise applications, including their credentials |
| Cloud Application Administrator | The same as Application Administrator, without application proxy |
| Security Administrator | Manage security features and read security signals |
| Security Reader | Read-only access to security features and reports |
| Helpdesk Administrator | Reset passwords for non-administrators and manage service requests |
Ready to test yourself?
Memorizing a table is a start, practice questions make it stick.