Microsoft Entra ID Concepts
The Entra ID vocabulary SC-300 and SC-900 test, from tenant objects to Conditional Access controls and governance features. SC-900 candidates need the first three tables; SC-300 needs all seven.
Microsoft Entra ID Concepts · firsttry.app/cheatsheets/entra-id-concepts · original reference written from published exam objectives. Not affiliated with any certification body.
Identity fundamentals
| Term | What it means |
|---|---|
| Authentication | Proving who you are |
| Authorization | Deciding what you are allowed to do once you are authenticated |
| Identity provider | The service that verifies an identity and issues the token |
| Single sign-on | Authenticate once, then reach many applications without signing in again |
| Federation | A trust between identity providers in different domains so one accepts the other's tokens |
| Zero Trust principles | Verify explicitly, use least privilege access, assume breach |
| Tenant | One organization's dedicated instance of Entra ID |
| Directory objects | Users, groups, devices, applications and service principals |
| Service principal | The identity an application uses inside a specific tenant |
| Managed identity | A service principal that Azure creates and rotates, so no credential is stored in code |
| System vs user assigned | System assigned lives and dies with one resource; user assigned is shared across resources |
Users, groups and devices
| Object | What it means |
|---|---|
| Member user | An account that belongs to the tenant, created in the cloud or synced from on-premises |
| Guest user | An external identity invited through B2B collaboration; userType is Guest |
| Cloud-only identity | Exists only in Entra ID, with no on-premises counterpart |
| Hybrid identity | Synced from Active Directory Domain Services by Entra Connect Sync or Cloud Sync |
| Password hash sync | A hash of the on-premises password hash is synced so Entra ID authenticates the user |
| Pass-through authentication | An agent validates the password against the on-premises domain controller |
| Security group | Grants access to resources and applications |
| Microsoft 365 group | Collaboration group that also creates a mailbox, a SharePoint site and Teams membership |
| Assigned membership | Members are added and removed by hand |
| Dynamic membership | Membership is a rule evaluated against user or device attributes |
| Administrative unit | Restricts an admin role assignment to a subset of users, groups or devices |
| Entra registered device | Personal device signed in with a work account, common for bring your own device |
| Entra joined device | Joined to Entra ID only, with no on-premises domain join |
| Hybrid joined device | Joined to both on-premises Active Directory and Entra ID |
Authentication methods
| Method | What to know |
|---|---|
| Password | Something you know; the weakest factor on its own |
| SMS or voice call | Something you have, but exposed to SIM swapping and interception |
| Authenticator push notification | Number matching makes the user type digits from the sign-in screen, so blind approval fails |
| Authenticator one-time code | Time-based code that works without network access on the phone |
| FIDO2 security key | Passwordless and phishing resistant; the key never releases a shared secret |
| Windows Hello for Business | Phishing resistant; biometric or PIN unlocks a key bound to that device |
| Certificate-based authentication | Phishing resistant; the user presents an X.509 certificate |
| Temporary Access Pass | Time-limited passcode for onboarding or recovering a passwordless account |
| Self-service password reset | Users reset their own password after verifying with registered methods |
| Password writeback | Sends a cloud password change back to on-premises Active Directory |
| Password protection | Blocks weak passwords using the global banned list plus your custom list |
| Smart lockout | Locks out repeated failed sign-ins while still recognizing the legitimate user |
Conditional Access building blocks
| Element | Examples |
|---|---|
| Users assignment | Include or exclude users, groups, directory roles, and guest or external users |
| Target resources | Cloud apps, or user actions such as registering security information |
| Network condition | Named locations defined by IP range or by country |
| Device platform condition | Windows, macOS, iOS, Android, Linux |
| Client apps condition | Browser, mobile and desktop clients, and legacy authentication clients |
| Device state filter | Compliant device, hybrid joined device, or a filter on device properties |
| Sign-in risk condition | Risk that this particular sign-in is not the real user (Identity Protection, P2) |
| User risk condition | Risk that the account itself is compromised (Identity Protection, P2) |
| Grant controls | Block, or require MFA, authentication strength, compliant device, approved client app, app protection policy, terms of use |
| Session controls | Sign-in frequency, persistent browser session, app enforced restrictions, Conditional Access App Control |
| Evaluation order | Policies run after the first factor succeeds, and any policy that blocks wins |
| Report-only mode | Logs what the policy would have done without enforcing it |
| Break-glass accounts | Exclude two emergency access accounts so a bad policy cannot lock everyone out |
Application access and SSO
| Concept | What it means |
|---|---|
| App registration | The application object that defines the app, its redirect URIs and its permissions |
| Enterprise application | The service principal, which is the local instance used for sign-in and user assignment |
| SAML SSO | Token-based sign-on for applications that speak SAML 2.0 |
| OpenID Connect | Sign-in layer built on OAuth 2.0, used by modern applications |
| Password-based SSO | Entra ID stores credentials and replays them into the app's sign-in form |
| Application proxy | Publishes an internal web application for remote access without a VPN |
| Delegated permission | The app acts for the signed-in user; effective access is the lesser of the two |
| Application permission | The app acts as itself with no user present, and always needs admin consent |
| User consent | A user approves an app's access to their own data, within the consent policy you set |
| Admin consent | An administrator approves for the whole tenant, required for higher privilege permissions |
| Admin consent workflow | Users request access to an app and a named reviewer approves or denies |
Identity governance
| Feature | What it does |
|---|---|
| Privileged Identity Management | Just-in-time, time-bound and approval-based activation of privileged roles (P2) |
| Eligible assignment | The user holds the role only after they activate it, for a limited window |
| Active assignment | The user holds the role permanently for the life of the assignment |
| Access reviews | Recurring attestation of group membership, app access or role assignments (P2) |
| Entitlement management | Access packages bundle groups, apps and sites behind a request and approval workflow (P2) |
| Lifecycle workflows | Automates joiner, mover and leaver tasks against attribute changes |
| Terms of use | Requires acceptance of a document before access, enforced through Conditional Access |
| Identity Protection | Detects risky users and risky sign-ins and can act on them automatically (P2) |
| Identity Secure Score | Scores your identity configuration against Microsoft's recommendations |
Entra ID admin roles
| Role | What it can do |
|---|---|
| Global Administrator | Everything in Entra ID, including reading and managing every other role; keep the count small |
| Global Reader | Read-only view of everything a Global Administrator can see |
| Privileged Role Administrator | Manage role assignments and Privileged Identity Management settings |
| User Administrator | Create and manage users and groups, and reset passwords within limits |
| Groups Administrator | Create and manage groups and group settings |
| Authentication Administrator | Set or reset authentication methods for non-administrator users |
| Privileged Authentication Administrator | Set or reset authentication methods for any user, including administrators |
| Application Administrator | Manage app registrations and enterprise applications, including their credentials |
| Cloud Application Administrator | The same as Application Administrator, without application proxy |
| Security Administrator | Manage security features and read security signals |
| Security Reader | Read-only access to security features and reports |
| Helpdesk Administrator | Reset passwords for non-administrators and manage service requests |
Try it here
Two verified practice questions on this material. Answer one, and see the official page behind the answer.
Plan and automate identity governance
Who should be engaged to confirm that people still need access to a resource?
Describe capabilities of Microsoft Entra
A help desk spends much of each Monday unlocking accounts and resetting forgotten passwords. Which Microsoft Entra feature lets users fix this themselves?
Five free questions on every practice exam. No account, no card.