Microsoft Entra ID and Entra Domain Services
😟 THE PROBLEM
Staff juggle a different password for every app and keep getting locked out.
😊 THE SOLUTION
Use Microsoft Entra ID as one identity for every app.
- Dozens of passwords✓ One identity with single sign-on
- On-premises accounts separate from cloud✓ Sync with Entra Connect
- Legacy app needs a domain✓ Entra Domain Services
Quick answer
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. It signs users in to Azure, Microsoft 365 and thousands of other apps, and provides single sign-on, MFA, app and device management. Microsoft Entra Domain Services provides managed domain services, such as domain join, Group Policy, LDAP and Kerberos, for legacy apps without you running domain controllers.
Exam objective: 2.4.1 Describe directory services in Azure, including Microsoft Entra ID and Microsoft Entra Domain Services. (Skills measured as of July 20, 2026)
Start with a question
How many passwords would you need if every app at work had its own login?
Dozens. With Microsoft Entra ID, one work identity signs you in everywhere.
Explain it like I’m 10
The technical explanation
Microsoft Entra ID provides:
- Authentication: verifying identity, password reset, MFA, smart lockout.
- Single sign-on: one identity for many apps.
- Application management: register and manage access to cloud and on-premises apps.
- Device management: register devices and use them in access policies.
Microsoft Entra Connect synchronises users from on-premises Active Directory. Microsoft Entra Domain Services adds managed domain join, Group Policy, LDAP and Kerberos/NTLM for legacy workloads, with Microsoft running the domain controllers.
Real-world business scenario
A manufacturing company
- The problem
- Staff had separate passwords for email, HR, the Azure portal and partner sites, and a legacy app in Azure needed domain join.
- What they used
- Entra ID with Entra Connect for single sign-on, and Entra Domain Services for the legacy app.
- Why that choice
- One identity everywhere, plus classic domain features without running domain controllers.
- The result
- Fewer password resets, and the legacy app was migrated without rewriting.
When to use it and when not to
✓ Use it when…
- Sign-in to Azure, Microsoft 365 and SaaS apps.
- **Domain Services** for legacy apps needing Kerberos or LDAP in Azure.
✕ Think twice when…
- Deploying your own domain controllers in Azure just for a few legacy apps, if Domain Services meets the need.
Interview preparation
Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.
Beginner What is Microsoft Entra ID?
Model answer
Microsoft's cloud identity service. It stores users and groups and handles sign-in to Azure, Microsoft 365 and other apps, with features like single sign-on and multifactor authentication.
Interviewer follows up
Is it the same as on-premises Active Directory?
You
No. On-premises AD Domain Services uses Kerberos, LDAP and Group Policy inside a corporate network. Entra ID is a cloud service using modern protocols like OAuth and SAML over the internet. They are often connected with Entra Connect.
Intermediate When would you use Microsoft Entra Domain Services?
Model answer
When I move legacy applications to Azure that need traditional domain features such as domain join, Group Policy, LDAP or Kerberos, and I do not want to deploy and patch my own domain controllers in Azure.
Experienced developer How do you design hybrid identity for a company with on-premises AD?
Model answer
Sync identities with Entra Connect or Cloud Sync, choose password hash sync (simplest and most resilient) or pass-through authentication, enable seamless SSO, enforce MFA and Conditional Access in Entra ID, and gradually move apps to modern authentication so dependence on on-premises AD shrinks.
Test yourself with exercises
3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.
Quick revision
Key points
- Entra ID = cloud identity and access management (formerly Azure AD).
- Provides authentication, SSO, app management and device management.
- Entra Connect syncs on-premises AD to Entra ID.
- Entra Domain Services = managed domain join, Group Policy, LDAP and Kerberos.
Important terminology
- Microsoft Entra ID
- Cloud identity and access management service (formerly Azure AD).
- Tenant
- A dedicated instance of Microsoft Entra ID representing an organisation.
- Microsoft Entra Connect
- Synchronises users and groups from on-premises Active Directory to Entra ID.
- Microsoft Entra Domain Services
- Managed domain join, Group Policy, LDAP and Kerberos/NTLM without managing domain controllers.
Common mistakes
- Calling Entra ID a direct replacement for on-premises AD Domain Services. They work differently.
Exam tips
- "Legacy app needs domain join and Kerberos, no domain controllers to manage" = Entra Domain Services.
Five quick revision questions
-
1.What was Microsoft Entra ID previously called?Show
Azure Active Directory (Azure AD).
-
2.What does Entra Connect do?Show
Syncs on-premises Active Directory identities to Entra ID.
-
3.Name two services Entra ID provides.Show
Authentication and single sign-on (also app and device management).
-
4.What does Entra Domain Services provide?Show
Managed domain join, Group Policy, LDAP and Kerberos/NTLM.
-
5.Do you manage domain controllers with Entra Domain Services?Show
No, Microsoft manages them.
Official references
Finished this lesson? Tick it off. Your progress is saved in this browser.