Microsoft Entra ID (Azure AD)

Microsoft's cloud identity provider: SSO, OAuth2/OIDC, B2B/B2C, Conditional Access, PIM just-in-time roles, and app registration for RBAC.

AzureAdvanced

Why

Entra ID is the identity backbone for Azure and Microsoft 365 — every Azure resource trusts it for RBAC, and it federates with on-prem AD via Connect. It provides Conditional Access (block legacy auth, require MFA by location), PIM for just-in-time privileged access, and app registrations for your own SaaS apps' OIDC login. Azure holds 21% cloud market share (Synergy Research Q4 2024).

Azure is the default for enterprises with Microsoft 365 / Active Directory estates — 95% of Fortune 500 use Azure. AKS and Cosmos DB are first-class for .NET workloads.

When

Use Entra ID for any Azure RBAC, Microsoft 365 SSO, or custom app needing OIDC login. Use B2C for consumer-facing apps with social login (Google, Facebook).

Use Managed Identities (backed by Entra ID) for service-to-service auth in Azure so no secret is stored. Prefer it over rolling your own JWT issuer.

How

1. Create an app registration for your app; get the client ID and tenant ID. 2. Add a client secret or (better) a federated credential for GitHub Actions. 3. Configure redirect URIs for OIDC login. 4. Define app roles in the manifest for RBAC; assign roles to users/groups. 5. Use MSAL (@azure/msal-node) to acquire tokens. 6. Protect APIs by validating the JWT audience and issuer. ```bash az ad app create --display-name "myapp" --identifier-uris "https://myapp" az ad sp create --id \${APP_ID} az role assignment create --role "Reader" --assignee \${SP_ID} --scope /subscriptions/.../resourceGroups/rg ```

Example

Node.js API validating an Entra ID JWT with passport and enforcing an app role: ```ts import passport from "passport"; import { BearerStrategy } from "passport-azure-ad"; passport.use(new BearerStrategy({ identityMetadata: "https://login.microsoftonline.com/contoso.onmicrosoft.com/v2.0/.well-known/openid-configuration", clientID: process.env.AAD_CLIENT_ID!, audience: process.env.AAD_AUDIENCE!, }, (token, done) => { if (!token.roles?.includes("Admin")) return done(null, false); return done(null, token, token); })); app.get("/admin", passport.authenticate("oauth-bearer", { session: false }), (req, res) => res.json({ ok: true })); ```

Common Problems

⚠401 invalid_token audience mismatch — the API's audience config must match the token's aud claim; for a single-tenant API, use the client ID URI as the audience.
⚠App role not in token — roles are only emitted for users assigned the role via app role assignment; group-based roles require the 'group claims' optional claim and a group-to-role mapping in your code.
⚠Client secret expired — app registrations' secrets expire (max 24 months); use federated identity credentials (workload identity federation) for GitHub Actions to avoid secrets entirely.

Best Practices

✓Use Managed Identities for Azure service-to-service auth — no secret to rotate, and the identity is tied to the resource lifecycle.
✓Enable Conditional Access policies (require MFA, block legacy auth, restrict by location) instead of relying on passwords alone.
✓Use PIM (Privileged Identity Management) for Owner/Contributor roles so privileged access is just-in-time and audited, not standing.

FAQ

What is Microsoft Entra ID (Azure AD) and what problem does it solve?

Microsoft's cloud identity provider: SSO, OAuth2/OIDC, B2B/B2C, Conditional Access, PIM just-in-time roles, and app registration for RBAC. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with Microsoft Entra ID (Azure AD) in 5 minutes?

Two steps to run it: (1) Create an app registration for your app; get the client ID and tenant ID.; (2) Add a client secret or (better) a federated credential for GitHub Actions.. Validate on the free tier first, then wire into production.

What is the #1 pitfall with Microsoft Entra ID (Azure AD)?

The most frequent issue is: 401 invalid_token audience mismatch — the API's audience config must match the token's aud claim; for a single-tenant API, use the client ID URI as the audience.. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for Microsoft Entra ID (Azure AD)?

Best practices for Microsoft Entra ID (Azure AD) include: Use Managed Identities for Azure service-to-service auth — no secret to rotate, and the identity is tied to the resource lifecycle.; Enable Conditional Access policies (require MFA, block legacy auth, restrict by location) instead of relying on passwords alone.; Use PIM (Privileged Identity Management) for Owner/Contributor roles so privileged access is just-in-time and audited, not standing.. The first one — "Use Managed Identities for Azure service-to-service auth — no secret to rotate, and the identity is tied to the resource lifecycle." — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with Microsoft Entra ID (Azure AD)?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most Microsoft Entra ID (Azure AD) options offer a free tier — validate within free quota before scaling.