Microsoft Entra ID (Azure AD) Complete Reference Cheatsheet

Introduction: The Foundation of Microsoft Cloud Identity

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft’s cloud-based identity and access management service. It serves as the control center for user authentication, application access, and security policies across Microsoft 365, Azure resources, and thousands of integrated applications. Understanding Entra ID is essential for secure and efficient cloud operations.

Note: In 2023, Microsoft rebranded Azure Active Directory (Azure AD) as Microsoft Entra ID. While the product name has changed, most functionality remains the same, and many interfaces still use “Azure AD” terminology. This cheatsheet uses both terms interchangeably.

Core Identity Concepts & Components

Azure AD Editions & Licensing

Common Add-ons:

• Microsoft Defender for Identity (formerly ATP): Advanced threat protection
• Microsoft Defender for Cloud Apps (formerly MCAS): Cloud access security broker
• Entra ID Governance: Identity governance and lifecycle management

Directory Management

Tenant Creation & Configuration

• Initial domain: [tenantname].onmicrosoft.com (immutable)
• Custom domain verification requires DNS record validation
• Multi-tenant apps span organizational boundaries
• Cross-tenant access settings control external collaboration

User Management

User Properties & Settings

• User Principal Name (UPN): Primary login identifier (email format)
• Object ID: Immutable identifier within a tenant
• Display Name: Shown in interfaces
• Mail: Email address (may differ from UPN)
• Department/Job Title/Manager: Organizational attributes
• Usage Location: Required for license assignment
• Authentication Methods: Ways the user can authenticate
• Authentication Contact Info: Phone/email for MFA/SSPR

Group Management

Group Creation Options:

• Assignment (static): Manually add/remove members
• Dynamic User: Rule-based membership using user attributes
• Dynamic Device: Rule-based membership using device attributes

Dynamic Group Rule Example:

user.department -eq "Finance" and user.country -eq "US"

Administrative Models

Key Built-in Roles:

• Global Administrator: Full control of Entra ID
• User Administrator: Create/manage users and groups
• Authentication Administrator: Reset passwords for non-admin users
• Application Administrator: Manage enterprise applications
• License Administrator: Assign and manage licenses
• Security Administrator: Manage security features
• Conditional Access Administrator: Manage CA policies
• Global Reader: Read-only access to everything

Authentication Methods

Primary Authentication Options

Multi-Factor Authentication (MFA)

Configuration Options:

1. Security Defaults: Basic MFA enforcement for all users
2. Conditional Access Policies: Context-based MFA triggers
3. Per-User MFA: Legacy configuration method (limited)

MFA Deployment Steps:

1. Enable authentication methods in Authentication Methods policy
2. Create Conditional Access policy requiring MFA
3. Exclude break-glass admin accounts from MFA requirement
4. Implement staged rollout to user groups
5. Monitor Authentication Methods Activity dashboard

Self-Service Password Reset (SSPR)

Key Settings:

• Registration requirements (optional/required)
• Authentication methods needed (1-3)
• Method options (email, phone, authenticator app, security questions)
• Admin notification on reset
• On-premises writeback (requires AD Connect)

Authorization & Access Control

Conditional Access Policies

Policy Components:

• Assignments:
  • Users/groups/roles (who)
  • Cloud apps (what)
  • Conditions (when/where/how)
• Access Controls:
  • Grant controls (allow with requirements)
  • Session controls (limit what can be done)

Common Conditional Access Scenarios:

Named Locations:

• IP ranges (trusted corporate networks)
• Countries/regions (allow or block)
• Mark as trusted location (affects risk calculations)

Identity Protection

Risk Detections:

Risk Policies:

• Sign-in Risk Policy: Actions during risky sign-ins
• User Risk Policy: Actions for users with compromised accounts
• MFA Registration Policy: Require MFA registration

Privileged Identity Management (PIM)

Role Assignment Types:

• Eligible: User must activate role when needed
• Active: Role is permanently assigned

Activation Settings:

• Activation duration (hours)
• Require MFA
• Require ticket/justification
• Approval requirements

Access Reviews:

• Periodic review of role membership
• Self-attestation or reviewer-driven
• Automated actions for denied access

Application Management

Enterprise Applications

Application Types:

• Microsoft Applications: M365, Dynamics, etc.
• Gallery Applications: Pre-integrated SaaS apps
• Non-gallery Applications: Custom SAML/OAuth integrations
• On-premises Applications: App Proxy for internal apps

Key Application Properties:

• Enterprise App Object ID: Unique identifier for the service principal
• App Registration Object ID: Unique identifier for the app registration
• Application ID (Client ID): Identifier used in authentication flows
• Client Secret/Certificate: Authentication credentials for the app
• Reply URL (Redirect URI): Where authentication responses are sent
• App Roles: Role-based access control within applications
• Required User Assignment: Whether users must be assigned to use the app

Single Sign-On Methods

Application Consent & Permissions

Permission Types:

• Delegated: App acts on behalf of signed-in user
• Application: App acts with its own identity

Consent Settings:

• User consent for personal apps
• User consent for apps in your organization
• Admin consent for all apps

Admin Consent Workflow:

• User requests access to an app
• Admins receive notification
• Admins review and approve/deny

Hybrid Identity Configuration

Azure AD Connect

Synchronization Options:

• Password Hash Synchronization: Store password hash in cloud
• Pass-through Authentication: Verify credentials on-premises
• Federation: Redirect to on-premises ADFS

Key Configuration Decisions:

• Filtering (sync all vs selected OUs)
• Custom attribute synchronization
• Attribute transformation rules
• Multi-forest considerations
• Password writeback for SSPR

Hybrid Security Features

Device Management

Device Identity Types

Device Security Features

• Conditional Access device filters: Block/allow specific device platforms
• Device compliance: Integrate with Intune for health status
• Compliant vs. Hybrid Join requirement: Different trust levels
• Microsoft Authenticator: Additional security on mobile devices
• Device-based Conditional Access: Require managed devices
• Primary Refresh Token (PRT): Seamless access across applications

Security Recommendations & Best Practices

Identity Security Foundation

1. Secure Authentication:

   • Enable MFA for all users
   • Implement passwordless where possible
   • Block legacy authentication protocols
   • Configure SSPR for user autonomy

2. Least Privilege Access:

   • Use Privileged Identity Management (PIM)
   • Implement Just-in-Time access for admin roles
   • Regularly review access with Access Reviews
   • Use Cloud App Security for session monitoring

3. Zero Trust Implementation:

   • Verify explicitly (strong authentication)
   • Use least privilege access (JIT)
   • Assume breach (segmentation, monitoring)

Monitoring & Alerting

Key Areas to Monitor:

• Sign-in logs (failed attempts, unusual patterns)
• Audit logs (admin activities, permission changes)
• Risky users and sign-ins
• MFA failures and registration status
• Service principal activity
• Provisioning logs

Alert Priorities:

1. Global Admin role assignments
2. Password changes for privileged accounts
3. MFA changes or disabling
4. Conditional Access policy modifications
5. New service principal creation
6. External user invitations

Security Benchmarks

Microsoft Secure Score Actions:

• Enable security defaults
• Require MFA for administrative roles
• Register all users for MFA
• Enable Password Hash Synchronization
• Use Cloud App Security to detect risky app usage
• Regularly review sign-in logs

PowerShell Cmdlets & Management Tools

Microsoft Graph PowerShell SDK

Key Module Installation:

Install-Module Microsoft.Graph -Scope CurrentUser

Authentication:

Connect-MgGraph -Scopes "Directory.ReadWrite.All"

Common User Management Commands:

# Get all users
Get-MgUser -All

# Create new user
$params = @{
    AccountEnabled = $true
    DisplayName = "John Smith"
    MailNickname = "jsmith"
    UserPrincipalName = "jsmith@contoso.com"
    PasswordProfile = @{
        Password = "SecureP@$$w0rd!"
        ForceChangePasswordNextSignIn = $true
    }
}
New-MgUser -BodyParameter $params

# Get user by UPN
Get-MgUser -Filter "userPrincipalName eq 'jsmith@contoso.com'"

# Update user properties
Update-MgUser -UserId "user-id" -DisplayName "John A. Smith"

# Disable user account
Update-MgUser -UserId "user-id" -AccountEnabled:$false

Group Management:

# Get all groups
Get-MgGroup -All

# Create new group
$params = @{
    DisplayName = "Marketing Team"
    MailEnabled = $false
    MailNickname = "marketingteam"
    SecurityEnabled = $true
    Description = "Marketing department team"
}
New-MgGroup -BodyParameter $params

# Add member to group
New-MgGroupMember -GroupId "group-id" -DirectoryObjectId "user-id"

# Get group members
Get-MgGroupMember -GroupId "group-id"

Application Management:

# Get all applications
Get-MgApplication -All

# Create service principal
$params = @{
    AppId = "application-id"
}
New-MgServicePrincipal -BodyParameter $params

# Get all enterprise applications (service principals)
Get-MgServicePrincipal -All

Azure CLI Commands

Authentication:

az login

User Management:

# List users
az ad user list

# Create user
az ad user create --display-name "John Smith" --password "SecureP@$$w0rd!" --user-principal-name "jsmith@contoso.com"

# Get user
az ad user show --id "jsmith@contoso.com"

# Update user
az ad user update --id "jsmith@contoso.com" --display-name "John A. Smith"

Group Management:

# List groups
az ad group list

# Create group
az ad group create --display-name "Marketing Team" --mail-nickname "marketingteam"

# Add member to group
az ad group member add --group "Marketing Team" --member-id "user-object-id"

# List group members
az ad group member list --group "Marketing Team"

Integration Scenarios & Solutions

Microsoft 365 Integration

Key Identity Components:

• Single identity across all M365 services
• Unified admin portal (Microsoft 365 admin center)
• User assignment for licenses and app access
• Group-based license assignment
• Teams integration for collaboration

Hybrid Management Scenarios

Third-Party Integration Patterns

Troubleshooting Toolkit

Sign-in Issues

Common Error Codes

Sign-in Log Analysis

Key Fields to Review:

• Status: Success or failure
• Conditional Access: Policies applied and results
• Device Info: Browser, OS, trusted device status
• Authentication Details: Method used
• Location: IP address and named location
• Additional Details: Risk state, applied policies

Resources for Further Learning

Official Documentation

• Microsoft Entra ID Documentation
• Microsoft Entra Admin Center
• Microsoft Graph API Reference
• Azure AD Feature Comparison

Practice & Certification

• Microsoft Learn Modules for Identity
• SC-300: Microsoft Identity and Access Administrator
• MS-500: Microsoft 365 Security Administration

Community Resources

• Microsoft Tech Community – Entra ID Forum
• Microsoft Identity Architecture Center
• Identity and Access Management YouTube Channel