Microsoft Entra ID (formerly Azure Active Directory) is the cloud identity directory for a Microsoft 365 tenant. It holds user accounts, groups, devices that have joined the tenant, and the policies that decide who may sign in. Outlook, Teams, SharePoint, and the admin centre all check Entra ID. They do not each keep a separate staff list.
Plan families and mailbox migration steps live in the Microsoft 365 for Malaysian businesses article. This guide is the identity layer those products share.
What lives in the directory
A tenant is one organisation’s Entra ID instance, usually named like company.onmicrosoft.com, plus any custom domains you have verified. Inside it you will find:
- Users: staff accounts, and optionally guest accounts
- Groups: security groups for access, and Microsoft 365 groups that also create a shared mailbox, calendar, and often a Team
- Applications: Microsoft 365 itself, plus any other apps that trust this directory for sign-in (SSO)
- Devices: laptops and phones that have registered or joined, which Intune can then manage
- Roles: who may change the directory, covered in admin roles
Licences are assigned to users in Microsoft 365. Entra ID is still the account those licences attach to. Deleting a user in Entra ID removes their sign-in. It does not by itself decide which product SKU the company buys.
How sign-in works
When someone opens Outlook on the web or Teams, they authenticate against Entra ID: password, then any multifactor authentication or Conditional Access that applies. If the check succeeds, they receive tokens for the apps they are allowed to use. If it fails, every Microsoft 365 app fails in the same way. That is why “Teams is down” is often “sign-in is blocked.”
Password reset, banned passwords, and named locations (for example “these office IPs”) are Entra ID settings. They are not Outlook settings.
How a person reaches Microsoft 365
- An admin creates or syncs a user in Entra ID
- A Microsoft 365 licence is assigned to that user
- The person signs in and passes any MFA or Conditional Access rules
- Tokens are issued for mail, files, and Teams
- Groups and roles decide what they can open after sign-in
Cloud-only vs connected to on-premises
Many Malaysian SMEs are cloud-only: users exist only in Entra ID. Larger organisations may synchronise from an on-premises Active Directory with Entra Connect. In that model, the on-premises directory is still the source for many attributes; Entra ID is what Microsoft 365 reads at sign-in. Mixing the two without a written source of truth creates duplicate accounts and disabled mailboxes that look like product faults.
SSO to non-Microsoft apps (a line-of-business site, an HR tool) is also Entra ID. The app trusts the tenant instead of storing a second password.
A practical example
A company creates mailboxes in Exchange admin, Teams accounts by inviting personal Outlook addresses, and a shared spreadsheet of passwords for a supplier portal. Sign-in breaks independently in each place. The revision creates one Entra ID user per person, assigns licences, puts suppliers in guest accounts, and connects the portal to the same directory. Password resets happen once.
Key takeaways
- Entra ID is the tenant’s identity directory. Microsoft 365 apps consume it.
- Users, groups, apps, devices, and roles live here.
- Sign-in problems are usually directory or policy problems, not “Teams vs Outlook.”
- One account per person beats a mailbox-only or spreadsheet identity.
FAQ
Is Entra ID the same as Microsoft 365?
No. Microsoft 365 is the product suite. Entra ID is the identity service the suite uses. You meet it every time someone signs in.
Do we need Entra ID if we only want email?
A Microsoft 365 mailbox still sits on a user in Entra ID. There is no separate “email-only directory” inside the tenant.
What happened to Azure AD?
Azure Active Directory was renamed Microsoft Entra ID. The tenant and the concepts (users, groups, Conditional Access) are the same service.