What is Microsoft Entra ID (formerly Azure AD), and how does authentication work in Azure?
What they are really testing: Whether you know Entra ID is the cloud identity provider for Azure and that it is token-based (OAuth2/OIDC), not the same thing as on-prem Active Directory. The foundation everything else builds on.
A real interview question
What is Microsoft Entra ID (formerly Azure AD), and how does authentication work in Azure?
What most people say
drag me
“Entra ID is just the new name for Active Directory in the cloud.”
Calling it cloud AD is the common misconception. Entra ID is a token-based (OAuth2/OIDC) cloud identity service, architecturally different from on-prem AD with its LDAP and Kerberos. Conflating them leads to wrong assumptions about how auth works.
The follow-ups they ask next
How is Entra ID different from on-prem Active Directory?
On-prem AD is LDAP/Kerberos for a local domain (domain controllers, group policy). Entra ID is a cloud, internet-facing, token-based (OAuth2/OIDC) identity service. Different protocols and design; you can sync between them but they are not the same.
What kinds of identities live in Entra ID?
Users and groups, plus application identities: service principals (for apps) and managed identities (platform-managed app identities with no secrets to handle). All within a tenant.
What the interviewer is listening for
- Knows Entra ID = cloud identity provider
- Token-based OAuth2/OIDC
- Knows it is not on-prem AD
What sinks the answer
- "It is just AD in the cloud"
- No notion of tokens/OIDC
- Cannot name the identity types
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Microsoft Entra ID (formerly Azure AD) is [Azure cloud identity provider, it holds and authenticates identities]. It holds [users, groups, service principals, managed identities, in a tenant]. Auth is [token-based via OAuth2/OIDC, Entra issues JWT tokens]. It is [not on-prem AD (no LDAP/Kerberos), a cloud token-based service, though you can sync from AD].”
Keep going with azure
Foundation
In Azure, what handles authentication versus authorization?
Foundation
Explain the Azure resource hierarchy: tenant, management group, subscription, resource group.
Junior
How does Azure RBAC work? Explain roles, scopes, and assignments.
Junior
What happens when a user signs in to an Azure/Entra-protected application?
Junior
What is the difference between a service principal and a managed identity, and why prefer managed identities?
Junior
What is Azure Key Vault, and how should an application access a secret from it securely?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free