Azure AD is now Entra ID — and no, it is not your on-prem Active Directory
Microsoft Entra ID is the cloud service that decides who you are and what you are allowed to reach when you sign into the Azure portal, Microsoft 365, or any of thousands of connected apps — and it is the exact same product Microsoft used to call Azure Active Directory.
New to cloud? CAMPUX is a free, build-first course. Start here →
Active Directory (AD DS) is your on-prem domain controllers; Azure AD is the old name for Microsoft's cloud identity service; Entra ID is the current name for that same Azure AD service. Azure AD and Entra ID are one product with two labels — and neither one is on-prem Active Directory, despite the similar names.
You searched for Azure AD and landed on a page about Entra ID. That is not a mistake. In 2023 Microsoft renamed Azure Active Directory to Microsoft Entra ID. Same service, same tenants, same features — new name. The old term still lives in scripts, exam questions, and half the internet's documentation, so you need to know both point at one thing. When someone on your team says "Azure AD," they mean Entra ID. Microsoft's own docs now describe it plainly: a cloud-based identity and access management service that provides authentication, policy enforcement, and protection for users, devices, apps, and resources.
Azure AD vs Entra ID: what changed in the rename
Nothing functional. Microsoft rebranded the whole Azure AD family to Entra in July 2023, but your tenant ID, application IDs, licenses, and the API endpoints (login.microsoftonline.com, graph.microsoft.com) are all unchanged. Only the names on the boxes moved:
| Old term (Azure AD) | New term (Microsoft Entra) |
|---|---|
| Azure Active Directory (Azure AD / AAD) | Microsoft Entra ID |
| Azure AD Premium P1 / P2 | Microsoft Entra ID P1 / P2 |
| Azure AD Connect | Microsoft Entra Connect |
| Azure AD B2C / External Identities | Microsoft Entra External ID |
| Azure AD Conditional Access | Microsoft Entra Conditional Access |
| App registrations, service principals, tenants | Unchanged — same names, same IDs |
What it actually does
Entra ID is an identity provider. It answers two questions, every time, for every sign-in. Who are you (authentication) and what are you allowed to reach (authorization). It holds the directory of users, groups, and applications for your organization, and it is the thing that checks a password, prompts for a second factor, and hands back a token that other services trust. Every Entra directory starts with a domain like contoso.onmicrosoft.com, and you add your own custom domains on top. If you pay for Microsoft 365 or an Azure subscription, you already have an Entra tenant whether you asked for one or not — every tenant is automatically an Entra tenant.
It is the front door for the whole Microsoft cloud. One identity, checked once, that the Azure portal, Microsoft 365, and thousands of SaaS apps all agree to trust.
It is not on-prem Active Directory
This is the confusion that trips up everyone coming from a Windows shop, so be clear about it. Entra ID is not a cloud-hosted copy of the Active Directory Domain Services (AD DS) you ran on a domain controller. The name overlaps; the technology does not. AD DS is built around domains, organizational units, Group Policy, and Kerberos — it joins Windows machines to a domain and pushes configuration down to them. Entra ID does none of that in the same way. It has no OUs, no GPOs, and it is not a domain controller. It is identity for the cloud and the web: it speaks OAuth 2.0, OpenID Connect, and SAML, and it authenticates people and workloads to HTTP-based applications. If you genuinely need Kerberos or LDAP in the cloud for a legacy app, that is a different, separate product (Microsoft Entra Domain Services) — not Entra ID itself.
| Microsoft Entra ID | Active Directory (AD DS) | |
|---|---|---|
| Manages | Cloud & web identities | Domain-joined Windows machines |
| Protocols | OAuth 2.0, OpenID Connect, SAML | Kerberos, NTLM, LDAP |
| Structure | Flat directory of users, groups, apps | Domains, OUs, forests |
| Policy | Conditional Access | Group Policy (GPO) |
| You run | Nothing — Microsoft-managed SaaS | Your own domain controllers |
| Devices join by | Entra join / registration | Domain join |
On-prem Active Directory Domain Services manages domain-joined Windows machines with OUs, Group Policy, and Kerberos. Entra ID manages cloud and web identities with tokens, OAuth, and modern protocols. They often run side by side and sync users between them, but they are not the same service and one does not replace the other.
And Azure AD DS is a third, separate thing
One more name causes trouble: Azure AD Domain Services (AAD DS), now called Microsoft Entra Domain Services. It is not Entra ID, and it is not the same as the on-prem AD DS you run yourself. It is a managed service that stands up actual domain controllers inside Azure, so legacy apps can use Kerberos, NTLM, LDAP, and domain join without you patching a server. Reach for it only when an application genuinely needs those older protocols in the cloud; for everything modern, plain Entra ID is the identity service you want.
Where you meet it as a cloud engineer
You do not admire Entra ID from a distance — you touch it on ordinary workdays. Three places come up constantly. First, RBAC principals: when you grant someone access to a resource group, the user or group you assign the role to lives in Entra ID, and the role decides what they can do (see Owner, Contributor, and Reader). Second, app registrations and service principals: when an application or pipeline needs to authenticate to Azure, it gets an identity in Entra ID — that is the difference between a managed identity and a service principal. Third, Conditional Access: the policies that say "require multi-factor authentication from outside the office" are Entra ID rules that run at sign-in (start with Conditional Access basics). Identity is the control plane; you are configuring it whether you realize it or not.
The tiers, briefly
Entra ID comes in three editions, and the free one does more than you expect. Free is included with any Microsoft cloud subscription and covers core directory, user and group management, single sign-on, security defaults, and self-service password reset. P1 adds Conditional Access, group-based licensing, and self-service password reset with writeback to on-prem AD. P2 adds the risk-based features — Identity Protection and Privileged Identity Management — that react to suspicious sign-ins and put admin roles behind just-in-time activation. P1 and P2 also arrive bundled inside Microsoft 365 E3 and E5, which is how most organizations end up with them. Pick the tier by the feature you need, not the logo.
The takeaway
Microsoft Entra ID is the renamed Azure Active Directory: a cloud identity and access management service that proves who you are and decides what you can reach across the Azure portal, Microsoft 365, and thousands of SaaS apps. It is not a cloud version of on-prem Active Directory Domain Services — no OUs, no Group Policy, no domain controller — it is token-based identity for cloud and web. Learn where it sits (RBAC principals, app registrations, Conditional Access) and which tier gives you which control, and you understand the layer every other Azure permission ultimately hangs from.
Questions people also ask
Is Azure AD the same as Entra ID?
Yes. In 2023 Microsoft renamed Azure Active Directory to Microsoft Entra ID, and the only thing that changed is the name. The service, tenants, features, APIs, endpoints, sign-in URLs, licensing, and pricing all stay the same. When a script, exam, or colleague says Azure AD, they mean Entra ID — you are looking at one product with two labels.
What is the difference between Active Directory and Azure AD?
Active Directory Domain Services runs on-premises and manages domain-joined Windows machines with organizational units, Group Policy, and Kerberos. Azure AD — now Microsoft Entra ID — is a cloud identity service that authenticates people and apps over OAuth, OpenID Connect, and SAML. AD is domain-centric and lives on your servers; Azure AD is identity-centric and runs as a managed cloud service. They often sync and run side by side.
Is Entra ID a domain controller?
No. Entra ID is a multi-tenant cloud service, so there are no domain controllers for you to deploy or maintain, and it does not do Group Policy or Kerberos the way a domain controller does. If you need actual managed domain controllers in Azure for a legacy app, that is a separate product called Microsoft Entra Domain Services, not Entra ID itself.
Does Entra ID replace on-prem Active Directory?
Not directly. Entra ID handles cloud and web identity, while on-prem Active Directory still manages domain-joined machines, Group Policy, and Kerberos-based apps inside your network. Most organizations run both and sync users between them with Entra Connect. One does not swap in for the other; they cover different jobs and commonly operate together in a hybrid setup.
What does Entra ID authenticate you to?
Entra ID is the identity provider for the Microsoft cloud. It signs you in to the Azure portal, Microsoft 365, and thousands of connected SaaS applications, checking your password, prompting for a second factor, and handing back a token those services trust. If you pay for an Azure subscription or Microsoft 365, you already have an Entra tenant doing this work.