What is Microsoft Entra ID, and how does it differ from on-premises Active Directory?

Microsoft Entra ID — formerly Azure Active Directory — is a cloud identity and access management service. It is the authentication and authorisation layer for Azure, Microsoft 365, and thousands of SaaS applications.

The differences from on-premises Active Directory are fundamental, not cosmetic:

• Protocols. On-premises AD uses Kerberos and LDAP. Entra ID uses OAuth 2.0, OpenID Connect, and SAML — internet protocols designed for applications outside your network.
• Structure. AD has organisational units, domains, forests, and Group Policy. Entra ID is flat, with users, groups, and tenants, and no Group Policy.
• What it manages. AD manages domain-joined Windows machines. Entra ID manages access to applications and cloud resources across any platform.

They are complementary rather than alternatives. Most organisations run both, synchronised with Entra Connect so users have one identity across on-premises and cloud — hybrid identity.

Key capabilities to name: single sign-on, multi-factor authentication, Conditional Access for policy-based access decisions, Privileged Identity Management for just-in-time elevation, and managed identities for services.

Note: Do not confuse Entra ID roles, which control access to identity objects, with Azure RBAC roles, which control access to Azure resources. They are separate systems and the distinction is a favourite interview probe.