Microsoft Entra ID
¿Qué es Microsoft Entra ID?
Microsoft Entra IDMicrosoft's cloud identity service — formerly Azure Active Directory — providing identity, single sign-on, MFA, Conditional Access, and external-identity capabilities for Microsoft 365 and millions of integrated SaaS applications.
Microsoft Entra ID is the rebrand of Azure Active Directory, announced in July 2023 and rolled out through 2023–2024. As a product it is essentially unchanged: the same cloud identity, authentication, and authorization service backing Microsoft 365, Azure, and millions of integrated SaaS applications. The Entra brand also covers a broader family — Entra ID Governance (formerly Azure AD Identity Governance), Entra Verified ID (decentralized identifiers), Entra Permissions Management (CIEM), Entra Internet Access and Entra Private Access (SSE/ZTNA). The naming change is operationally important because it appears throughout documentation, MSGraph endpoints (still `graph.microsoft.com`), Conditional Access UIs, audit logs, and security tooling — meaning anyone writing detections, runbooks, or training has had to migrate terminology. From a security perspective Entra ID is the de facto IdP for most enterprises, and its primary attack surfaces are well known: consent phishing, device-code phishing, OAuth-token theft, Pass-the-PRT, Golden SAML against AD FS, and Storm-0558-style key compromise. Conditional Access, FIDO2-only sign-in policies, and Identity Protection are the corresponding defensive controls.
● Ejemplos
- 01
A Conditional Access policy blocks legacy authentication protocols and requires FIDO2-bound sign-in for all global administrators.
- 02
A SIEM detection updates its data source from 'AzureActiveDirectory' to 'Microsoft Entra ID' but continues to reference the same Graph endpoints and event schema.
● Preguntas frecuentes
¿Qué es Microsoft Entra ID?
Microsoft's cloud identity service — formerly Azure Active Directory — providing identity, single sign-on, MFA, Conditional Access, and external-identity capabilities for Microsoft 365 and millions of integrated SaaS applications. Pertenece a la categoría de Identidad y acceso en ciberseguridad.
¿Qué significa Microsoft Entra ID?
Microsoft's cloud identity service — formerly Azure Active Directory — providing identity, single sign-on, MFA, Conditional Access, and external-identity capabilities for Microsoft 365 and millions of integrated SaaS applications.
¿Cómo funciona Microsoft Entra ID?
Microsoft Entra ID is the rebrand of Azure Active Directory, announced in July 2023 and rolled out through 2023–2024. As a product it is essentially unchanged: the same cloud identity, authentication, and authorization service backing Microsoft 365, Azure, and millions of integrated SaaS applications. The Entra brand also covers a broader family — Entra ID Governance (formerly Azure AD Identity Governance), Entra Verified ID (decentralized identifiers), Entra Permissions Management (CIEM), Entra Internet Access and Entra Private Access (SSE/ZTNA). The naming change is operationally important because it appears throughout documentation, MSGraph endpoints (still `graph.microsoft.com`), Conditional Access UIs, audit logs, and security tooling — meaning anyone writing detections, runbooks, or training has had to migrate terminology. From a security perspective Entra ID is the de facto IdP for most enterprises, and its primary attack surfaces are well known: consent phishing, device-code phishing, OAuth-token theft, Pass-the-PRT, Golden SAML against AD FS, and Storm-0558-style key compromise. Conditional Access, FIDO2-only sign-in policies, and Identity Protection are the corresponding defensive controls.
¿Cómo defenderse de Microsoft Entra ID?
Las defensas contra Microsoft Entra ID combinan habitualmente controles técnicos y prácticas operativas, como se detalla en la definición.
¿Cuáles son otros nombres para Microsoft Entra ID?
Nombres alternativos comunes: Azure AD, Azure Active Directory, AAD.
● Términos relacionados
- identity-access№ 014
Active Directory
Servicio de directorio empresarial de Microsoft para redes Windows que ofrece autenticación, autorización y gestión de políticas centralizadas para usuarios, equipos y recursos.
- identity-access№ 1162
Inicio de sesión único (SSO)
Esquema de autenticación que permite iniciar sesión una sola vez ante un proveedor de identidad de confianza y luego acceder a varias aplicaciones sin volver a introducir credenciales.
- identity-access№ 839
OAuth 2.0
Marco abierto de autorización que permite al propietario de un recurso conceder a una aplicación de terceros acceso limitado y delimitado a una API, sin compartir credenciales.
- identity-access№ 852
OpenID Connect (OIDC)
Capa de identidad construida sobre OAuth 2.0 que permite a los clientes verificar la identidad de un usuario y obtener información de perfil mediante tokens ID firmados.
- identity-access№ 793
Autenticación multifactor (MFA)
Método de autenticación que requiere dos o más factores independientes —normalmente de categorías distintas— antes de conceder acceso.
- attacks№ 840
OAuth Consent Phishing
An identity attack that abuses the OAuth consent flow: instead of stealing a password, the attacker tricks the victim into granting their malicious app standing permissions (mail.read, files.read.all) on the victim's tenant.