Microsoft Entra ID
Что такое Microsoft Entra ID?
Microsoft Entra IDMicrosoft's cloud identity service — formerly Azure Active Directory — providing identity, single sign-on, MFA, Conditional Access, and external-identity capabilities for Microsoft 365 and millions of integrated SaaS applications.
Microsoft Entra ID is the rebrand of Azure Active Directory, announced in July 2023 and rolled out through 2023–2024. As a product it is essentially unchanged: the same cloud identity, authentication, and authorization service backing Microsoft 365, Azure, and millions of integrated SaaS applications. The Entra brand also covers a broader family — Entra ID Governance (formerly Azure AD Identity Governance), Entra Verified ID (decentralized identifiers), Entra Permissions Management (CIEM), Entra Internet Access and Entra Private Access (SSE/ZTNA). The naming change is operationally important because it appears throughout documentation, MSGraph endpoints (still `graph.microsoft.com`), Conditional Access UIs, audit logs, and security tooling — meaning anyone writing detections, runbooks, or training has had to migrate terminology. From a security perspective Entra ID is the de facto IdP for most enterprises, and its primary attack surfaces are well known: consent phishing, device-code phishing, OAuth-token theft, Pass-the-PRT, Golden SAML against AD FS, and Storm-0558-style key compromise. Conditional Access, FIDO2-only sign-in policies, and Identity Protection are the corresponding defensive controls.
● Примеры
- 01
A Conditional Access policy blocks legacy authentication protocols and requires FIDO2-bound sign-in for all global administrators.
- 02
A SIEM detection updates its data source from 'AzureActiveDirectory' to 'Microsoft Entra ID' but continues to reference the same Graph endpoints and event schema.
● Частые вопросы
Что такое Microsoft Entra ID?
Microsoft's cloud identity service — formerly Azure Active Directory — providing identity, single sign-on, MFA, Conditional Access, and external-identity capabilities for Microsoft 365 and millions of integrated SaaS applications. Относится к категории Идентификация и доступ в кибербезопасности.
Что означает Microsoft Entra ID?
Microsoft's cloud identity service — formerly Azure Active Directory — providing identity, single sign-on, MFA, Conditional Access, and external-identity capabilities for Microsoft 365 and millions of integrated SaaS applications.
Как работает Microsoft Entra ID?
Microsoft Entra ID is the rebrand of Azure Active Directory, announced in July 2023 and rolled out through 2023–2024. As a product it is essentially unchanged: the same cloud identity, authentication, and authorization service backing Microsoft 365, Azure, and millions of integrated SaaS applications. The Entra brand also covers a broader family — Entra ID Governance (formerly Azure AD Identity Governance), Entra Verified ID (decentralized identifiers), Entra Permissions Management (CIEM), Entra Internet Access and Entra Private Access (SSE/ZTNA). The naming change is operationally important because it appears throughout documentation, MSGraph endpoints (still `graph.microsoft.com`), Conditional Access UIs, audit logs, and security tooling — meaning anyone writing detections, runbooks, or training has had to migrate terminology. From a security perspective Entra ID is the de facto IdP for most enterprises, and its primary attack surfaces are well known: consent phishing, device-code phishing, OAuth-token theft, Pass-the-PRT, Golden SAML against AD FS, and Storm-0558-style key compromise. Conditional Access, FIDO2-only sign-in policies, and Identity Protection are the corresponding defensive controls.
Как защититься от Microsoft Entra ID?
Защита от Microsoft Entra ID обычно сочетает технические меры и операционные практики, как описано в определении выше.
Какие есть другие названия Microsoft Entra ID?
Распространённые альтернативные названия: Azure AD, Azure Active Directory, AAD.
● Связанные термины
- identity-access№ 014
Active Directory
Корпоративная служба каталогов Microsoft для сетей Windows, обеспечивающая централизованную аутентификацию, авторизацию и управление политиками для пользователей, компьютеров и ресурсов.
- identity-access№ 1162
Единый вход (SSO)
Способ аутентификации, при котором пользователь один раз входит у доверенного поставщика идентификации и затем получает доступ ко многим приложениям без повторного ввода учётных данных.
- identity-access№ 839
OAuth 2.0
Открытый фреймворк авторизации, позволяющий владельцу ресурса предоставлять стороннему приложению ограниченный и регулируемый доступ к API без передачи учётных данных.
- identity-access№ 852
OpenID Connect (OIDC)
Слой идентификации поверх OAuth 2.0, позволяющий клиентам проверять подлинность пользователя и получать базовые сведения о профиле через подписанные ID-токены.
- identity-access№ 793
Многофакторная аутентификация (MFA)
Метод аутентификации, при котором перед предоставлением доступа требуется два и более независимых фактора, обычно из разных категорий.
- attacks№ 840
OAuth Consent Phishing
An identity attack that abuses the OAuth consent flow: instead of stealing a password, the attacker tricks the victim into granting their malicious app standing permissions (mail.read, files.read.all) on the victim's tenant.