Microsoft Azure Administrator

The gatekeeper, not the building

Every Azure subscription needs an answer to one question before anything else: who are you, and what are you allowed to touch? Microsoft Entra ID (formerly Azure Active Directory) is that answer - a cloud directory service, playing the same role a badge system plays in a physical office. It doesn't store your files or run your VMs; it just issues identities, checks who's trying to sign in, and confirms "is this really them?" at every door.

Users, groups, and tenants

• Users - the individual identities Entra ID issues, one per person (or service).
• Groups - badges with shared access, so you manage permissions for a team at once instead of person by person.
• Tenant - your organization's own dedicated instance of this directory - your own HR department, not shared with any other company, even though it runs on Microsoft's shared cloud infrastructure.

Where this fits with RBAC

Get this distinction early: Entra ID is the gatekeeper, not the building. It answers *who you are*. Azure RBAC (next module) answers *what you're allowed to do* once you're inside - a separate system that layers on top of the identity Entra ID already confirmed.