Entra ID

What is Entra ID?

Microsoft Entra ID is Microsoft’s cloud-based identity and access management service that authenticates users, devices and applications and decides who gets access to Microsoft 365, Azure and thousands of other applications, and under which conditions. Until July 2023 the service was called Azure Active Directory (Azure AD). Despite that old name, Entra ID is a different product from on-premises Active Directory: it mainly uses web protocols such as OAuth 2.0, OpenID Connect and SAML rather than Kerberos and LDAP. For IT/OT organisations, Entra ID matters mainly as the central gateway for remote access, management portals and cloud applications, and as a building block of a Zero Trust architecture.

🧠 How does Entra ID work?

Every organisation gets its own tenant in Entra ID: an isolated directory holding users, groups, devices and registered applications. A sign-in takes four steps:

1. Sign-in - the user or device signs in to the Microsoft sign-in service with a work or school account.
2. Authentication - Entra ID checks the password, passkey, certificate or app notification, optionally combined with MFA.
3. Evaluation - Conditional Access policies weigh signals such as user, group, location, device state, application and sign-in risk, and decide: allow, require an extra factor, or block.
4. Token - if approved, Entra ID issues a signed token that the application trusts without ever handling passwords itself (single sign-on).

Roles and permissions within the tenant are assigned through RBAC, and access control to applications is managed through group assignments. With Privileged Identity Management (PIM), administrators only receive their role temporarily after activation instead of permanently. Together these functions make Entra ID the IAM platform for the Microsoft cloud.

🔄 What is the difference between Entra ID and Active Directory?

Microsoft chose the new name partly to end the confusion with Windows Server Active Directory. The two complement each other but work in fundamentally different ways:

Many organisations run a hybrid setup: Microsoft Entra Connect (or the lighter Cloud Sync) synchronises accounts from Active Directory to Entra ID. Three sign-in methods are available:

• Password hash synchronisation (PHS) - Entra ID validates a derived hash of the password; synchronisation runs every two minutes and no on-premises sign-in infrastructure is needed.
• Pass-through authentication (PTA) - lightweight agents (Microsoft recommends three) validate the password against the on-premises domain controllers.
• Federation - your own identity provider, such as AD FS, handles the sign-in, with servers in the DMZ.

Microsoft recommends always enabling PHS, even alongside PTA or federation, so that sign-in keeps working when on-premises infrastructure fails, for example after a ransomware attack.

📅 Which licences and milestones matter?

Entra ID comes in several tiers. Most of the security features that matter for OT access are in the paid tiers:

Microsoft 365 E3 includes P1 and Microsoft 365 E5 includes P2. Key dates in the history of the service:

• 11 July 2023 - the new name was announced; the licence names followed on 1 October 2023. Sign-in URLs, APIs and libraries stayed the same.
• 30 September 2024 - the on-premises Azure Multi-Factor Authentication Server stopped processing MFA requests. Since then, VPN integrations with MFA run through the cloud.
• October 2024 - mandatory MFA for sign-in to the Azure portal, the Entra admin center and the Intune admin center (phase 1).
• 1 October 2025 - phase 2: mandatory MFA for changes made through Azure CLI, PowerShell, infrastructure-as-code tools and the REST API. Tenants could postpone this until 1 July 2026 at the latest.

🏭 How is Entra ID used in OT environments?

In process automation, Entra ID rarely sits deeper in the Purdue Model than the boundary between IT and OT. Typical uses:

• VPN with MFA via RADIUS - the VPN gateway sends a RADIUS request to a Windows NPS server; the server checks the password against Active Directory and calls Entra MFA through the NPS extension. The NPS server only needs outbound TCP 443. Microsoft recommends a VPN timeout of at least 60 seconds so the user has time to approve the prompt.
• Supplier access - external service engineers get a guest (B2B) account with their own MFA, time-limited group membership and a separate Conditional Access policy, instead of a shared account.
• Single sign-on to web portals - SCADA web clients, historian dashboards, MES applications and IIoT platforms that support OpenID Connect or SAML hand sign-in over to Entra ID.
• VPN replacement - Microsoft Entra Private Access grants per-application access through a client and a connector that only makes outbound connections, so no inbound port is needed in the firewall.
• Jump hosts - administrators sign in with Entra ID and MFA to a jump server in the IDMZ and continue from there with a separate OT account.

What deliberately does not belong in Entra ID is local sign-in on HMIs, controllers and engineering stations. Those must keep working when the internet connection drops, so they rely on a separate local OT domain or local accounts, without synchronisation to the IT tenant.

🔐 How do you secure Entra ID for IT/OT access?

Entra ID is an attractive target: whoever takes over an administrator account gains access to everything connected to it at once. The Storm-0558 attack of 2023 showed this, when attackers used a stolen Microsoft signing key to forge tokens and broke into the mailboxes of about 25 organisations. The US Cyber Safety Review Board published a critical report on it in April 2024. Practical security measures:

• Phishing-resistant MFA - use passkeys (FIDO2) or certificates for administrators and OT access; SMS and voice calls are weaker against phishing.
• Block legacy authentication - protocols without MFA support otherwise bypass every Conditional Access policy.
• Least privilege with PIM - no permanent global administrators; activate roles temporarily with approval and a justification.
• Emergency access accounts - at least two cloud-only accounts on the onmicrosoft.com domain, protected with a passkey, excluded from blocking policies and tested at least every 90 days.
• Logging - forward sign-in and audit logs to a SIEM such as Microsoft Sentinel, because the default retention is only 7 or 30 days.
• Separation - do not synchronise OT administrator accounts to the IT tenant, and limit what a cloud account can reach in the OT network with network segmentation, VLANs and firewall rules.

🧭 Which requirements does Entra ID help meet?

Entra ID is a means, not an end, but it helps you meet requirements from regulation and standards in a demonstrable way:

• NIS2 and the Dutch Cybersecurity Act - Article 21 of NIS2 explicitly lists access control policies and the use of multi-factor authentication as duty-of-care measures. Conditional Access and MFA reports are useful evidence for both.
• IEC 62443-3-3 - system requirement SR 1.1 calls for unique identification and authentication of human users; its enhancements require MFA for untrusted networks (security level 3) and for all networks (security level 4). Entra ID can cover this for access from outside, not for the OT network itself.
• ISO 27001 - the controls for access management, authentication information and privileged access rights map directly onto Conditional Access and PIM.

❓ Frequently asked questions

Is Entra ID the same as Azure AD?

Yes, Entra ID has been the new name for Azure Active Directory since July 2023. Features, licences and prices stayed the same; only the product name and licence names changed. Entra ID is, however, a different product from on-premises Active Directory.

Does Entra ID replace an on-premises Active Directory?

Not automatically. Entra ID manages identities for cloud applications and can sign in Windows devices directly, but it offers no Kerberos domain, Group Policy or LDAP for older systems. In OT environments a local Active Directory or local accounts therefore usually remain necessary.

Can Entra ID work in an isolated OT network?

No, Entra ID is a cloud service and needs an internet connection for every sign-in. Systems that must keep running when the connection fails, such as HMIs and engineering stations, should therefore not depend on Entra ID.

How do I connect a VPN to Entra ID MFA?

The common route is the NPS extension: the VPN gateway sends a RADIUS request to a Windows NPS server, which checks the password against Active Directory and then calls Entra MFA. This requires an Entra ID P1 or P2 licence. VPN gateways that support SAML or OpenID Connect can also integrate with Entra ID directly.

Which Entra ID licence do I need for Conditional Access?

Conditional Access requires Entra ID P1, which is included in Microsoft 365 E3 and Business Premium, among others. Risk-based policies and Privileged Identity Management require Entra ID P2. Without a paid licence, Entra ID Free only offers security defaults as baseline protection with MFA.

What is the difference between Entra ID and Microsoft Entra?

Microsoft Entra is the product family for identity and network access. Entra ID is its core identity service; other members include ID Governance, External ID, Verified ID, Internet Access and Private Access.

📌 In summary

Entra ID, formerly Azure AD, is Microsoft’s cloud service for identity and access and acts as the central gateway for remote access, management portals and cloud applications in IT/OT environments. With MFA, Conditional Access and PIM, Entra ID supports Zero Trust and the requirements of NIS2 and IEC 62443, but local sign-in within the OT network should not depend on the cloud.