Demystifying Microsoft Entra ID, Tenants and Azure Subscriptions

Introduction

As a startup or a new customer exploring Microsoft Azure, you may find the terminology around identity and access management a bit perplexing. Terms like Tenant, Subscription, and Microsoft Entra ID, are crucial to understanding how to effectively manage and secure your Azure environment. This blog post aims to demystify these concepts and provide a clear, concise understanding of how they interrelate.

What is Microsoft Entra ID (former Azure Active Directory)?

Microsoft Entra ID is the new name for Azure Active Directory (AAD), Microsoft's cloud-based identity and access management service. It plays a crucial role in managing user, group, and application access to Azure services. Here’s a breakdown:

• Identity Management: Entra ID handles both authentication (verifying identity) and authorization (granting access) for Azure resources.
• Cloud-Based: Unlike traditional Active Directory, which is designed for on-premises environments, Entra ID operates entirely in the cloud, making it ideal for modern, cloud-first organizations.

Key Features:

• User and Group Management: You can create users and groups within your Entra ID tenant. These identities can be synchronized with your existing on-premises Active Directory using Entra Connect.
• Single Sign-On (SSO): Provides a seamless sign-on experience across multiple applications and services.

What is an Entra Tenant?

An Entra Tenant represents a dedicated instance of Microsoft Entra ID for your organization. It is essentially your organization’s space in the Azure cloud where you manage your identities and access.

Key Points:

• Created Automatically: When you sign up for Azure or any Microsoft cloud service, a tenant is automatically created.
• Domain Representation: By default, your tenant will have a domain like yourcompany.onmicrosoft.com, which can be customized to use your own domain. (You can also add and replace your on.microsoft.com fallback domain)

What is an Azure Subscription?

An Azure Subscription is a logical container used to provision and manage Azure resources. It is closely tied to billing and acts as a boundary for resource management and deployment.

Key Characteristics:

• Resource Management: All Azure resources (e.g., virtual machines, databases) are associated with a subscription.
• Billing: Each subscription has its own billing cycle and payment terms, allowing you to manage costs effectively.
• Scalability: Best practice is to have separate subscriptions for production and non-production environments to manage permissions and scalability efficiently.

Relation to Tenant:

• A single Azure tenant can manage multiple subscriptions, but each subscription is associated with only one tenant.

How they work together

• Automatic creation of Entra ID Tenant:
  
  • When you create an Azure subscription, an Entra ID tenant is automatically provisioned. This tenant manages identities and access within your subscription.
• Authentication and authorization:
  
  • Azure subscriptions rely on Entra ID to authenticate and authorize users, services, and devices, ensuring that only authenticated identities can access Azure resources.
• Role-Based Access Control (RBAC):
  
  • Azure Roles: Used for managing access to Azure resources within a subscription. Examples include Owner, Contributor, and Reader. Custom roles can also be created for more granular control. See here some best practices for Azure RBAC 
  • Entra Roles (Former AAD Roles): Specific to managing Entra ID resources, such as Global Administrator and User Administrator. See here how Entra Roles and Azure Roles are related.
• Multi-subscription management:
  
  • A single Entra ID tenant can manage multiple subscriptions, enabling the same set of users and groups to access different environments. However, each subscription is associated with only one tenant.

Practical tips for startups

• Benefit from the Azure setup guide:
  
  • Before you start building and deploying solutions by using Azure services, you need to prepare your environment. In this guide, we introduce features that help you organize resources, control costs, and secure and manage your organization. You can access it directly from the Azure Portal too.
• Start with a clear structure:
  
  • Separate Subscriptions: Use separate subscriptions for production and non-production environments to ensure better management and segregation of resources.
• Define roles:
  •  Clearly define and assign Azure Roles and Entra ID Roles to manage permissions effectively.
• Synchronize identities:
  
  • If you have an existing on-premises AD, use Entra Connect to synchronize identities with Entra ID, ensuring seamless access management.
• Plan for scalability:
  
  • Design your subscription architecture to accommodate growth. Consider factors like billing, resource limits, and administrative boundaries.
• Use enterprise scale landing zones:
  
  • Implement recommended modular design to ensure your Azure environment can scale efficiently with your business needs.

Follow the links below if you are familiar with AWS and would like to understand how to map AWS concepts to Azure:

• Azure and AWS accounts and subscriptions
• Mapping AWS IAM concepts to similar ones in Azure
• Azure for AWS professionals

Conclusion

Understanding Microsoft Entra ID, Azure Subscriptions, and Tenants is essential for effective Azure governance. These concepts form the backbone of identity and access management in Azure, ensuring secure, scalable, and efficient management of your cloud resources. As your startup grows, mastering these basics will help you optimize your Azure environment, supporting your journey towards innovation and success.

For more detailed information, always refer to the latest Microsoft Azure documentation and best practices. 

Reference: What is Microsoft Entra ID?