Microsoft Entra ID
Capability scores
Methodology →- Authentication
- 4.5
- SSO & Federation
- 4.5
- Authorization
- 4.0
- Lifecycle & Provisioning
- 4.0
- MFA & Passwordless
- 4.5
- Governance & Audit
- 4.0
- Developer Experience
- 4.0
- Deployment Flexibility
- 3.0
- Pricing Transparency
- 3.0
- Support & Ecosystem
- 5.0
Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.
Overview
Microsoft Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity service and, in 2026, the most widely deployed workforce identity platform, largely because it ships with Microsoft 365. Microsoft's pricing page states that Entra ID P1 is included with Microsoft 365 E3 and Business Premium, and P2 with E5. For any organization already on Microsoft, Entra is the default identity layer, and a strong one rather than a bundled convenience. For customer identity see Microsoft Entra External ID.
What it is good at
Conditional Access is the standout: a policy engine that combines user, device, location, and risk signals, backed by Identity Protection telemetry. Passwordless coverage is broad. The authentication methods overview lists Windows Hello for Business, Platform Credential for macOS, synced passkeys, FIDO2 security keys, passkeys in Microsoft Authenticator, and certificate-based authentication as phishing-resistant. The passkeys documentation lets admins enforce attestation so only device-bound passkeys register. Integration with Microsoft 365, Azure, Intune, and Defender is tighter than any third party can match, and Entra ID Governance adds access reviews and entitlement management.
Where it falls short
Outside the Microsoft world the experience is less polished: third-party SaaS provisioning and federation work, but the catalog and ergonomics trail Okta. Licensing is confusing, with capabilities split across Free, P1, P2, Governance, the Entra Suite and Microsoft 365 bundles, so it is easy to be under-licensed for a feature you assumed you had.
Its scale makes it the main target. CVE-2025-55241 let undocumented Actor tokens impersonate Global Admins across tenants until Microsoft fixed it in July 2025. Recorded incidents include Storm-0558 token forgery, the Midnight Blizzard password spray, and in 2026 token replay into 79 organizations and sign-ins with stolen app secrets. Hybrid shops running AD FS also had to patch CVE-2026-56155, exploited as a zero-day; see AD FS to Entra migration.
Pricing
Free tier plus published per-user prices (checked 2026-11-05, Entra pricing). Entra ID Free comes with an Azure subscription. Entra ID P1 $7, P2 $10, Entra ID Governance $7 and Entra Suite $12 per user per month, paid yearly. P1 is included in Microsoft 365 E3 and Business Premium, P2 in E5. Prices may vary by Microsoft agreement.
Best for, and who should look elsewhere
The obvious choice for Microsoft-centric organizations, where it is usually both cheaper and better integrated than a third party. Consider a neutral platform like Okta or Ping if Microsoft is a minority footprint or you want vendor independence. If only the authenticator is the problem, passwordless specialists such as HYPR, Beyond Identity, Secret Double Octopus and Cisco Duo, or Yubico security keys, can work alongside Entra. See Okta vs Microsoft Entra and Microsoft Entra vs Ping Identity.
Bottom line
If you live in Microsoft 365, Entra is the default and a strong one, provided you invest in Conditional Access and app-credential hygiene. The further you are from the Microsoft stack, the more its advantages fade.
Integrations: see what Microsoft Entra ID documents for clouds, HR systems, SaaS apps and legacy directories in the Identity Integration Matrix.
Breaches involving Microsoft Entra ID
Incidents in our sourced breach database where Microsoft Entra ID was the abused surface or the path in. Inclusion is not a judgement on the product: most record stolen credentials, tokens or misconfiguration on the customer side, and each record says which.
- Actor signs in to Entra ID as applications with stolen client secrets 2026 · Stolen credentials
- Stolen Microsoft 365 session tokens replayed into 79 organizations 2026 · Phishing (adversary-in-the-middle)
- Stolen ConnectWise app credentials open Microsoft 365 tenants across MSP customers 2026 · Third-party access
- JadePuffer wipes Azure resources with compromised service principals 2026 · Exposed secrets
- Password spraying across Chilean Microsoft 365 tenants lands on default-password service accounts 2026 · Password spraying
- Midnight Blizzard password spray into Microsoft corporate email 2024 · Password spraying
- Storm-0558 forged Microsoft tokens to read Exchange Online mail 2023 · Identity infrastructure vulnerability
- AiTM phishing campaign against more than 10,000 Microsoft 365 organizations 2022 · Phishing (adversary-in-the-middle)
Microsoft Entra ID: frequently asked questions
- What passwordless methods does Microsoft Entra ID support?
- Microsoft's authentication overview, updated September 2026, lists six phishing-resistant methods: Windows Hello for Business, Platform Credential for macOS, synced passkeys (FIDO2), FIDO2 security keys, passkeys in Microsoft Authenticator, and certificate-based authentication. Microsoft Authenticator passwordless sign-in and QR code sign-in are also available as primary methods. Admins can enforce attestation in a passkey profile, which allows only device-bound passkeys and excludes synced passkeys such as Apple iCloud Keychain or Google Password Manager.
- What are the alternatives to Microsoft Entra passwordless authentication?
- If you want passwordless sign-in outside Entra, Okta offers FastPass and Passkey (FIDO2 WebAuthn) as phishing-resistant authenticators, and Ping Identity adds Keyless zero-knowledge biometrics. Dedicated passwordless and MFA vendors such as HYPR, Beyond Identity, Secret Double Octopus and Cisco Duo sit in front of or alongside Entra, and Yubico supplies FIDO2 security keys that Entra itself supports. Many Microsoft shops keep Entra as the identity provider and change only the authenticator.
- How much does Microsoft Entra ID cost?
- As of 5 November 2026, Microsoft's Entra pricing page lists Entra ID Free (with an Azure subscription), Entra ID P1 at $7 and P2 at $10 per user per month, Entra ID Governance at $7, and the Entra Suite at $12 per user per month, all paid yearly. P1 is included in Microsoft 365 E3 and Business Premium, and P2 in Microsoft 365 E5. External ID and Verified ID are pay-as-you-go with free monthly allowances.
- Is Microsoft Entra ID secure after the Actor token flaw?
- Microsoft fixed CVE-2025-55241 in the service within days of Dirk-jan Mollema's 14 July 2025 report and published the CVE on 4 September 2025 with no customer action required; Microsoft said it found no evidence of abuse. The flaw let undocumented Actor tokens and a legacy Azure AD Graph validation gap impersonate any user in any tenant. The 2026 Entra incidents in our breach database instead came from customer-side weaknesses: stolen app secrets, replayed session tokens and service accounts without MFA.
Microsoft Entra ID comparisons
More IAM Platform vendors
All IAM Platform →- Okta4.7/5
- Ping Identity4.4/5
- JumpCloud4.3/5
- AWS IAM Identity Center4.2/5
- ForgeRock4.2/5
Related on Start with Identity
- CVESMB Server Kerberos reflection via Ghost SPNs
October 2025 follow-on to CVE-2025-33073. SMB Server elevation of privilege by combining Kerberos reflection with Ghost SPNs and DNS self-registration.
- CVEWindows SMB Client improper authentication (tampering)
Windows SMB Client improper authentication (CWE-287) that allows tampering. Not an Entra token bug, but it sits in the same Microsoft identity-adjacent patch tr
- CVEWindows SMB Kerberos reflection elevation of privilege
Kerberos authentication reflection on SMB, still abusable via Ghost SPNs after the first fix. High-severity elevation of privilege on Windows.
- BlogAzure AD is now Microsoft Entra ID: what actually changed
Microsoft announced the Azure AD to Entra ID rename in July 2023 and finished the visible relabelling by the end of that year. No tenant, protocol, or licence c
- RecipeBreak-glass (emergency access) accounts in Microsoft Entra ID
Set up at least two cloud-only emergency access accounts on the onmicrosoft.com domain with a permanent Global Administrator assignment and FIDO2 passkeys, excl
- GuideConditional Access Policies: A Complete Implementation Guide for Microsoft Entra
Master Microsoft Entra conditional access with risk-based policies, device compliance rules, location-based restrictions, and real-world deployment patterns.
By SWI Community Team · Last evaluated 2026-11-05
Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.