9. Glossary and Cheatsheet

The ten-second lookup: every term from this topic in one line, the commands you'll actually type, the identifier shapes, and the limits worth memorising.

Glossary

Access token — A JWT proving authorisation to a specific API, identified by the aud claim. Validated offline by the resource. Short-lived.

Administrative unit (AU) — A container of directory objects that scopes a directory role to a subset of the tenant. The nearest thing Entra ID has to an AD organisational unit, but it scopes roles, not policy.

AD DS (Active Directory Domain Services) — The on-premises LDAP/Kerberos directory. Not Entra ID. Synchronised into Entra ID with Entra Connect Sync or Cloud Sync.

Admin consent — Granting an application its requested permissions tenant-wide, for all users. Always required for application permissions.

App registration — The global definition of an application: client ID, redirect URIs, credentials, requested permissions, published scopes and app roles. applications in Microsoft Graph.

App role — A permission an application publishes, assignable to users, groups, or other applications. Emitted in the roles claim. The robust alternative to authorising on group membership.

Application (client) ID — The GUID identifying an app registration globally. Not the object ID; not what role assignments use.

Application permission — A permission exercised without a signed-in user, tenant-wide, with no user-rights ceiling. Always admin-consented. Emitted in roles.

Authentication strength — A Conditional Access control requiring a specific class of authentication method (e.g. phishing-resistant), rather than a blunt "require MFA".

Authority — The URL segment identifying which directory to authenticate against: a tenant GUID, a verified domain, organizations, common, or consumers. A real security control.

Azure AD — The former name of Microsoft Entra ID (renamed 2023). Same product, same APIs.

Azure RBAC — The authorisation system for Azure resources, stored in ARM. Separate from directory roles. See foundations.

B2B collaboration — Inviting identities from other organisations as guests, so their home tenant owns the credential and the offboarding.

Backup authentication service — Microsoft's secondary token path that can serve some requests when the primary is unhealthy. Reduces, doesn't eliminate, identity-outage impact.

Break-glass account — A cloud-only emergency administrator account excluded from all Conditional Access, stored offline, alerted on when used. Two of them. Tested.

CAE (Continuous Access Evaluation) — Participating resources subscribe to critical events and reject tokens in near-real-time instead of waiting for expiry. The fix for revocation latency.

Claim — A field in a token. The ones to know: tid, oid, sub, aud, iss, appid, scp, roles, amr, exp.

Client secret — A string credential on an app registration, with an expiry. The weakest option; avoid in production.

Conditional Access — The policy engine evaluated at token issuance, combining assignments (users, apps, conditions) with grant and session controls. Requires P1. All policies evaluate; blocks always win.

Consent — Granting an application its requested permissions, by a user for themselves or by an admin tenant-wide. The mechanism behind illicit consent grant attacks.

Delegated permission (scope) — A permission exercised on behalf of a signed-in user. Effective access is the intersection of app grant and user rights. Emitted in scp.

Device identity — Entra registered (BYOD), Entra joined (cloud-only corporate), or Entra hybrid joined (also joined to on-premises AD DS).

Directory role — A role granting authority over directory objects (Global Administrator, User Administrator, Application Administrator). Distinct from Azure RBAC.

Dynamic group — A group whose membership is derived from a rule over attributes. Requires P1. Evaluation is asynchronous and can lag.

Easy Auth — App Service Authentication: platform middleware that handles the OIDC flow and injects claims as headers. Authenticates; does not authorise.

Entitlement management — Access packages bundling applications, groups, and an expiry into a requestable, approvable unit. Part of Entra ID Governance.

Entra Connect Sync / Cloud Sync — The two agents that synchronise on-premises AD DS into Entra ID. Heavyweight and lightweight respectively.

Entra Domain Services — A managed AD DS domain, and a real Azure resource. For workloads that need LDAP or Kerberos.

Entra External ID — Formerly Azure AD B2C. The customer-facing identity product, billed per monthly active user.

Enterprise application — The portal's name for a service principal. Same object, different blade.

Federated identity credential — A credential on an app registration trusting an external OIDC issuer, matched on issuer, subject, and audience. The basis of workload identity federation. No secret.

Global Administrator — The highest directory role. Not the same as Azure Owner. Target: two break-glass accounts and no permanent humans.

Group overage claim — When group memberships exceed the token limit (~150 SAML / ~200 JWT ⚠️ verify), the groups claim is replaced by _claim_names/_claim_sources pointing at Graph. Breaks apps for heavily-permissioned users.

Guest — A user with userType: Guest, invited from another directory. Credential and MFA live in their home tenant.

ID token — An OIDC token proving authentication to the client application. Never sent to an API.

Identity Protection — Risk detection and risk-based Conditional Access. Requires P2.

JWKS endpoint — Where resources fetch the tenant's token signing keys, discoverable from the OIDC metadata document. Cached, which is why validation is offline.

Legacy authentication — Protocols that can't do MFA (POP, IMAP, SMTP AUTH, older Office clients). Block them.

Managed identity — A service principal whose credentials Azure creates and rotates. System-assigned (tied to one resource) or user-assigned (its own ARM resource, shareable, survives recreation).

Member — A user native to this tenant, as opposed to a guest.

Microsoft Graph — The API for directory objects. Entra ID's control plane. https://graph.microsoft.com.

Microsoft Graph PowerShell — The current PowerShell module for Entra ID. The AzureAD and MSOnline modules are retired.

Multi-tenant application — One app registration in the vendor's tenant, one service principal per customer tenant created on consent. Must validate tid against an allow-list.

Named location — A defined set of IP ranges or countries used as a Conditional Access condition.

Object ID (oid) — The GUID identifying a directory object. The stable identifier, and what role assignments reference. Not the client ID, not the UPN.

OIDC / OAuth 2.0 — The protocols. OIDC handles authentication (ID token); OAuth 2.0 handles authorisation (access token).

Overage claim — See group overage claim.

PIM (Privileged Identity Management) — Eligible, time-bound, approval-gated role activation with an audit trail. Requires P2.

PHS / PTA / Federation — The three on-premises authentication topologies. Password hash sync survives your own datacentre failing; the other two don't.

PKCE — Proof Key for Code Exchange. Required alongside the authorisation code flow for public clients; use it everywhere.

Primary Refresh Token (PRT) — A device-bound token that lets a joined device sign in silently. Why corporate laptops don't prompt.

Refresh token — Obtains new access tokens without re-authenticating. Revocable; never leaves the client.

Report-only mode — A Conditional Access policy that is fully evaluated and logged but not enforced. Where every new policy starts.

Restricted management administrative unit — An AU whose members can only be managed by designated admins, protecting sensitive objects from otherwise-privileged roles ⚠️ verify current licensing.

SCIM — The provisioning protocol that creates and deletes accounts in SaaS applications. The other half of SSO — without it, offboarding removes access but leaves the account.

Scope — Two meanings, unfortunately: (1) a delegated permission, appearing in scp; (2) the level a role assignment applies at. Context disambiguates.

Security defaults — Free, all-or-nothing baseline protection (MFA for everyone, legacy auth blocked). Mutually exclusive with Conditional Access policies.

Service principal — The local identity of an application in one tenant, holding consent and role assignments. Called "enterprise application" in the portal. servicePrincipals in Graph.

Smart lockout — Distinguishes real users from password-spray attempts and locks the attacker rather than the account.

Soft delete — Deleted users, groups, applications, and service principals are recoverable for a retention window (~30 days ⚠️ verify), still consuming quota and still holding their names.

Tenant — One isolated Entra ID directory: the boundary for identity, policy, and licensing. Identified by a GUID and one or more verified domains.

Tenant ID (tid) — The GUID identifying the tenant, present in every token. Multi-tenant apps must validate it.

UPN (User Principal Name) — The sign-in name, alice@contoso.com. A display attribute — never key your data on it. Use oid.

Verified domain — A DNS domain proven to belong to the tenant via a TXT record, enabling UPNs in that domain. Managed or federated.

Workload identity — A service principal or managed identity representing an application rather than a person. The population nobody offboards.

Workload identity federation — Exchanging an external OIDC token for an Azure token, with no stored secret. The correct answer for CI/CD, AKS, and cross-cloud.

Cheatsheet — the commands you'll actually type

# --- who am I, really ---
az ad signed-in-user show --query "{upn:userPrincipalName, oid:id}" -o table
az account show --query "{tenant:tenantId, sub:id, user:user.name}" -o table

# --- applications and service principals ---
az ad app create --display-name my-app
az ad app list --display-name my-app --query "[].{name:displayName, clientId:appId, objId:id}" -o table
az ad sp create --id "$CLIENT_ID"                       # SP for an existing registration
az ad sp show --id "$CLIENT_ID" --query id -o tsv       # the OBJECT id — what roles need
az ad app credential reset --id "$CLIENT_ID" --years 1  # rotate a secret (prints the new one once)
az ad app federated-credential create --id "$CLIENT_ID" --parameters fic.json  # no secret at all

# --- users and groups ---
az ad user show --id alice@contoso.com --query "{oid:id, upn:userPrincipalName}" -o table
az ad group create --display-name app-readers --mail-nickname app-readers
az ad group member add --group app-readers --member-id "$OBJECT_ID"
az ad group member list --group app-readers --query "[].userPrincipalName" -o tsv

# --- permissions and consent ---
az ad app permission add --id "$CLIENT_ID" \
  --api 00000003-0000-0000-c000-000000000000 \
  --api-permissions e1fe6dd8-ba31-4d61-89e7-88639da4683d=Scope     # User.Read
az ad app permission admin-consent --id "$CLIENT_ID"               # needs a privileged role
az ad sp show --id 00000003-0000-0000-c000-000000000000 \
  --query "oauth2PermissionScopes[].{value:value,id:id}" -o table   # look up Graph scope GUIDs

# --- role assignments (this is ARM, not the directory) ---
az role assignment create \
  --assignee-object-id "$OBJECT_ID" --assignee-principal-type ServicePrincipal \
  --role "Key Vault Secrets User" --scope "$RESOURCE_ID"
az role assignment list --assignee "$OBJECT_ID" --all -o table
az role assignment list --all --query "[?principalName==null]" -o table   # find the orphans

# --- tokens: the fastest debugging tool you have ---
az account get-access-token --resource https://graph.microsoft.com --query accessToken -o tsv
az account get-access-token --resource https://vault.azure.net --query accessToken -o tsv
# paste into jwt.ms and read aud / iss / tid / oid / scp / roles / exp

# --- incident response ---
az ad user update --id alice@contoso.com --account-enabled false
az ad user revoke-sign-in-sessions --id alice@contoso.com   # tokens survive a disable; this kills them

# --- soft delete ---
az ad app list --show-deleted --query "[].{name:displayName, deleted:deletedDateTime}" -o table

# --- raw Graph, for everything the CLI doesn't wrap ---
az rest --method GET --url "https://graph.microsoft.com/v1.0/me"
az rest --method GET --url "https://graph.microsoft.com/v1.0/applications?\$select=displayName,appId"

# Microsoft Graph PowerShell — the current module (AzureAD and MSOnline are RETIRED)
Connect-MgGraph -Scopes "Application.ReadWrite.All","Directory.Read.All"
Get-MgContext
$app = New-MgApplication -DisplayName "my-app"
$sp  = New-MgServicePrincipal -AppId $app.AppId
Revoke-MgUserSignInSession -UserId alice@contoso.com
Get-MgDirectoryDeletedItemAsApplication          # soft-deleted apps

Identifier and endpoint shapes

Entra ID has no ARM resource ID for its own objects — the reason from What & Why, now as a set of URLs.

# Directory object (Microsoft Graph) — the control plane
https://graph.microsoft.com/v1.0/applications/{objectId}
https://graph.microsoft.com/v1.0/servicePrincipals/{objectId}
https://graph.microsoft.com/v1.0/users/{objectId}

# Token endpoints — the data plane
https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/authorize
https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token
https://login.microsoftonline.com/{tenantId}/v2.0/.well-known/openid-configuration
https://login.microsoftonline.com/{tenantId}/discovery/v2.0/keys

# The ARM resources that DO have IDs
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{name}
{scope}/providers/Microsoft.Authorization/roleAssignments/{guid}

Well-known GUIDs worth recognising on sight:

GUID	What it is
00000003-0000-0000-c000-000000000000	Microsoft Graph (the application)
00000002-0000-0000-c000-000000000000	Azure AD Graph — deprecated, retired
797f4846-ba00-4fd7-ba43-dac1f8f63013	Azure Resource Manager
62e90394-69f5-4237-9190-012177145e10	Global Administrator (directory role template)
api://AzureADTokenExchange	The audience for federated identity credentials

Limits worth memorising — with their scope

A number without a scope is useless in Azure. ⚠️ Verify all figures against current Azure docs before designing around them; several vary by tenant type and licence.

Limit	Scope	Rough value
Directory objects	Per tenant	Hundreds of thousands, raisable via support
Objects created by one non-admin user	Per user	Small (tens–hundreds)
Groups per user	Per user	Large but finite
Owners per app or group	Per object	A handful
Custom directory roles	Per tenant	Low hundreds; requires P1
Conditional Access policies	Per tenant	Low hundreds
Group claims before overage	Per token	~150 SAML / ~200 JWT
Graph request budget	Per app, per tenant, per resource type	Sliding window; 429 + Retry-After
Soft-delete retention	Per object	~30 days
Access token lifetime	Per token	~60–90 min, longer if CAE-aware

The five things to remember if you remember nothing else

1. Authentication is not authorisation. Entra ID issues the token; Azure RBAC, directory roles, and app roles decide what it can do.
2. The object ID is the identifier. Not the client ID, not the UPN, not the display name.
3. Tokens are validated offline, which is why revocation lags and why CAE exists.
4. Control-plane roles don't grant data-plane access — Contributor on a storage account can't read a blob.
5. Managed identity inside Azure, workload identity federation outside, secrets nowhere.

---

That's the topic. If you want the reverse direction — every service that consumes these tokens — start from Integrations, or go back to the article contents.

← Back to the Microsoft Entra ID overview · ← Previous: Interview Questions