TopolearnEvery sign-in to Azure, human or machine, is an Entra ID identity, so you need to know the kinds.
Microsoft Entra ID (formerly Azure Active Directory) is the cloud identity provider behind Azure, Microsoft 365 and your own apps. A tenant is one directory with its own users, groups and applications.
The identity types you meet in Azure:
- Users: people, either members of the tenant or invited guests (B2B).
- Groups: collections of users and other principals. Assign access to groups, not individuals.
- App registration: the global definition of an application (its client ID, redirect URIs, secrets or certificates, API permissions).
- Service principal: the instance of an app inside a tenant, the thing you actually grant roles to. Creating an app registration creates its service principal in the home tenant ("Enterprise applications" in the portal).
- Managed identity: a special service principal whose credentials Azure manages for you (covered later).
Keep two separate permission systems apart. Entra roles (Global Administrator, User Administrator) control the directory itself. Azure RBAC roles (Owner, Contributor, Reader) control Azure resources. A Global Administrator has no access to subscriptions by default.
Entra ID speaks OAuth 2.0 and OpenID Connect: clients obtain access tokens for a resource (audience), such as https://management.azure.com/ for ARM or https://vault.azure.net for Key Vault.
Example
az ad signed-in-user show --query "{upn:userPrincipalName, id:id}"
# Group to assign access to
az ad group create --display-name "orders-devs" --mail-nickname orders-devs
# App registration + its service principal
APP_ID=$(az ad app create --display-name orders-ci --query appId -o tsv)
az ad sp create --id "$APP_ID"
# Get an access token for ARM, as the signed-in identity
az account get-access-token --resource https://management.azure.com/ --query expiresOnRemember
- A tenant is one Entra ID directory
- App registration = global definition; service principal = its identity in a tenant
- Entra roles govern the directory; Azure RBAC roles govern resources
- Grant access to groups, not individual users
Watch out for
- Assuming a Global Administrator can manage subscriptions: they must first elevate access or be granted an Azure role.