Describe the capabilities of Microsoft Entra
Microsoft Entra ID and Identity Types
CoreRecognize Microsoft Entra ID, human and nonhuman identities, agent ID, and hybrid identity.
Aligned to the SC-900 skills measured as of July 28, 2026; product behavior verified September 10, 2026.
Why this matters
Microsoft Entra ID supplies the cloud identity foundation used to authenticate and control access across Microsoft and connected applications, including emerging AI-agent identities.
Must Know
- Microsoft Entra ID is Microsoft's cloud-based identity and access management service for users, devices, workloads, applications, and resources.
- User identities represent people; device identities represent devices; workload identities represent software such as applications, services, scripts, or containers.
- Agent identities represent AI agents that act autonomously or on behalf of users. Microsoft Entra Agent ID provides identity constructs to authenticate, authorize, govern, and protect agent identities.
- Hybrid identity connects on-premises directory identities with Microsoft Entra ID so a person can use a common identity across environments.
- Identity type describes what the principal represents; it does not by itself grant permission.
Compare and Distinguish
- User vs device vs workload vs agent identity: person, device, software workload, or AI agent.
- Microsoft Entra ID vs Active Directory Domain Services: cloud identity and access management versus traditional domain directory services.
- Hybrid identity vs cloud-only identity: connected on-premises and cloud identity lifecycle versus an identity created and managed only in the cloud.
- Identity vs role: the identity is the principal; the role supplies permissions.
Scenario examples
- A cloud application is represented by a workload identity instead of using an employee account.
- An AI agent receives its own governed identity so its activity and access are distinguishable from the sponsoring user.
- An employee uses an identity connected from an on-premises directory to access Microsoft cloud resources.
Exam traps
- Agent identities are not merely renamed user accounts.
- A managed identity or service principal represents a workload, not a human administrator.
- Hybrid identity does not mean every directory object or credential must be identical in both environments.
- Creating an identity does not authorize it to every resource.
Key takeaways
- Microsoft Entra ID is the cloud IAM foundation.
- Classify identities by the entity they represent.
- Agent ID brings lifecycle, governance, and protection to AI-agent identities.
- Hybrid identity bridges on-premises and cloud identity.
Ready for the quiz?
- Which identity type represents an application?
- What is distinctive about an agent identity?
- What problem does hybrid identity address?
Related objectives
- D2.1.S1 — Describe Microsoft Entra ID
- D2.1.S2 — Describe types of identities, including agent ID
- D2.1.S3 — Describe hybrid identity