Describe the capabilities of Microsoft Entra
Microsoft Entra ID and Identity Types
CoreRecognize Microsoft Entra ID, human and nonhuman identities, workload identities, and hybrid identity.
Aligned to the SC-900 skills measured as of October 21, 2026; product behavior verified October 30, 2026.
Why this matters
Microsoft Entra ID supplies the cloud identity foundation used to authenticate and control access across Microsoft and connected applications, including the software workloads that need identities of their own.
Must Know
- Microsoft Entra ID is Microsoft's cloud-based identity and access management service for users, devices, workloads, applications, and resources.
- User identities represent people; device identities represent devices; workload identities represent software such as applications, services, scripts, or containers.
- In Microsoft Entra, workload identities are applications, service principals, and managed identities. A managed identity is a type of service principal that removes the need for developers to manage credentials.
- Hybrid identity connects on-premises directory identities with Microsoft Entra ID so a person can use a common identity across environments.
- Identity type describes what the principal represents; it does not by itself grant permission.
Compare and Distinguish
- User vs device vs workload identity: person, device, or software workload.
- Microsoft Entra ID vs Active Directory Domain Services: cloud identity and access management versus traditional domain directory services.
- Hybrid identity vs cloud-only identity: connected on-premises and cloud identity lifecycle versus an identity created and managed only in the cloud.
- Identity vs role: the identity is the principal; the role supplies permissions.
Scenario examples
- A cloud application is represented by a workload identity instead of using an employee account.
- A CI/CD pipeline uses a service principal to deploy a web app, so the deployment does not depend on an employee account.
- An employee uses an identity connected from an on-premises directory to access Microsoft cloud resources.
Exam traps
- Device and workload identities are both nonhuman, but a device identity represents a device and a workload identity represents software.
- A managed identity or service principal represents a workload, not a human administrator.
- Hybrid identity does not mean every directory object or credential must be identical in both environments.
- Creating an identity does not authorize it to every resource.
Key takeaways
- Microsoft Entra ID is the cloud IAM foundation.
- Classify identities by the entity they represent.
- Workload identities give software its own identity instead of an employee account.
- Hybrid identity bridges on-premises and cloud identity.
Ready for the quiz?
- Which identity type represents an application?
- What removes the need for developers to manage a workload’s credentials?
- What problem does hybrid identity address?
Related objectives
- D2.1.S1 — Describe Microsoft Entra ID
- D2.1.S2 — Describe types of identities, including workload identities
- D2.1.S3 — Describe hybrid identity