We have been using Microsoft Enterprise for ten years, and we actually started beginning to really use it about two years ago. Earlier, we had an access manager on the premises, but everything is moving to the cloud. So we are moving our access management and identity management solutions to the cloud as well.
The whole access management solution is valuable. In 2015, we were selecting a new access management solution, and because it was already integrated, we started using it.
Integration with Defender allows us to get alerts and respond to them by blocking users. Microsoft Entra ID has streamlined and centralized our device management and threat response processes.
We are looking for more customization with BRAIN and everything else, and while they are following up on that, we want some more of it.
We have experienced some downtime because of the use of the data centers.
In Microsoft technical support or Microsoft Denmark, we have an account manager and strategist, whom we contact along with the suppliers who have their own technicians. The experience has been positive.
Earlier, we had an access manager on the premises before moving to Microsoft Enterprise for cloud-based solutions. In 2015, we selected a different access management solution initially.
Would you rate the overall solution on a scale of 1 to 10? Yeah, excellent. From one to ten, would you mind the call? I think, yeah, excellent.
Entra ID is used to authenticate users and applications.
Entra ID has helped us implement role-based authentication rather than conditional keys. It has made our entry point and access more secure. Entra has improved our Zero Trust platform, but I can't go into the details about how.
It has improved our attack response slightly because we now have a better idea of what's happening and what we see in the logs.
Entra ID provides an excellent overview of the applications and the options applied to them.
There are areas for improvement, particularly when moving between tenants. If we create a new tenant and try to set it up under the same organization, it becomes extremely difficult. A recent incident we dealt with took four months to resolve with a seven-day deadline, which was quite frustrating.
I have used Entra since it was released, and we also used Azure AD before it got renamed.
Stability has been questionable sometimes. We've had a few outages which have caused us some concern, and it's a critical solution that we can't do without.
There isn't much that can be done for scalability other than considering an alternative provider, which we have thought about at times.
I rate Microsoft support eight out of 10 in general, but they let us down when we were moving tenants. We were pretty upset with them.
Positive
We always used Azure AD and then Microsoft Entra ID.
Overall, some areas showed more return on investment, while others less so.
I rate Entra ID eight out of 10.
Our primary use case for this solution is identity and access management within our organization's hybrid cloud environment. We have a multinational presence across 12 countries, with around three thousand employees worldwide. Entra ID plays a pivotal role in streamlining user onboarding and offboarding processes, ensuring secure access to our resources.
Our environment is characterized by a blend of on-premises and cloud-based services, and Entra ID seamlessly integrates with our Azure tenant. It allows us to efficiently manage user identities, enforce authentication and authorization policies, and implement multifactor authentication for enhanced security.
Moreover, we leverage Entra ID's capabilities to maintain compliance with specific regulations, such as those in Germany, where mailbox access for departed employees requires careful management. Entra ID's security features, including Azure Information Protection integration, provide an additional layer of protection against evolving cyber threats.
Microsoft Azure Entra ID has been a transformative addition to our organization, bringing a multitude of benefits and enhancements across various facets of our operations. Here are the key ways in which Entra ID has made a significant difference:
Unified User Access and Seamless Experience:
Entra ID provides a unified interface for managing user access, offering an exceptionally user-friendly experience. Users can effortlessly access a wide range of applications, both cloud-based and on-premises, using a single set of credentials. The Azure portal serves as a true portal, creating a distinct realm for users while maintaining a user-friendly interface. Single Sign-On (SSO) configuration simplifies the login process, allowing users to use a single ID for multiple applications. This streamlined approach, coupled with multifactor authentication, ensures a secure and convenient login experience, especially important in today's remote work environment.
Efficient Policy Management:
One of the standout features of Entra ID is the ease with which Azure policies and conditional access can be applied to enhance security. The EntraID admin center serves as a central hub for cloud-based identity and access management, offering a wide array of features that not only enhance security but also promote collaboration and productivity within the organization.
Modern Authentication Protocols:
Entra ID employs modern authentication protocols like OpenID Connect, which are well-suited for web and mobile users. This is especially crucial in an era where remote work and mobile device usage are prevalent. It represents a significant improvement over the traditional Windows Active Directory, which relied solely on Kerberos and NTLM.
Hybrid Capabilities:
Entra ID's support for hybrid scenarios is invaluable. It caters to the preferences of employees who still rely on on-premises solutions while leveraging the advantages of the cloud. This flexibility in a hybrid environment is a substantial benefit.
Conditional Access for Enhanced Security:
Conditional access policies, akin to "if-then" scenarios, provide granular control over access conditions. These policies evaluate login attempts based on factors such as user location, device health, and more. This ensures that access is granted only under specific, predefined conditions, significantly bolstering security.
Role-Based Access Control (RBAC):
Entra ID offers a robust RBAC system that allows precise management of access permissions. Custom roles can be created, granting users only the necessary permissions, enhancing security without overexposure.
Cost-Effective Scalability:
The cost-effectiveness of Entra ID is notable. It offers a free option, making it accessible to organizations of various sizes. Premium plans unlock advanced features, such as identity protection and advanced threat detection, providing excellent value for the investment.
Enhanced User Experience:
Entra ID has substantially improved the user experience. Account creation and provisioning are straightforward, even more streamlined than traditional Windows Active Directory. This inclusive process involves licensing, role, and permission configuration, all within a unified interface.
Microsoft Azure Entra ID has significantly enhanced our organization's security, user experience, and efficiency. Its modern authentication, conditional access, and RBAC capabilities, along with its support for hybrid environments, make it a valuable addition to our IT ecosystem. Moreover, the cost-effectiveness of Entra ID and its role in simplifying identity and access management have further solidified its value proposition. Our users are more satisfied than ever, thanks to the improvements brought about by this powerful solution.
The standout features of Microsoft Entra ID, for me, revolve primarily around its robust security measures. As someone deeply invested in cloud security, these aspects have proven to be exceptionally valuable.
Conditional Access Policies: The ability to formulate and enforce conditional access policies is a game-changer. It allows us to implement highly granular access control, considering factors like user location, device health, and authentication methods. This level of flexibility ensures that access to critical resources is granted only under the appropriate circumstances, enhancing our security posture significantly.
Identity Protection: Microsoft Entra ID's identity protection capabilities are commendable. They assist us in safeguarding user identities, reducing the risk of unauthorized access and identity-related security breaches. The peace of mind that comes with knowing our identities are well-protected is invaluable.
Threat Intelligence: Real-time threat intelligence provided by Entra ID equips us with the necessary tools to stay ahead of emerging security threats and vulnerabilities. In a rapidly evolving threat landscape, having this information at our fingertips is indispensable.
These security features, coupled with a user-friendly interface and seamless integration, make Microsoft Entra ID an exhilarating solution for those of us who prioritize cloud security. It not only enhances our security posture but also empowers us to adapt and respond effectively to evolving cybersecurity challenges.
Privileged Identity Management (PIM) Performance: Improvements in the performance and reliability of PIM are crucial. Users occasionally encounter issues where roles are elevated, but the assigned roles do not function as expected. Enhancing the consistency and responsiveness of PIM is essential for a seamless privilege management experience.
Portal Speed and Responsiveness: Addressing occasional slowdowns, particularly on Fridays, within the Azure Entra ID portal is important. Consistent portal performance ensures efficient user access management and administration.
Cross-Tenant Synchronization and Collaboration: Simplifying cross-tenant synchronization and collaboration is essential for organizations working in multi-tenant environments. Enhancements in this area can streamline identity and access management processes across tenants, reducing complexity and improving collaboration.
User Offboarding and SharePoint Permissions: Streamlining the offboarding process for former employees is critical. After disabling or deleting a former employee's account, there should be an automatic mechanism to remove associated permissions in SharePoint. Currently, these permissions often remain in SharePoint as stale entries, requiring manual removal. Automating this process can improve security and reduce administrative overhead.
I have been using Microsoft Entra ID for six and a half years.
The Entra ID system has consistently demonstrated a high level of stability. Throughout our usage, I can't recall a single instance when the service experienced downtime. This underscores Microsoft's commitment to ensuring the continuous functionality of the service for its customers.
The stability of Entra ID is crucial for our operations, and its reliability has greatly contributed to our confidence in the platform. Microsoft's dedication to maintaining a stable environment aligns with the expectations of organizations relying on their services.
In summary, the stability of the Entra ID system has been commendable, and it reflects Microsoft's emphasis on delivering a reliable experience to its users.
Scalability in the context of Entra ID has been a significant advantage, particularly when compared to traditional on-premises solutions. The scalability of Entra ID is dependent on both the hardware and the underlying infrastructure. In the case of on-premises servers, organizations are tasked with maintaining and upgrading the hardware, which can be resource-intensive.
What I've observed with Entra ID is that it offers exceptional scalability and reliability. This scalability is achieved through a combination of factors, including built-in redundancy and automatic updates. Microsoft takes on the responsibility of managing the underlying infrastructure, alleviating the maintenance burden on organizations.
This level of scalability allows us the flexibility to easily scale our resources up or down based on our specific requirements. Whether we need to accommodate growth or adjust resources to optimize costs, Entra ID provides the agility needed to achieve our goals.
In essence, the scalability of Entra ID is of the highest quality, and it's a testament to the benefits of utilizing a cloud solution like Azure. The cloud-based approach simplifies resource management and ensures that we can efficiently adapt to changing demands.
We've encountered occasional issues, and Microsoft's customer service and support have consistently been friendly and responsive. Whenever we've reached out to them, they've promptly assisted us in resolving our problems.
One notable aspect is that Microsoft support typically prefers phone calls or emails for communication. While their support is effective, we've found that using Microsoft Teams for support calls would be much more convenient. Teams provides an efficient and collaborative platform for communication, making it a valuable tool for resolving issues.
This highlights the opportunity for Microsoft to enhance customer support by utilizing Teams for more convenient and efficient interactions.
Positive
The initial setup of Entra ID is remarkably straightforward. The system seamlessly integrates within our existing infrastructure, requiring nothing more than an Azure tenant.
In terms of the migration process, we prioritize quality over quantity. We don't need a large workforce for the migration; instead, we value individuals who possess a clear understanding of their roles and responsibilities. This approach is supported by a well-established product line and effective risk management strategies. Additionally, our past experiences and insights gained from previous projects significantly contribute to our confidence and comprehension of the necessary actions.
In collaboration with our partners, our team consists of five members dedicated to the migration process. Our partners, on the other hand, have a smaller team comprising three individuals providing assistance. This collaborative effort ensures a smooth and efficient transition to Entra ID.
We worked with a Cloud Solution Provider (CSP) with many years of experience with the product to successfully implement Entra ID
Our investment in Entra ID has undoubtedly yielded a significant return. Those familiar with its capabilities and accompanying features are confident in the tangible benefits it brings. In a landscape where cloud advancements have revolutionized IT, Entra ID stands out as a crucial component of our infrastructure.
Without this cloud product and the transformative developments in cloud technology, navigating the IT landscape would be challenging. We'd likely find ourselves exploring various products from different companies, potentially incurring higher costs than our current investment in Entra cloud products.
Therefore, I have full confidence that we've achieved a substantial return on investment through our adoption of Entra ID and other cloud solutions. It's a testament to the value and cost-efficiency that modern cloud technologies offer to organizations.
When it comes to setup cost, pricing, and licensing for Entra ID, I would advise others to carefully assess their organization's specific needs and requirements. It's essential to have a clear understanding of the features and capabilities needed to support your business operations effectively.
Consider the scalability of your organization and how Entra ID aligns with your growth plans. Microsoft offers various licensing options, so it's worth exploring the most suitable licensing model that fits your budget and operational demands.
Additionally, keep in mind that while initial setup costs may vary, the long-term benefits of a secure and efficient identity management solution like Entra ID can significantly outweigh the initial investment. It's an investment in both security and productivity.
Lastly, stay updated with Microsoft's licensing updates and pricing changes to ensure that your organization remains compliant and optimized in terms of cost-effectiveness."
This advice provides a general guideline for organizations considering Entra ID, encouraging them to conduct a thorough evaluation of their needs and resources.
Our organization has a strong Microsoft orientation, which naturally led us to align our infrastructure with Microsoft standards. Entra ID serves as our identity provider, handling crucial processes like onboarding, offboarding, and managing departed employees' accounts and devices.
One challenge we've encountered is dealing with "stale devices" connected to Entra ID when employees have left the company. To address this, we regularly execute scripts to identify and manage both dormant accounts and devices. Compliance policies, especially in countries like Germany, necessitate specific mailbox access rules for departed employees. This involves granting the manager access to the mailbox for three months before archiving it. Deleting the user account isn't an option in such cases.
Entra ID offers a health dashboard that helps us track maintenance activities and pending implementations. Key updates, recommended every three months by Microsoft, are currently performed on a monthly basis to maintain robust security.
As a multinational company and a global workforce, security is paramount. Multifactor authentication is a crucial process for all Entra ID users, given the increasing sophistication of cyber threats. We highly recommend exploring the security features of Entra ID and its integration with Azure Information Protection—a cost-effective, AI-driven solution that enhances security.
I have been employed as a subject matter expert for Microsoft Entra ID, as well as other Microsoft projects. Presently, my organization is collaborating closely with the Microsoft product team. This involves handling end-to-end customer scenarios connected to the products. In cases where there are issues related to configuration or operational scenarios, I provide assistance by configuring based on the organizational requirements. Additionally, I ensure end-to-end security through Microsoft Entra ID. I have dedicated the past 22 months to working within my organization on various Microsoft projects.
Microsoft Entra ID is a cloud-only service. However, if a customer has existing on-premises resources, they can integrate them using Azure Ready Connect to Microsoft Entra ID. It can be used in a hybrid mode depending on the organization's requirements.
Microsoft Entra ID provides a unified interface for managing user access. The user's sign-on experience relies on several factors, including the specific service or resource they are attempting to reach. The initial sign-on process involves first-factor authentication, which typically entails entering the username and password. Depending on the user's assigned security level, multi-factor authentication may be required. If the user is attempting to access an application and Single Sign-On is enabled, they can also enjoy a seamless sign-on experience for accessing both on-premises and cloud-only resources.
The admin center assists us in managing everything, from global administrators to Role-Based Access Control provisions. If a specific admin needs to be assigned to access all user authentication methods, an authentication administrator will be made available. Similarly, a conditional access administrator can assume this role if needed. We have a variety of roles accessible for performing tasks such as accessing, reading, writing, and editing operations, all based on specific requirements. Alternatively, there's the global administration role, which holds the capability to perform various actions and possesses full control over the tenant. This control can be exercised through the admin center.
When the COVID-19 pandemic emerged, all of our employees across various organizations worldwide began working from home. This trend of remote work continues significantly. Users operate from diverse networks, which might vary in terms of security levels. In order to safeguard resources, Microsoft Entra ID plays a pivotal role for all organizations, not solely for mine. Microsoft Entra ID provides essential security features, such as continuous access evaluation, multifactor authentication, IP restriction, and device-based blocking. These features constitute a device registration scenario that organizations can adopt. Whether an organization chooses to manage devices through Microsoft Entra ID or one of the other device registration scenarios available depends on the specific context, particularly the industrial location for an IT engineer. In this setup, an organization can impose restrictions or temporary blocks on users directly, contributing to the assurance of secure logins. This approach aids organizations in preventing unauthorized access to user accounts and organizational data from potentially malicious actors like hackers or unauthorized exporters. Microsoft Entra ID has been designed to enhance the security of both users and organizational information, aligning with Microsoft's commitment to safeguarding user data.
Conditional access is among the most reliable and secure features enhancing the performance of Microsoft Enterprise ID. This functionality enables us to execute various actions, as I have previously indicated. These statements are straightforward and comprehensive. To prevent access for specific users, we must apply logs based on specific requirements. If there is a need to restrict a user, we can implement a pause. This means that if a user is accessing from a certain location or utilizing a particular device, they will be granted access. Conversely, if these conditions are not met, the user's access will be denied. Therefore, conditional access policies can be employed as the organization's primary line of defense. In the past 22 months, updates have been made to the conditional access framework, incorporating conditional access policies from both session management and control management. This enhancement enables organization administrators to apply more refined filters, thereby enhancing user security. These updates include the potential enforcement of app protection procedures through Entra ID. Alternatively, administrators may create custom policies for specific applications or websites using the Defender of products. In the past, the option to merge different Entra apps and conditional access was not available. Presently, conditional access policies offer heightened security, allowing the creation of policies from various Microsoft services, including different apps. This capability empowers us to restrict users or employees from actions like copying certain data or transferring information to other locations. It prevents downloading of company information from untrusted devices as well. Additionally, our implementation of app protection policies aligns various Microsoft services with conditional access policies, further fortifying overall security.
The three factors for implementing a zero-trust framework are verifying the users, checking their privileges, and aiding in identifying any breaches. Conditional access assists with this process.
We can establish application restrictions and enforcement policies based on the Entra ID. These policies can then be aligned with conditional access policies across various locations. Additionally, we have the ability to formulate policies, such as designating trusted and untrusted locations for device data. This ensures that specific applications will only be accessible if they meet the conditional access prerequisites both from Entra and within the Endpoint Manager policies. This encompasses all first-party Microsoft applications as well.
The Verified ID feature is one of the most impressive functionalities I have encountered. Although I haven't used it personally, my role involves working as a technical support engineer for Microsoft. My responsibilities include handling support requests for Microsoft and assisting customers worldwide, whether they are utilizing premier or personal support services. To the best of my understanding, the Verified ID offers one of the most secure methods for organizations to store their data via the Decentralized Identifier framework. This enables them to manage their setup autonomously and perform DID verifications. Through this process, organizations can issue credentials to users using the Microsoft Authenticator app. This ensures that a web server is set up and a decentralized ID is created. Importantly, all organizational data remains confined within the organization; Microsoft does not retain user credentials or passwords. Consequently, all organizational data becomes integrated into the decentralized ID. This process is carried out by administrators responsible for onboarding users into the organization. When an employee joins the organization, they are issued credentials using the Verified ID feature through the authenticator app. Subsequently, these credentials are passed on to the user. The authenticator app then verifies the legitimacy of the request.
Microsoft Entra ID has proven invaluable in saving time for both our IT administrators and HR departments. Prior to Entra ID, we were required to generate individual user IDs sequentially. However, with Entra ID, we now have the convenience of producing them in bulk. This includes the ability to furnish these user access IDs temporarily, along with corresponding temporary passwords. This is achieved through a CSV-formatted Excel sheet. This process is particularly advantageous when juxtaposed with onboarding new users. For our existing users, determinations are made based on their user activity and potential risk status. In this regard, our IT administrators or global admins are promptly alerted if any user is flagged as risky. These notifications and identity protection features are integral components of Microsoft Entra ID, especially in relation to potential users. Furthermore, our system incorporates the latest workflow feature. This functionality closely resembles Identity Protection, although the latter exclusively pertains to users and objects. Conversely, virtual IDs oversee services, including applications and various other resources that have been generated via web apps, SQL, or SharePoint instances.
Microsoft Entra ID has significantly contributed to cost savings within our organization. Prior to implementing Entra ID, substantial financial resources were dedicated to various investments. Particularly in the realm of licensing, any learning initiative incurred substantial expenses. However, there has been a notable transformation in Azure, now rebranded as Entra, accompanied by the incorporation of numerous features under the Microsoft Entra ID umbrella. Undoubtedly, this has greatly enhanced cost management for our organization. Moreover, we now possess the capability to effectively manage subscriptions. We receive regular alerts from the cost management infrastructure, providing insights into our resource consumption. A distinct 'pay-as-you-go' option empowers us to select and pay solely for the resources we utilize. This approach enables us to forego committing to a fixed amount of virtual machines for a predetermined period. Instead, we can opt for resources as needed, paying only for their actual usage. Indeed, the cloud plays a pivotal role in cost savings when compared to the complexities of managing on-premises servers and resources.
The Microsoft Entra ID has significantly enhanced our user experience. In our daily scenarios, there is no need to log in every time. This is especially beneficial for user authentication and accessing various resources. Entra offers features that simplify our daily tasks and the use of dynamic applications that we host. One remarkable feature is the ability to utilize single sign-on, which is both cool and highly effective. Additionally, we have the option of Windows Hello for Business, including field authentication for Windows Hello for Business. These authentication features streamline the login process and contribute to the ease of our work.
The most valuable feature of Microsoft Entra ID is its security options, where we can provide highly effective security for user accounts during authentication. We have a conditional access policy in place, along with modern authentication methods that can be configured in various ways to meet organizational requirements. These methods may include phone calls, SMS, or even passwordless authentication, which is the most convenient and secure method introduced by Microsoft. This includes Windows Hello for business and certification-based authentication as well.
There are several limitations that Microsoft is currently facing. Since I work with global customers daily, they often come up with new ideas. However, these ideas are sometimes hindered by Microsoft's limitations. As a result, many people are turning to third-party tools or services, even from vendors that are not as reputable as AWS or GCP.
I have personally made similar suggestions to my product team, especially regarding the vendors that users are attempting to rely on. For instance, certain organizations prefer to restrict the use of mobile phones, particularly in countries like India. These organizations are very strict about security and prohibit the use of Android or camera-enabled mobile devices for their employees. Consequently, these users cannot utilize Microsoft Authentication, and instead, they must resort to other password authentication methods such as Fido or Windows Hello for Business.
Among these options, we have only one choice, which is Fido, a security key. However, when users need to use Fido, they are required to also use multifactor authentication. This means that a user can only register for Fido after they have registered for the Authenticator, which is not an ideal scenario. If an organization has already decided not to use mobile phones and has opted for Fido authentication with security keys, it's not advisable to then ask them to use Microsoft Authenticator.
Recently, Microsoft introduced an alternative solution known as the temporary access pass. This pass allows users to log in temporarily, but its effectiveness is limited. This is especially true for Fido authentication with security keys, although it is included in the Entra IDs CBA, particularly for Android and mobile devices. Unfortunately, these secure options are not available when logging in from devices like iPads or iOS-based mobiles, other operating systems, laptops, mobile devices, Chrome, or Linux machines.
Microsoft needs to make improvements in this regard and extend its services to other operating systems as well, especially when considering their widespread usage.
I have been using Microsoft Entra ID for almost two years.
The solution is continuously being updated and enhanced with new features. As we are involved in Microsoft projects, we get a sneak peek into the upcoming release of Microsoft Entra ID, and I am confident it will be exceptionally stable.
Microsoft Entra ID is scalable.
I have been employed as a tech support engineer, assisting with Microsoft products since the inception of my career. As a result, I have not required the services of their customer support.
I have utilized Okta solely for federation services in some testing capacities within my laboratory environment. Okta proves advantageous for establishing federated connections between Azure instances across different clouds. To illustrate, imagine that Microsoft employs local active directory federation services. This duplication seems inevitable, given Microsoft's explicit intentions conveyed through the Microsoft Ignite channel.
Consequently, Microsoft ought to develop federation services akin to Okta's, which offers exclusive cloud-based federation services. This offering would greatly assist users and organizations habituated to utilizing federated authentication protocols. It would be prudent for Microsoft to integrate a cloud-exclusive federation service into Azure Cloud.
Furthermore, Microsoft contends that, in terms of security and trustworthiness in authentication service identity providers, Entra reigns supreme compared to other options. In this regard, I concur that Entra boasts superior security when contrasted with Okta.
Azure Cloud refrains from provisioning specific federation endpoints for certain applications due to the persistent usage of on-premises or federated applications by numerous organizations. This gap is where Okta has capitalized, effectively occupying the market space that Entra commands in such scenarios.
The initial setup is straightforward. The deployment is simple. We possess Microsoft learning documents and public articles from Microsoft, along with community channels. If we aim to adhere to these instructions, the process is quite simple. Even a college graduate attempting to configure from the Entra web portal will find it easy to follow. The procedure is particularly straightforward for specific scenarios and the specific topics that Entra provides.
I completed the implementation in-house using the documentation provided by Microsoft and by following the Microsoft YouTube channels.
Entra's pricing is somewhat higher compared to AWS. With AWS, we have the ability to access EC2 servers, which are essentially virtual machines, for free for a duration of up to one year, specifically the basic virtual machine instances. However, Entra does not offer a similar option. If we are utilizing any form of virtual machine on Entra, we must begin payment after one month of complimentary usage. Unlike AWS, Entra does not provide access to basic virtual machine instances for educational or testing purposes. Furthermore, there is a discernible difference in pricing and licensing when we compare AWS Identity Access Management with Entra's ID system.
I would rate Microsoft Entra ID eight out of ten. I deducted two points due to the limitations concerning the connectivity of services for Android and other operating systems.
Microsoft Entra ID serves as an identity protector and service privilege manager.
It has enabled my organization to build a secure environment for user login and asset access. We can enable secure user logins and access to assets.
When we implement app access with Microsoft Entra ID, it gives us confidence that we have secure authentication for our applications.
With privilege identity management, we can grant or escalate rights to a role for a short duration of time and not forever. It is a great feature. It is useful to validate the escalation of privileges.
Federation on access service principle and the ability to be passwordless in certain use cases are valuable. Federated identity management is a great feature for the zero-trust model.
Microsoft Entra ID could benefit from more fine-tuned rights. It is necessary to prevent granting an application or user broad access rights. A more precise approach would allow for specific rights, limited to certain contexts within the organization.
I have been using Microsoft Entra ID for three years.
Microsoft Entra ID efficiently responds to numerous requests, and we have not faced significant connectivity issues, making it reliable.
Their customer support is good.
Positive
I have not used any other solution. I was previously using Azure AD. About two years ago, it was renamed to Microsoft Entra ID.
I would rate Microsoft Entra ID a nine out of ten.
We have it synced to our on-premises Active Directory environment where we have some Active Directory servers. We use it for authentication into our cloud apps. We use it for SSO. Because it is connected to our Office 365 tenant, we use it for single sign-on for applications that support it.
We also use it to evaluate risky sign-ins or risky activity for users. If there are user sign-ins from a geographic location that they would not normally sign in from, we get a notification for it, and we can investigate what is going on with a user's ID, if the person is actually there or not, and if we need to take any action on it.
Entra ID has primarily helped with security and some level of organization of our user environment and application access for staff.
Entra provides a single pane of glass for managing user access to some degree. We still have to use local Active Directory management for certain items or troubleshooting. It does not seem to extend management and troubleshooting down to the endpoint level or have the same sort of granularity as managing Active Directory directly from an Active Directory server.
Entra ID has helped to save time. It has saved four to eight hours of staff member's time per week.
In some ways, Entra ID has saved us money because using it for single sign-on for third-party applications means that we do not have to use a third-party solution such as Okta or OneLogin. It is a default solution. It comes out of the box, and it works with multiple applications, which means that we do not have to go the route of having a third party to have that same type of solution for us. In that sense, it does save us money, but I do not know how much it has saved because I have not priced out Okta or any of the other solutions. I imagine it is a fairly substantial amount that they would charge per user per month times the number of our users.
Syncing with our on-prem Active Directory is valuable because we do not have to keep multiple identities for each of our staff members. We can easily evaluate login risks and provide access for SSO via 365 into applications, such as Salesforce, and other things that we run our business on.
Certain aspects of the user interface can be rather clunky and slow. It can sometimes be circular in terms of clicking a link for a risky user sign-in and seeing what the risky login attempts were. It takes you in a circle back to where you started, so drilling down into details, especially if you are not in it every day and it is one of many tools that you use, can be difficult. It can be difficult to track down the source of an issue.
There should be better integration or support for FSMO roles and cross-tenant force management. If you want to enable it, it is tricky when you add Entra ID into the mix for domain sync or directory sync.
I have been using this solution for five years.
The Entra ID and Azure Active Directory support is quite good. Sometimes, it may take a little bit of time to get past tier one basic questions and basic pointing to support articles and talk to somebody who looks at your configuration and starts to understand what your specific challenges are, but once you get to that next tier of support, it seems like you are able to get answers very quickly.
I would rate their support an eight out of ten. A ten out of ten would be where you make one phone call and all solutions are given.
Positive
We did not have single sign-on capabilities for our SaaS apps. Prior to implementing our Azure environment, we did not have a cloud identity provider. It was all on-premises.
I was involved in the deployment and initial setup of Entra ID. It was not that difficult. It had medium difficulty. There is a Microsoft way of doing things. Microsoft certainly seems to have made things easier since then. Whenever I go back into the system, it looks like some of the usability improvements are there.
I believe that we also contacted Azure support a number of times during our deployment, and they were quite helpful. They were helpful up to the point where I got contacted by a product manager for Azure Active Directory at the time, and they were able to walk us through some of the implementation challenges we had, so Microsoft, at least for us as we were adopting Azure and Azure Active Directory, had a lot of hands on help with getting set up. They are open to feedback as well. The implementation was about as difficult as I expected an implementation to be. It was not certainly a turnkey where it just works right out of the box, but I have had more difficulty implementing other Microsoft solutions.
It is good. We have Office 365 E3, and then that is tied in with Azure Active Directory. I believe that we only have to pay for our technician-level access or IT department access for Azure Active Directory Premium, which I am sure they call Entra Premium P2 licensing, so it is not a very large cost. We just adopted that, and that gives us a lot of insights into user security that we would not otherwise have.
We looked at Okta. We looked at Cisco Duo. We looked at OneLogin. I believe that there was some cost that we would have to bear if we had adopted them. Okta looked like a very good solution, but Azure AD came integrated out of the box with our Azure environment and our 365 environment, so we decided to move forward with it instead.
We have started using Permission Management. We have not fully rolled it out yet. We have also not used Verified ID. It is something that is a little tough to implement because the documentation is not necessarily there yet. We have just started touching the surface of it.
I would rate Entra ID an eight out of ten. It is a good product. It works out well for an organization of our size. We are fairly small, and we have limited IT resources. We are able to use Entra ID for permissions management and access management. I am trying to learn more about secure access and secure edge type of solutions that Entra has. At this Microsoft event, the demos in Demo Theater 3 have been overflowing and overcrowded to some crazy degrees, so there is definitely demand for it. Microsoft can put these demos in a larger room because there is a lot of demand for it.
I handle access management.
Microsoft Entra ID has positively impacted the secure access to apps and resources in our environment. It's just easy to integrate.
It makes management easier. We have visibility into password compromises and other things.
What I appreciate the most about Microsoft Entra ID is that it integrates seamlessly with other Microsoft products, which streamlines the process.
It integrates with applications, such as our Password Manager, and multi-factor authentication, and it integrates with Office 365 and third-party applications. That's very useful.
Microsoft Entra ID can be improved by having more resources for learning how to best use the tool and understanding best use case scenarios. The learning curve is challenging, so I would appreciate seeing a training portal that is easier to use. I would appreciate seeing more guides and training materials about Microsoft Entra ID.
I have been using it for six months.
The stability and reliability of Microsoft Entra ID are good. It is very reliable, and I have never experienced any problems.
Microsoft Entra ID is very scalable with third-party applications.
We have been using Entrust within our environment, and Microsoft Entra ID is in our larger environment. We use both solutions.
The biggest return on investment when using Microsoft Entra ID is the integration with third-party applications.
I would rate Microsoft Entra ID a nine out of ten.
Positive
The use cases typically include external customer authentication, which we do, and by customers, I mean our hotel partners. There is basic user authentication and the ability to isolate those users based on a particular security environment, whether they are coming from a PCI environment, lab environment, corp environment, etcetera. Each of those has to pass through specific security, so everything that your Active Directory or Windows AD is solving on-premise is essentially the use case, except for the external customer situation which was the one thing that made me look at Entra ID. Unfortunately, the way Entra ID works created a major security issue that I cannot go into regarding guest users for our tenant. We are now trying to fix that.
We tried to stand it up as a PoC, and we went back and forth with Microsoft on it for a few months. We never got to a resolution because there is an architectural design issue with the service itself, and Microsoft is not going to change their service for us. We tried to use it, and then we gave up, killed it, and went back to the original plan, which was to use Okta. Our goal is to eventually completely get out of the Microsoft Identity ecosystem and move over to Okta.
We do not use Entra ID anymore. We have moved away from Entra ID. We could not justify it from a business standpoint. That is the crux of the situation. We now have a solution that can meet all of our business needs.
Microsoft Entra does not provide a single pane of glass for managing user access. It is not fully featured yet. There are some things within that Entra ID administrator portal, but it is not as robust as simply going to Entra ID service and then going to different features that it has to maintain identities. It is not even a single pane of glass if you look at how Microsoft does identity between Entra ID, Azure Resource Manager, and M365 itself. I know that they are trying to fix the situation between Entra ID and M365, but the subscription-level identity access controls need to be moved out of the subscription level and need to be globally managed from the identity provider. I am sure there was a design choice for that, but it just does not work when you are a company of our scale because we just cannot keep managing individual resources, so we would like to centralize the identity system.
I used Microsoft Entra Permission Management in a very specific scenario but because we are a hybrid environment, we often found ourselves fighting with cloud groups. We moved a lot of security groups into Entra from our Windows AD environment. We have a lot of stuff that has been built upon that for the past 20 years. Not being able to have Windows Active Directory security groups that are synced to Entra ID to control access to resources was a big pain for us. We would have had to create a cloud group and then add all the members of those on-prem security groups to it, so we did not even bother with it. When you have a company of our age and our size and you have nested security groups, there is a lot of linkage there, and it is not attainable.
It is great for mom-and-pop shops or small businesses that are truly coming into the enterprise ecosystem and that have not come from a legacy environment. Current statistics show that 99% of the world that was in an Active Directory authentication environment is still in the Active Directory or Windows AD authentication environment and just supplementing Okta, so we are not doing anything new. A previous Microsoft employee that I talked to said that in the last decade, there has literally been only one customer to get fully off their hybrid environment and go fully into Entra, and it took them over ten years. Therefore, Microsoft needs to focus more on Entra and fix not only the design flaws but also address a lot of the customers' needs. It has a lot of potential specifically around taking business from IIQ for some of those UAR workflows, identity workflows, etcetera. Their biggest competitor is Okta, and Okta is currently the better solution.
We have been trying not to use the solution. It is used for a specific use case, which is around authenticating M365, and we are trying to see if we can get out of using it, but that is only because our environment is extremely complicated. Entra ID is not battle-tested or stable enough to support a business of our size. There are some design issues specifically around support for legacy services. We used to be part of Microsoft, so we have about 15-year-old services sitting in our data center that still need to use legacy LDAP authentication. The way we currently have the environment set up is for one very specific domain. I am using a domain for specific context here to keep it simple. We have 36 Active Directory domains, and that does not include the child. We follow the least privileged access model. Our environment currently consists of using AD Connect to synchronize objects from our corporate tenant into Entra ID, and then from Entra ID, we wanted to stand up Azure domain services as a possibility for retiring legacy LDAP services. The issue with Entra ID specifically is that the way it replicates objects out of its database into the Azure domain services Active Directory tenant or Active Directory service is that it uses the display name. This is a bad practice, and it has been known as a bad practice even by Microsoft over the past decade, so the design is not good. The issue with replicating based on the display name is that when you are coming from an environment that uses a least privilege access model, where you want to obfuscate the type of security account being used by hiding it behind a generic display name, instead of myusername_da, myusername_ao, etcetera, to have an idea of what accounts are being used when they are logging in, it is unable to reconcile that object when it creates a new domain. If they all have the same DM, you end up with quadruplicates of each user identity that was replicated to it from the directory. Those quadruplicates or their same account names, as well as the display names within the cloud domain services directory, have a unique identifier with the original account name attached. What that does is that it not only breaks that LDAP legacy authentication, but it also drives up the cost for your customers because you are paying for each additional seat, additional user objects that are created, or additional users. You also cannot tell any of those accounts apart unless you dive deep into the user object to peel back what type of account that is to map it back to what came from on-prem itself, so the service is completely useless. What we have done in our case is that we do not really need Entra ID. We have Okta, so we use an Okta LDAP endpoint. That does exactly what we need in using SCIM, which is the technology that is able to take identities from multiple dynamic providers and merge them together into a single record. It is able to act as an official LDAP endpoint for the business, so legacy apps work. We do not have a problem. Microsoft could learn from that.
Entra should allow for external MFA providers rather than forcing you into a walled garden and the Microsoft ecosystem. Flexibility is a big thing, especially for companies of our size. A big issue for us is that we want the identity to be in Entra for sure, but we want it to come from Okta. We want the authentication and stuff to work, but we want Okta to control the PIM rules. We want it to do the MFA and all those things, but Entra does not play nice with others. Okta has engineered some ways to get it done, but it is not as full-featured as we would like it to be. Microsoft should do what they do with some other partners such as Nerdio and Jamf where they have their own version of a service, but they are still partnering with those other companies to at least add options on the market.
Fully customizable UARs and Azure Secure Identity Workflows would be great. Currently, you can do it if you cobble together a bunch of Azure functions and use Sentinel. If you are sending logs to Sentinel and are able to match patterns and run automation based on that, it would be great. They can help with a solution that abstracts away a lot of that complexity across multiple services into exactly what IIQ does. I could definitely foresee Entra being the choice for identity for pretty much all cloud providers if they can focus on the areas that SailPoint's IIQ does. A big pain point for a business of our size by being in Okta is that we do not have the same workflows that we have between IIQ and AD. With the amount of data that our company generates, we wanted Sentinel. I had their security department onboard, and it was going to be millions a month just to use Sentinel, but we could not use it, so we decided to leverage Splunk and a few other SIEM providers.
They should also stop changing the name of the product.
We used it for a few months.
Microsoft's support has been so bad when we have had issues in Azure that we recently poured 24 million dollars out of our spend for Azure, cut our unified support agreement with them, and sent it to somebody else. I would rate their support a zero out of ten. It is so bad. We probably never had a support engineer solve our problem. Usually, I or somebody else in the company has to reverse engineer service to try and find the solution. The things that we find are not even documented on the Microsoft site. The second way is to pull the information from the blog of some old guy who found the same issue and ended up solving it.
People on the support side at Microsoft just read from a runbook and then send us to another part of the world where they ask us the same question, read from a runbook, and then we repeat ourselves, so we sent all that support to Insight. They were happy, and they were way cheaper. It only cost us less than four million. It was significantly cheaper. Our leadership is like, "Wow! IT actually saved us money this year."
Negative
We were using Active Directory, and we will never get off AD. There is too much legacy stuff for us to even bother getting off AD. It is a very mature product. It would be crazy for us to leave Windows Active Directory for something else, even Okta. There are core things that we need to function a certain way, so Entra ID just does not make sense. Entra sometimes even has access issues and replication delays with identity and adding objects to a new access control list within its platform or service.
We are not a typical company. We used to be part of Microsoft, so a lot of things that we inherited were very complex, and we also do things differently. For the old NT systems and SMB shares, we are still using Active Directory groups, and they work just fine. We have automation built around membership. We control the membership of those groups, the auditing of those groups, and everything else, so it does not make sense. It would be too much work to move us over to Entra ID.
I was involved in its deployment. It was complex, but that was not Microsoft's fault. That was our fault because we have a very complicated environment.
We have a hybrid environment. We were in IBM, but we pulled back. We have Oracle's cloud platform, and we have AWS as well as Azure, but 99% of our cloud workloads are all in AWS.
When we initially started, Microsoft was not there. The initial implementation strategy was to synchronize the Windows Active Directory corporate domain to Entra ID. That way, we had the identities and we could use the same AD connector to synchronize the AD distribution lists. The other side was the mailbox.
We did not take the help of any integrator. It does not require much. You stand up your servers. You have a staging host with its own database, and then a sync host with its own database. You then hook them up and make sure you have all the permissions in your previous tenant.
Microsoft puts MSOL accounts in some default directory. You should be able to tell the agent to put the MSOL accounts in a more secure OU. For instance, the original recommendation, which has changed recently, when we set up the service was to use an enterprise admin to set up the agent, which generates a bunch of MSOL accounts. Those MSOL accounts ended up in our all users' organizations. When you have a company of our size, that is not the only MSOL account that exists in the directory, and it is really hard to tell those apart, so we have to look through the logs, see which MSOL account it is using, and move it into the proper OU for the on-prem domain. It would be nice if you could determine where that goes at the time of creation.
We were able to reclaim the money that we did not spend with Microsoft and spend it elsewhere. It is technically an ROI, an investment of our time in negotiating other deals.
Microsoft is so expensive. You know it is expensive when a Fortune 100 company like ours is complaining about the cost. That has been a big thing for me. When I really want to use an Azure service, it is very hard for me to justify the cost, especially with Microsoft support.
To those evaluating Entra ID, I would say that if you are on Windows Active Directory, just stay on it.
I would rate it a five out of ten. It is not ready yet. It needs focus by Microsoft.
I work on it to investigate it. I work at a cybersecurity company, so I focus on how the product behaves, particularly how Microsoft Entra ID behaves with group permissions and such.
We work with Microsoft because we're also a security company, so we scan Microsoft Entra ID and then monitor what happens regarding defending against token theft and nation-state attacks.
We are partners with Microsoft. We don't sell Microsoft products; we sell our own product, but we integrate it with Microsoft.
It's simple to create groups or accounts and to add users. There are several options for dynamic groups.
Microsoft Entra ID influences our zero trust model because we need to make sure that we give the right user permissions.
To improve Microsoft Entra ID, it should be made simpler because there is a lot of stuff to do in the platform, which could be reduced to fewer buttons.
I have been using Microsoft Entra ID for two years.
Microsoft Entra ID is pretty stable.
I don't know about scalability, but I assume it is suitable because it is used for huge organizations.
Customer service and technical support for Microsoft Entra ID are very good because I open many tickets with the support and get straight answers. If I don't get an answer, they update me all the time that they will provide an answer, and they work on that.
Positive
Microsoft Entra ID is pretty easy to deploy. The speed of deploying Microsoft Entra ID depends on the organization and its structure, but building new users is very simple.
There is a return on investment when using this platform, though I am uncertain about the specifics.
I haven't observed any problems or changes in the frequency and nature of identity-related security incidents after using Microsoft Entra ID in my company.
I would rate Microsoft Entra ID a nine out of ten.
