Fair enough. But here’s the thing — if you use Microsoft 365, you’re already using Entra. Whether you know it or not. It’s the system that controls who can log in to your email, your files, your Teams — everything.

So let’s demystify it.

What Is Microsoft Entra, Actually?

Microsoft Entra ID (formerly Azure Active Directory, or Azure AD — Microsoft loves renaming things) is Microsoft’s identity and access management service.

In plain English: it’s the system that decides who gets in and what they can see once they’re in.

Every time you log in to Outlook, OneDrive, Teams, or any Microsoft 365 service, Entra is the bouncer at the door. It checks your username, verifies your password, maybe asks for your MFA code, and then lets you through.

That’s it. That’s the core job. It’s the lock on the front door.

Why the Name Changes?

Quick sidebar because I know someone is wondering — yes, this used to be called Azure Active Directory, and yes, Microsoft renamed it to Entra ID, and yes, it’s confusing.

Here’s the deal: “Azure Active Directory” was a terrible name. While it shared some high-level concepts with the traditional Active Directory you might know from on-premises Windows servers — users, groups, authentication — it was a completely different architecture underneath. The name made people assume it was just Active Directory in the cloud. It wasn’t. That caused endless confusion. So Microsoft split the identity product line into “Entra” and now it’s called Microsoft Entra ID.

Same product. Shiny new name. If you see Azure AD in older documentation, it’s the same thing. Old habits die hard — you’ll still see Azure AD everywhere in older docs, scripts, and PowerShell modules. Just know it’s the same thing with a new label.

What Does It Actually Do?

Let’s get specific about what Entra handles day to day in a small business:

1. User accounts and passwords. Every person in your business who has a Microsoft 365 account — that account lives in Entra. Their username, password, display name, job title, all of it. You manage users through the Microsoft 365 admin centre (which is backed by Entra).

2. Single Sign-On (SSO). If your device is set up with your work account, you’ll often sign in once to your computer and won’t be prompted again when you open apps like Teams. That’s Entra working behind the scenes — one login, access to everything. It’s more convenient and more secure than using separate passwords everywhere.

3. Multi-Factor Authentication (MFA). This is the big one. MFA means that even if someone gets your password, they still can’t log in without the second factor — usually a code from an app on your phone.

Without MFA, your password is the only thing standing between a hacker and your business email, files, and customer data. That’s one lock. MFA adds a second. Simple concept, massive impact.

4. Conditional Access. This is where it gets powerful. Conditional Access lets you set rules about how and where people can log in. For example:

• Only allow logins from New Zealand
• Require MFA if someone is logging in from a new device
• Block logins from countries you don’t operate in
• Only allow company-managed devices to access certain files

Business Premium includes Conditional Access. Basic and Standard rely on Security Defaults, which enforces MFA automatically but with less flexibility.

5. Device management (with Intune). If you add Intune to the mix (Business Premium), Entra tells Intune which devices are trusted and which aren’t. A company laptop that’s been set up properly? Fine. A random personal laptop from a coffee shop? Maybe not.

Why Should You Care?

Because identity is the new firewall.

Old school IT thinking was: build a strong perimeter. Get a good firewall, lock down the network, and you’re safe. That worked when everyone worked in an office and all the computers were plugged into the same network.

That’s not how most businesses work anymore. People work from home. They check email on their phones. They log into SharePoint from their laptop at the airport. The perimeter is gone.

So what’s left? Identity. The only thing that matters now is: is this person actually who they say they are, and should they be allowed to access this thing?

That’s Entra’s job. And if you’re not paying attention to it — if MFA isn’t enabled, if former employees still have active accounts, if you’ve got no control over what devices can access your data — you’ve got a gaping hole in your security and you don’t even know it’s there.

The Scary Bit

Here’s what keeps me up at night when I think about small businesses:

The number one way business accounts get compromised is stolen or phished passwords. Someone gets tricked into entering their Microsoft 365 password on a fake login page. The hacker now has their username and password. They log in. They read emails. They access files. They send from that person’s email to suppliers with new bank account details.

Sound far-fetched? It happens constantly.

And the fix is dead simple: enable MFA. If you do nothing else after reading this post, go turn on MFA for every user in your Microsoft 365 account.

With MFA enabled, the stolen password is useless. The hacker needs the second factor — the code from your phone — and they don’t have it.

It’s not bulletproof. Nothing is. But according to Microsoft, MFA stops over 99.2% of identity-based account compromise attacks dead in their tracks.

What About Business Standard Users?

If you’re on Business Standard, you still get basic MFA and user management through Entra. You just don’t get the fancier conditional access policies and Intune integration.

Here’s what you should still do:

1. Enable MFA for every user. No exceptions. Not just the important ones. Everyone.
2. Use the Microsoft Authenticator app. It’s free, it works well, and it’s easier than SMS codes.
3. Remove accounts for people who’ve left. When someone leaves your business — voluntarily or otherwise — disable their account immediately. Don’t leave old accounts sitting there. They’re an open door.
4. Check sign-in logs occasionally. In the Entra admin centre, you can see who’s been logging in and from where. If you see a login from Nigeria and you don’t have staff in Nigeria, something’s wrong.

How to Enable MFA (Quick Version)

There are two approaches depending on your licence. Pick the one that applies to you.

Option A: Security Defaults (Business Basic / Business Standard)

This is the simplest option. Security Defaults enforces MFA for all users with no configuration needed.

1. Go to entra.microsoft.com
2. Sign in as at least a Conditional Access Administrator
3. Navigate to Entra ID → Overview → Properties
4. Click Manage Security Defaults
5. Set it to Enabled
6. Save
7. Tell your staff to download Microsoft Authenticator and set it up — they’ll be prompted on their next login

Option B: Conditional Access Policy (Business Premium)

If you’re on Business Premium, you have Entra ID P1 and can create Conditional Access policies for more control.

1. Go to entra.microsoft.com
2. Sign in as at least a Conditional Access Administrator
3. Navigate to Entra ID → Conditional Access
4. Click New Policy
5. Under Users, select All users
6. Under Target resources, select All cloud apps
7. Under Grant, select Require multifactor authentication
8. Set Enable policy to On and save
9. Tell your staff to download Microsoft Authenticator and set it up

Note: Microsoft is phasing out the older per-user MFA page. Don’t use it for new setups — use Security Defaults or Conditional Access instead.

Staff grumble about MFA for about a week. Then they forget it’s even there. It becomes second nature. Don’t let a bit of initial pushback stop you from enabling it.

The Bottom Line

Microsoft Entra isn’t just enterprise jargon. It’s the lock on the door of your entire digital business. If you’re on Microsoft 365 — which most businesses are — you’re already using it.

The question is: are you using it well? Is MFA on? Are old accounts disabled? Do you know who has access to what?

If you can’t answer those questions, it’s time to take a look. Not next month. This week.

I’ve put together a step-by-step MFA setup guide on Patreon — covering both Security Defaults and Conditional Access, with a staff onboarding email template you can send to your team and a monthly security checklist. Grab the guide here.