Microsoft Entra ID: The Complete Guide (2026)

Microsoft Entra ID (formerly Azure Active Directory) is the identity backbone behind Microsoft 365, Intune, and most modern Windows environments. If your organisation has any mix of on-prem Active Directory and cloud services, understanding how Entra ID handles hybrid identity, Conditional Access, and authentication is no longer optional. This guide covers the essentials for 2026: how sync works, what changed with Conditional Access this year, and where Microsoft is pushing authentication next.

What Is Microsoft Entra ID?

Entra ID is Microsoft’s cloud identity and access management platform — the directory that authenticates users into Microsoft 365, Intune-managed devices, Azure resources, and thousands of third-party SaaS apps via SSO. Most organisations run it in hybrid mode: on-prem Active Directory stays authoritative for legacy apps and file shares, while Entra ID handles cloud authentication, with the two kept in sync.

Hybrid Identity: Entra Connect Sync vs Cloud Sync

There are two ways to sync on-prem AD to Entra ID, and which one you should be planning around changed in 2026.

Entra Connect Sync (the classic Azure AD Connect) runs a dedicated sync engine on a Windows server you manage. It supports Pass-through Authentication and some complex multi-forest scenarios, but high availability means standing up a separate staging server, and every configuration change happens on that box.

Entra Cloud Sync uses a lightweight provisioning agent instead of a full sync engine. Configuration lives in the cloud, multiple agents load-balance and fail over automatically without a staging server, and it’s Microsoft’s recommended default for new deployments in 2026. Microsoft began actively notifying Entra Connect Sync customers about migrating to Cloud Sync in July 2026 — if you’re still on classic Connect Sync, expect that conversation with Microsoft this year.

Cloud Sync isn’t a drop-in replacement for every scenario yet — check your specific dependency on Pass-through Authentication or complex forest topology before migrating. But for anything greenfield, start with Cloud Sync.

For a deeper side-by-side comparison of the two approaches — including a practical migration checklist — see our dedicated Entra Connect vs Cloud Sync guide.

Conditional Access Essentials

Conditional Access is Entra ID’s policy engine: if-this-then-that rules that require MFA, block legacy authentication, restrict sign-in by location or device compliance, and more. The biggest 2026 change is when these policies get enforced.

Previously, Conditional Access mostly applied at sign-in. From 6 July 2026, policies scoped to the “Register security information” user action are enforced during credential registration itself — so a user registering a new MFA method, security key, or authentication app now has to satisfy the applicable Conditional Access controls (MFA, compliant device, trusted location) before they can even register. This closes a real gap: previously a compromised account with just a password could sometimes register a new MFA method and lock the real owner out.

Also new: Conditional Access now supports Agent ID, treating AI agents as first-class identities with their own access checks — relevant if you’re piloting agentic AI tools against your tenant.

Authentication Methods: What’s Changing

• Custom controls are retiring. If you use third-party MFA via Custom controls, migrate to External MFA before the 30 September 2026 retirement (end of life May 2027).
• System-preferred authentication now covers the first factor too. Entra ID picks the highest-ranked method available for a user automatically, rather than defaulting to whatever they used last — rollout was expected complete by end of June 2026.
• Synced passkeys are GA, and tenant passkey profile capacity rose from 3 to 10, useful if you need different passkey policies for different user segments.
• SSPR is getting stricter. From 7 September 2026, self-service password reset only accepts authentication methods a user has explicitly registered for identity verification — no more falling back to methods that were never deliberately set up for SSPR.

For the full rundown on the 2026 authentication changes — custom controls retirement, synced passkeys, and the SSPR registration change — see our Entra ID authentication methods guide.

Licensing Tiers

Entra ID Free comes with any Microsoft 365 or Azure subscription and covers basic directory, SSO, and self-service password change. Entra ID P1 adds Conditional Access, hybrid identity features (Cloud Sync, Connect Sync), and group-based access management. Entra ID P2 adds Identity Protection (risk-based Conditional Access), Privileged Identity Management, and access reviews. If you’re implementing any Conditional Access policy scoped to credential registration or MFA enforcement, you need at least P1.

Getting Started Checklist

• Confirm whether you’re on Entra Connect Sync or Cloud Sync, and plan the Cloud Sync migration if you haven’t already.
• Audit your Conditional Access policies for coverage of the “Register security information” action ahead of the July 2026 enforcement change.
• If you use Custom controls for third-party MFA, start planning the move to External MFA now — don’t wait for the September 2026 retirement.
• Review your SSPR-eligible authentication methods per user before the September 2026 explicit-registration requirement lands.
• Check your Entra ID licensing tier covers the Conditional Access and identity protection features you actually need.

This guide will keep expanding with deeper dives on Conditional Access policy design, hybrid identity migration walkthroughs, and authentication method rollouts — check back or explore the related guides below.