Skip to main content
This article defines core Microsoft Entra ID concepts you’ll encounter when managing identities, accounts, and access in Azure and other Microsoft cloud services. It clarifies the differences between identity, account, service principal, managed identity, and tenant/directory so you can apply the right terminology and patterns in architecture, automation, and security.

​
Identity

An identity is any entity that can be authenticated by Microsoft Entra ID. Identities are the security principals that can request tokens, be assigned permissions, and appear in directory operations. Common identity types:
  • User accounts (people)
  • Groups (logical collections of identities; primarily used for authorization)
  • Service principals (applications and services)
  • Managed identities (Azure resources with an identity)
In short: an identity is the “who” or “what” that can sign in or be authenticated by Entra ID.

​
Account

An account is an identity that also has attributes (profile data) stored in the directory. For example, a user identity becomes a user account when attributes are attached such as:
  • displayName
  • department
  • jobTitle
  • manager
  • mobilePhone
  • officeLocation
These attributes form the account record and are used for display, policy evaluation, and integrations.

​
Microsoft Entra ID account vs Microsoft account (MSA)

  • Microsoft Entra ID account: An identity within a Microsoft Entra ID directory (historically Azure Active Directory). These are typically work or school accounts managed by an organization (for example, alice@contoso.com).
  • Microsoft account (MSA): A personal consumer account used for services such as Outlook.com, Xbox, or personal Microsoft subscriptions (for example, alice@hotmail.com). MSAs are separate from Entra ID accounts.
Note: Work and school accounts are managed in Microsoft Entra ID (the enterprise identity directory). Personal Microsoft accounts (MSA) are consumer identities that may be allowed to sign into some services, but they are a different identity system.

​
Service principals and managed identities

These two concepts are related but have distinct roles:
  • Service principal:
    • The tenant-scoped identity representing an application or automation.
    • Can be assigned roles, permissions, and credentials (client secrets, certificates).
    • Created when you register an application (an application object) and then provision the service principal in a tenant.
    • Used for non-interactive authentication (APIs, automation, CI/CD).
  • Managed identity:
    • A special type of service principal automatically managed by Azure.
    • Removes the need to store credentials in code or configuration.
    • Two kinds:
      • System-assigned managed identity: Lifecycle tied to a single Azure resource. Deleting the resource deletes the identity.
      • User-assigned managed identity: A standalone Azure resource that can be assigned to one or more Azure resources and has an independent lifecycle.
Managed identities are the recommended pattern when Azure resources need to access other Azure services securely without handling secrets. Table — Service principal vs Managed identity:

​
Account creation and Entra ID examples

  • Work or school account: Created and managed in an organization’s Microsoft Entra ID directory (example: alice@contoso.com).
  • Personal Microsoft account (MSA): Created for consumer services (example: alice@hotmail.com). MSAs are separate from Entra ID accounts but may be accepted by some Microsoft services.

​
Tenant (Directory)

A tenant (or directory) is the dedicated instance of Microsoft Entra ID created when you sign up for a Microsoft cloud service (for example, Azure, Microsoft 365). “Tenant” and “directory” are interchangeable. Key points:
  • A tenant stores identities, groups, applications, policies, and configuration for an organization.
  • An Azure subscription is associated with a tenant; multiple subscriptions can belong to the same tenant.
  • Tenants provide isolation for identity and access management between organizations.

​
Quick recap

  • Identity: Any entity that can be authenticated (user, group, service principal, managed identity).
  • Account: An identity with attributes (user profile fields and metadata).
  • Microsoft Entra ID account: A work or school identity in an Entra ID directory.
  • Microsoft account (MSA): A separate consumer account system for personal services.
  • Service principal: The identity representing an application or automation in a tenant; used for non-interactive sign-in.
  • Managed identity: An Azure-managed service principal that simplifies credential management (system-assigned or user-assigned).
  • Tenant/Directory: The Entra ID instance that holds an organization’s identities and configuration.
This article also examines how Microsoft Entra ID (formerly Azure AD) differs from Active Directory Domain Services (AD DS) and where each is appropriate for identity, authentication, and resource access.

Watch Video