Microsoft Entra ID Fundamentals and External Identities

Microsoft Entra ID is Microsoft’s cloud-based identity and access management service — it authenticates users and controls what applications and resources they can reach, across Microsoft 365, Azure, and thousands of other SaaS apps. Around that core service sits a family of related tools, each solving a narrower identity problem: legacy domain protocols, on-premises synchronization, external partner access, and public consumer sign-up. Knowing which of these five pieces answers which scenario is the actual skill the AZ-900 exam is testing, not just recalling their names.

Microsoft Entra ID: the core identity platform

At its center, Microsoft Entra ID (formerly Azure Active Directory, and still commonly called Azure AD in search and casual conversation) manages user and group identities and their access to applications. It handles authentication — verifying who someone is — and authorization — deciding what they’re allowed to do — using modern protocols like OAuth 2.0, OpenID Connect, and SAML. If a scenario describes signing in to Microsoft 365, an Azure resource, or any modern SaaS application, Entra ID is the service doing the work. It is not a networking tool, a monitoring tool, or a storage service — options describing traffic filtering, VM metric collection, or blob backups are always distractors in Entra ID questions. Every Azure subscription trusts exactly one Entra ID tenant for authentication, so it helps to see how that tenant sits above the subscription and management group hierarchy that organizes everything else in the account.

Microsoft Entra Domain Services: legacy protocols, managed

Some applications, particularly older line-of-business software being lifted into Azure, were built to authenticate against a traditional Active Directory domain using protocols Entra ID doesn’t speak natively: NTLM, Kerberos, LDAP bind requests, domain join, and group policy objects. Microsoft Entra Domain Services exists specifically to provide those classic domain capabilities as a managed service — Microsoft runs and patches the underlying domain controllers, so the organization never deploys or maintains its own. This is the answer whenever a scenario describes a legacy application that “authenticates with NTLM,” “issues LDAP queries,” or “requires domain join,” combined with a stated preference not to manage domain controller virtual machines. Entra ID and Domain Services aren’t competitors — they typically run side by side, with Entra ID handling modern sign-ins and Domain Services covering the legacy holdouts that can’t be rewritten right now.

Microsoft Entra Connect: bridging on-premises AD to the cloud

An organization that already runs on-premises Active Directory Domain Services and wants those same employee identities to work for signing in to cloud resources needs Microsoft Entra Connect. Connect synchronizes on-premises directory objects — users, groups, and their attributes — into Microsoft Entra ID on an ongoing basis, creating a hybrid identity model where one set of credentials works both on-premises and in the cloud. Connect can also synchronize multiple separate on-premises forests, such as those from recently acquired subsidiaries, into a single shared Entra tenant, which is a pattern the exam sometimes dresses up as a multi-company merger scenario. Don’t confuse Connect with Domain Services: Connect moves identities from on-premises AD into the cloud, while Domain Services creates a new managed domain that runs natively in Azure — they solve different halves of a hybrid-identity problem and are frequently deployed together.

External identities: B2B collaboration vs. External ID for customers

The last piece is how an organization lets people outside its own workforce sign in. Microsoft Entra offers two distinct capabilities here, and the exam leans heavily on the distinction between them.

Microsoft Entra B2B collaboration invites a known external user — a partner, vendor, contractor, or auditor — as a guest user who signs in with credentials they already have from their own organization. The inviting company never creates or manages a new password for that person; access is scoped to just the specific resources they need, and the guest account can be removed once the collaboration ends. This is the answer for any scenario about supplier employees, partner-firm contractors, or an auditing firm’s staff needing scoped, temporary access without new account creation.

Microsoft Entra External ID for customers (the modern name for what was Azure AD B2C) is built for the opposite audience: anonymous members of the public. It lets an organization publish a customer-facing application where users self-register with an email address or a social media login, under a fully custom-branded sign-up and sign-in experience, while the organization retains control of that identity experience. This is the answer for retail storefronts, loyalty portals, or patient portals aimed at potentially millions of unknown consumers rather than a known handful of partner employees.

The discriminator the exam wants you to apply every time is simple: is this person a known business partner who already has an organizational identity somewhere, or is this an anonymous member of the general public signing up for the first time? Known partner points to B2B collaboration; anonymous public points to External ID for customers.

Comparing the five pieces

Service	Solves	Typical scenario cue
Microsoft Entra ID	Core sign-in and access for modern apps	”Authenticate with OAuth/SAML,” “sign in to Microsoft 365”
Microsoft Entra Domain Services	Legacy domain protocols, managed	”NTLM,” “LDAP,” “domain join,” “no domain controllers to manage”
Microsoft Entra Connect	On-premises AD to cloud sync	”Same credentials on-prem and in the cloud”
B2B collaboration	Known external partners	”Supplier staff,” “contractors,” “existing corporate login”
External ID for customers	Anonymous public consumers	”Shoppers sign up,” “social login,” “public app”

How the AZ-900 exam tests this

• A scenario names a legacy protocol (NTLM, Kerberos, LDAP) and explicitly rules out managing domain controllers. That combination always points to Microsoft Entra Domain Services, never plain Entra ID.
• A scenario describes wanting one identity that works both on-premises and in the cloud. That’s Microsoft Entra Connect’s signature pattern — watch for it disguised as a merger or acquisition scenario involving multiple on-premises forests.
• A scenario pairs two audiences in one stem — for example, partner-firm auditors needing scoped access alongside patients or shoppers self-registering on a public portal. The exam wants you to route the known-partner half to B2B collaboration and the anonymous-public half to External ID for customers, and will offer a reversed pairing as a wrong answer.
• A scenario mentions “Owner role” or “new internal account” as the proposed fix for external access. These are always the wrong answer for external collaboration scenarios — they over-provision access or fail to solve the real problem of the person having no existing account in the directory.

These identity distinctions come up constantly once questions start layering scenarios together, so work through AZ-900 practice questions that mix legacy protocols, hybrid sync, and external audiences in the same stem. Identity is also the foundation the exam builds its access-control questions on top of, so pair this with Azure RBAC vs. Conditional Access and Azure MFA, SSO, and passwordless authentication to round out the identity domain. Verifying an identity before granting access is also the starting assumption behind Zero Trust and defense in depth, which treats every sign-in as suspect regardless of network location.

Quick reference

• Microsoft Entra ID (formerly Azure AD): cloud identity and access management using OAuth 2.0, OpenID Connect, and SAML.
• Microsoft Entra Domain Services: managed domain join, group policy, LDAP, and NTLM/Kerberos — no domain controllers to deploy or patch.
• Microsoft Entra Connect: synchronizes on-premises Active Directory to Microsoft Entra ID for hybrid sign-in; can sync multiple forests into one tenant.
• B2B collaboration: invites known external partners as guest users who sign in with their existing organizational credentials.
• External ID for customers: lets anonymous consumers self-register with email or social identities for a branded, customer-facing app.
• Entra ID and Domain Services complement each other rather than compete — modern apps use one, legacy apps use the other.
• The exam’s core discriminator for external access: known partner → B2B collaboration; anonymous public → External ID for customers.