Microsoft Entra ID: Features, Licensing Tiers, and Microsoft Entra Domain Services
Second in this series on Microsoft Entra ID. Where the previous post covered design principles and how Entra ID structurally compares to Active Directory Domain Services, this one covers what Entra ID actually does out of the box, how the licensing tiers gate those capabilities, and Microsoft Entra Domain Services — the managed service that bridges cloud identity with legacy, directory-dependent applications.
Features and capabilities
| Feature | What it does |
|---|---|
| Secure access to cloud resources | Provides secure access to cloud applications and resources through SSO, MFA, and conditional access. |
| User and group management | Lets administrators manage users, groups, and their access permissions. |
| Application management | Enables registering and managing applications that integrate with Microsoft Entra ID. |
| Identity protection | Detects and responds to identity-based threats. |
| Self-service password reset (SSPR) | Lets users reset their own passwords without administrator intervention. |
| Federation | Establishes a trust relationship between separate security domains — commonly between multiple cloud providers, or between a private cloud and a public cloud. |
| Conditional access | Lets administrators define policies that control access based on device, location, and other signals. |
| Cloud app discovery | Surfaces which cloud applications are actually being used across the organisation. |
Several of these — SSPR, application identities, conditional access, identity protection — get their own dedicated, deeper treatment later in this series; this table is the map, not the full territory.
Licensing tiers
The tier structure has changed over the years, and it's easy to end up with outdated tier names in your notes — Microsoft Entra ID doesn't currently have a "Basic" tier; the live line-up is Free, Office 365, P1, P2, and the newer Entra Suite add-on.
| Tier | What it adds |
|---|---|
| Free | Included with every Azure subscription. Basic directory services. Licenses can only be assigned to individual users — group-based licensing needs a paid tier. |
| Office 365 edition | Bundled with Microsoft 365 subscriptions. Adds features like self-service password reset. |
| Entra ID P1 | Adds conditional access, MFA, advanced security reports, self-service password change/reset/unlock, sign-in activity search, group management (My Groups), entitlement management (My Access), app launching (My Apps), delegated password reset and phone number management (My Staff), and automated user provisioning. |
| Entra ID P2 | Everything in P1, plus Identity Protection, Privileged Identity Management, risk-based conditional access, and real-time sign-in and user risk assessment. |
| Entra Suite | An add-on that requires an Entra ID P1 subscription underneath it. Bundles five products: Microsoft Entra Private Access, Microsoft Entra Internet Access, Microsoft Entra ID Governance, Microsoft Entra ID Protection, and premium Microsoft Entra Verified ID (including Face Check). |
I'd originally noted Entra Suite as just "SSO and adaptive MFA" — that undersells it considerably. It's closer to a Zero Trust network-and-identity bundle: Private Access replaces legacy VPN for private app access, Internet Access is a secure web gateway for SaaS and general internet traffic, and Governance/Protection extend conditional access and lifecycle automation across the lot.
It's worth treating "does this tenant have the right licence" as a first-class design question rather than an afterthought — a striking number of features covered elsewhere in this series gate on P1 or P2 specifically: Conditional Access, Access Reviews, administrative unit administration, device write-back, and hardware OATH tokens all require at least P1, several require P2 outright.
Microsoft Entra Domain Services
Microsoft Entra Domain Services is a managed cloud service that gives you domain join, Group Policy, LDAP, and Kerberos/NTLM authentication, without having to deploy or manage your own domain controllers. Microsoft frames its purpose as "AD minimisation" — reducing how much legacy directory infrastructure you need to keep alive, in favour of modern cloud identity — which is a useful way to think about when to reach for it versus running domain controllers yourself.
It synchronises with your existing Microsoft Entra tenant, so users and groups sign in with credentials they already have — only users synchronised from on-premises AD DS, or those with hybrid identities, get access to resources like file shares served through the managed domain. That synchronisation is what makes lift-and-shift possible: legacy applications that depend on LDAP, Kerberos, NTLM, Group Policy, or plain domain join can move into the cloud without being rewritten for modern authentication such as OIDC or OAuth. Microsoft manages deployment, patching, and availability of the domain controllers behind the scene, and you can deploy multiple replica sets across Azure regions to improve availability and support disaster recovery for the legacy applications sitting on top.
Mechanically, it works by creating a managed domain inside your virtual network that stays synchronised with Microsoft Entra ID. Users authenticate with their Microsoft Entra credentials, and legacy applications get lifted and shifted into that managed domain — extending identity management to traditional, directory-dependent applications in the cloud without the overhead of running your own domain controllers.
Gotchas and caveats
The Entra Suite naming is worth double-checking before you use it in a proposal or cost estimate — it changed relatively recently, requires a P1 subscription as a prerequisite, and licensing pages for suites like this tend to shift as Microsoft repackages things. When in doubt, check the current Microsoft Entra licensing page rather than trusting older notes (including these).