What is Microsoft Entra?
Microsoft Entra is a family name covering ten products, not one. Here is what each does, which you already own with Microsoft 365, and the one thing Entra ID cannot tell you about your organization.
Microsoft Entra is Microsoft's family of identity and network access products.
Ten products carry the name as of August 2026. Almost every organization runs exactly one of them: Microsoft Entra ID, formerly Azure Active Directory.
A correction before anything else. An earlier version of this page described a product called Microsoft Entra Edge. There is no such product. It was not renamed and it was not retired. We got it wrong, and the error sat on this page from July 2023 until August 2026.
Two other errors sat here with it. All of them are listed at the end of this post. Everything below is checked against Microsoft's own product family documentation, retrieved August 2026.
The Entra name covers ten products, not one
Microsoft Entra is a family name. Nothing is called "Microsoft Entra" on its own, which is the root of most of the confusion around it.
Most organizations touch two or three of these products and pay for one.
| Product | What it does | Do you already have it? |
|---|---|---|
| Entra ID | Authenticates users and enforces access policy. Formerly Azure Active Directory. | Yes. Every Microsoft 365 tenant runs it. |
| Entra ID Governance | Automates access requests, assignments and access reviews. | No. Entra Suite or standalone. |
| Entra ID Protection | Detects identity risk and remediates it automatically. | With Entra ID P2. |
| Entra Private Access | Reaches private apps and corporate networks without a VPN. | No. Entra Suite or standalone. |
| Entra Internet Access | Secures access to internet, SaaS and Microsoft 365 resources. | No. Entra Suite or standalone. |
| Entra External ID | Gives partners and customers their own identities. | No. Billed separately. |
| Entra Verified ID | Issues and verifies decentralized credentials. | Premium capabilities sit in Entra Suite. |
| Entra Workload ID | Identities for applications, services and containers. | No. Separate add-on. |
| Entra Agent ID | Authentication, authorization and governance for AI agents. | No. Newest member of the family. |
| Entra Domain Services | Managed LDAP, Kerberos and group policy for legacy applications. | No. Billed as an Azure service. |
Entra ID is the one you already run
Microsoft announced the rename from Azure Active Directory on 11 July 2023. We covered that at the time in why Microsoft renamed Azure AD to Entra ID. The product did not change. The name did.
Entra ID authenticates users and decides what they can reach. Single sign-on, conditional access, multi-factor authentication, group membership, and the employee records themselves all live here.
It comes in three tiers:
- Free. Included with any Microsoft cloud subscription, which means every Microsoft 365 plan.
- P1. Included with Microsoft 365 Business Premium, E3 and E5. Adds conditional access and self-service password reset.
- P2. Included with Microsoft 365 E5. Adds Entra ID Protection risk detection and privileged identity management.
Worth saying plainly, because this page got it wrong for three years: Entra ID is not a secure web gateway. An earlier version of this post described it as "an identity-centric Secure Web Gateway that guards access to all internet, SaaS, and Microsoft 365 resources". That is Microsoft's description of Entra Internet Access, a different product in the same family.
Greg Bennett
Global Secure Access is the network half of Entra
In July 2023 Microsoft added two network products: Entra Internet Access and Entra Private Access. Together they are administered as Global Secure Access, Microsoft's Security Service Edge offering.
Private Access reaches internal applications without a VPN. Internet Access secures and filters outbound traffic to SaaS and the public internet.
Both apply conditional access at the network layer, so every request is authenticated, authorized and encrypted regardless of where it originates. That is the Zero Trust part of Entra, and it belongs to these two products.
If you are looking for secure remote access to internal resources, Private Access is the product. It is what the fictional "Entra Edge" section on this page was clumsily describing.
Entra Suite bundles five products and needs P1 underneath
Microsoft Entra Suite reached general availability in July 2024, a year after this post first published. It bundles Private Access, Internet Access, ID Governance, ID Protection, and the premium Verified ID capabilities.
It requires Entra ID P1 as a prerequisite. Microsoft 365 E7 includes the Suite outright.
If your organization is on E3 and evaluating a VPN replacement, this is the bundle the Microsoft account team will put in front of you.
Permissions Management was retired on 1 October 2025
Entra Permissions Management was a Cloud Infrastructure Entitlement Management product. It reported excessive permissions across Azure, AWS and Google Cloud, which is a much narrower job than the name suggests. It was never a general place to manage what employees can see.
Microsoft announced end of sale and retired it on 1 October 2025. Organizations that used it for multicloud entitlement visibility need a replacement, and there is no successor under the Entra name.
This page previously listed it as a live component and described it as a way to "define and manage permissions for all users". Both statements were wrong.
Entra ID knows who your employees are. It does not know who they report to.
Most people reading this page are not buying an identity product. They arrived because Entra ID is the system their employee data sits in, and they want to build something on top of it.
So here is the part that matters for that.
Entra ID is the most authoritative record of who works at your organization. It is right about identity almost every time somebody signs in. That is the job it was built for and it does it well.
It is a considerably weaker record of organizational structure.
We measured 65 Microsoft 365 tenants at first sync, before any cleanup work, for The State of Employee Directories in 2026. At that first read of untouched Entra ID data:
- The manager field was populated for 42% of employees.
- Average profile completeness across the core directory fields was 30.8%.
- 33% of the organizations were directory-ready, meaning name, email, job title and photo each at 60% coverage or above.
Two numbers, one system. Entra ID is close to perfect at authentication and under half right on reporting lines, and those are not the same job. Signing in only requires the tenant to confirm that you are you. Nothing in that process ever reads the manager field, so nothing in that process ever keeps it current.
Org chart software reads that field. It does not create it. We wrote about the specific fields that break a chart in 5 missing employee data fields that quietly break your org chart.
What those numbers do not prove
The cohort is self-selected. Every organization in it had already decided its directory needed work before we measured anything. Organizations that never gave it a thought are not in the sample, and their numbers could be better or worse.
The 42% is a baseline, not a verdict on Microsoft. The same figures would appear in any employee directory product reading the same tenant on day one. The follow-up study, The Employee Directory Data Problem Is Fixable, measured the same 65 tenants later, and every one of them ran its own cleanup work over that window. We cannot separate what the software contributed from what the administrators did.
One more thing we cannot tell you. We do not have a number for how many administrator hours a manager-field cleanup takes at 2,000 employees. We should have one. We do not. Until we measure it, treat any vendor's estimate of that effort, including ours, as marketing rather than data.
Check your own tenant before you buy anything
Open the Microsoft Entra admin center and export your user list. Then count three things across active employees only, excluding guests, service accounts and shared mailboxes:
- How many have no manager.
- How many have no job title.
- How many have no photo.
It takes an afternoon. Those three counts tell you whether org chart software reading this tenant will produce anything usable, because every vendor in the category, us included, reads exactly those fields on day one and gets exactly the number you just measured.
If the manager field is thin, no software fixes that by rendering it more attractively.
If the counts come back healthy and you are ready to compare products, start with 12 best employee directory software in 2026.
Frequently asked questions
Is Microsoft Entra the same as Azure AD?
No. Azure Active Directory was renamed Microsoft Entra ID, announced on 11 July 2023. Entra ID is one product inside Microsoft Entra, which is the family name for ten products.
Is Microsoft Entra Edge a real product?
No. There is no Microsoft Entra product called Edge and there never has been. Microsoft's product family documentation lists ten Entra products as of August 2026, and Edge is not among them. Secure remote access to internal corporate resources is Microsoft Entra Private Access.
Is Entra ID free?
The Free tier is included with any Microsoft cloud subscription, including every Microsoft 365 plan. Entra ID P1 is included with Microsoft 365 Business Premium, E3 and E5. Entra ID P2 is included with Microsoft 365 E5.
What is the difference between Entra ID P1 and P2?
P1 adds conditional access and self-service password reset to the Free tier. P2 adds Entra ID Protection risk detection and privileged identity management on top of P1.
Do I need Microsoft Entra Suite?
Only if you are replacing a VPN or a secure web gateway, or adding access reviews and identity lifecycle workflows. It requires Entra ID P1 underneath, and Microsoft 365 E7 includes it.
What happened to Microsoft Entra Permissions Management?
Microsoft announced end of sale and retired it on 1 October 2025. It was a multicloud entitlement management product covering Azure, AWS and Google Cloud, not a general permissions tool.
Can I build an org chart from Entra ID?
Only as far as the manager field allows. Across 65 Microsoft 365 tenants measured at first sync, the manager field was populated for 42% of employees. Org chart software reads that field, it does not create it, so the chart is only as complete as the tenant behind it.
Corrections to this post
Published 12 July 2023. Rewritten 16 August 2026. Four changes worth naming:
- Removed a section describing "Microsoft Entra Edge", a product that does not exist and never has. The capability it described belongs to Microsoft Entra Private Access.
- Corrected Microsoft Entra ID, previously described as "an identity-centric Secure Web Gateway". That is Microsoft's description of Microsoft Entra Internet Access.
- Removed Microsoft Entra Permissions Management from the list of current products. It was retired on 1 October 2025.
- Added Entra ID Governance, Entra ID Protection, Entra External ID, Entra Domain Services, Entra Agent ID, Entra Suite and Global Secure Access. None of these existed under those names when this post first published.
Product facts on this page are taken from Microsoft's Microsoft Entra product family documentation, retrieved 16 August 2026. First-party figures are from the OneDirectory dataset described in Employee Directory and Org Chart Statistics 2026.
