Azure Tenants and Microsoft Entra ID
A Microsoft Entra tenant is the identity directory used by an organization. It contains the identities that sign in to Microsoft cloud services and can receive access to Azure resources.
- What Microsoft Entra ID is
- What a tenant contains
- How a tenant and an Azure subscription work together
- How to find and switch your current tenant
What is Microsoft Entra ID?
Microsoft Entra ID is Microsoft’s cloud-based identity and access management service. It helps users, devices, applications, and workloads prove who or what they are before they access a service.
You may still see the old name Azure Active Directory in older articles, scripts, screenshots, or conversations. The current product name is Microsoft Entra ID.
What is a tenant?
A tenant is a dedicated instance of Microsoft Entra ID. It normally represents one organization and is separate from other tenants.
A tenant has its own tenant ID, default domain such as contoso.onmicrosoft.com, users, groups, applications, roles, and settings.
Tenant and subscription are different
Stores identities and directory objects. It answers the question: who is signing in?
Contains Azure resources and provides boundaries for billing, quotas, governance, and Azure access.
Every Azure subscription has a trust relationship with one Microsoft Entra tenant at a time. One tenant can be connected to multiple Azure subscriptions.
This distinction is important. Microsoft Entra roles manage directory objects such as users and groups. Azure roles manage access to Azure resources such as virtual machines, networks, and storage accounts.
A simple example
A company has one Microsoft Entra tenant with its employees and groups. The same tenant is trusted by three subscriptions:
A group called Azure-Network-Team can receive a role in one subscription without automatically receiving the same access in the other subscriptions.
How to find the tenant ID
In the Azure portal:
- Search for Microsoft Entra ID.
- Open Overview or Properties.
- Find Tenant ID.
You can also find the tenant connected to a subscription by opening Subscriptions, selecting the subscription, and checking its directory information.
How to switch tenants
An account can have access to more than one tenant. In the Azure portal, select your account in the top-right corner and open the directory switcher.
Before creating or changing a resource, confirm that you are using the correct tenant and subscription. This avoids creating resources in the wrong environment or thinking that a subscription has disappeared because a portal filter is hiding it.
Summary
Microsoft Entra ID manages cloud identities and access. A tenant is a dedicated directory for an organization. An Azure subscription uses one tenant to authenticate identities that can receive Azure roles.
The tenant holds the identities. The subscription holds the Azure resources. Understanding this separation makes the next topics, including resource groups and Azure RBAC, much easier.