Microsoft Entra ID Documentation

Microsoft Entra is a family of identity and network access products designed to implement a Zero Trust security strategy. It provides tools to verify identities, validate access conditions, check permissions, encrypt connection channels, and monitor for compromise. The product family is categorized by the type of entity being secured:

Zero Trust Access Controls

• Microsoft Entra ID: The foundational cloud-based identity and access management service providing authentication and policy enforcement. Every tenant includes an initial domain (e.g., contoso.onmicrosoft.com).
• Microsoft Entra Domain Services: Provides managed domain services like group policy, LDAP, and Kerberos/NTLM for legacy applications in the cloud.

Employee Access

• Microsoft Entra Private Access: Secures access to private apps and corporate networks without a VPN.
• Microsoft Entra Internet Access: Secures access to internet resources and SaaS apps, including web content filtering.
• Microsoft Entra ID Governance: Automates identity lifecycle management, access requests, and reviews.
• Microsoft Entra ID Protection: Detects and remediates identity-based risks using tools like risk-based Conditional Access policies.
• Microsoft Entra Verified ID: A decentralized identity (DID) service for issuing and verifying digital credentials.

Customer and Partner Access

• Microsoft Entra External ID: Manages collaboration with business partners (guests) and customer identity and access management (CIAM) for consumer apps.

Workload and AI Agent Access

• Microsoft Entra Workload ID: Manages identities for applications, services, and containers (e.g., GitHub Actions).
• Microsoft Entra Agent ID: A framework for providing purpose-built identities to AI agents to ensure governed, least-privilege access.

The Global Secure Access operations guide suite provides post-deployment procedures for managing the service in an enterprise environment. It is organized into three main categories:

1. Shared Operations

These guides cover cross-cutting operational concerns:

• Common operations: Covers the RACI matrix (roles and responsibilities), change management, metrics, and reporting frameworks.
• Security operations for network access: Focuses on security monitoring, detection patterns, Microsoft Sentinel analytics rules, and cross-signal investigation.
• PowerShell samples: Provides automation scripts for monitoring, configuration backup compliance, role assignment reviews, and alert analysis.

2. Capability-Specific Operations

Each capability guide follows a standard structure: Alerting and monitoring, Maintenance and health checks, Integration and automation, Operational metrics, and Troubleshooting.

• Private Access operations: Manages connector health, application segments, ZTNA alerting, and Graph API automation.
• Internet Access operations: Manages web filtering policies, TLS inspection, URL categorization, and threat blocking metrics.
• Remote Networks operations: Monitors GRE/IPsec tunnels, branch site capacity, CPE device health, and tunnel failover.
• Microsoft Traffic operations: Manages Microsoft 365 traffic profiles, compliant network enforcement, endpoint coverage, and service performance.

3. Templates and Checklists

Use these resources for structured operational tasks:

• Daily health check: A consolidated checklist for all capabilities.
• Private Access health check: A specific checklist for Private Access connectors and segments.
• Change request template: A template for documenting configuration changes.
• Communication plan template: A template for notifying stakeholders of planned changes.

Deploying a Customer Identity and Access Management (CIAM) solution using Microsoft Entra External ID involves a six-step planning process. This process ensures consistent app integration and tenant management separate from your workforce directory.

Deployment Workflow

1. Create an external tenant: Establish a dedicated resource for customer identities and app registrations.
2. Choose an authentication approach: Decide between Browser-delegated (Microsoft hosts the UI) or Native authentication (your app hosts the UI).
3. Register your application: Establish trust between your app and the external tenant.
4. Integrate a sign-in flow: Create user flows to define sign-in methods, attributes, and identity providers.
5. Secure your sign-in: Implement MFA, bot protection, and account takeover (ATO) protection.
6. Customize your sign-in: Apply branding, custom domains, or authentication extensions.

Microsoft Entra and Palo Alto Prisma Access can coexist to create a unified SASE (Secure Access Service Edge) environment. Depending on your requirements, you can deploy them in several coexistence scenarios:

1. Microsoft Entra Private Access with Palo Alto Prisma Access for secure Internet Access: Global Secure Access handles private application traffic, while Prisma Access captures only Internet traffic.
2. Microsoft Entra Private Access with Palo Alto Prisma Access for Private Application and Internet Access: Both clients handle traffic for separate private applications. Global Secure Access handles Microsoft Entra Private Access applications, while Prisma Access handles applications via service connections or ZTNA connectors. Internet traffic is handled by Prisma Access.
3. Microsoft traffic with Palo Alto Prisma Access for Private Application and Internet Access: Global Secure Access handles all Microsoft 365 traffic. Prisma Access handles private applications (via service connection/ZTNA) and Internet traffic.
4. Microsoft Entra Internet Access and Microsoft traffic with Palo Alto Prisma Access for Private Application Access: Global Secure Access handles Internet and Microsoft 365 traffic. Prisma Access captures only private application traffic via service connections or ZTNA connectors.