If your small business uses Microsoft 365, you already have Microsoft Entra ID. It is the cloud-based directory and identity service that sits behind the scenes, handling sign-ins, passwords, and access rules for your users and apps. Entra ID is the new name for Azure Active Directory, and it is the foundation for managing who can access what in your Microsoft environment.
For a small business, you don't need to be an identity expert to keep things safe and organised. Understanding a few core concepts—users, groups, multifactor authentication (MFA), and administrative roles—can help you avoid the most common mistakes and keep your Microsoft 365 tenant under control. This guide walks through the essentials in plain language.
Quick checklist
- Confirm your Microsoft 365 tenant is active and you can sign in to the Entra admin center
- Create separate user accounts for every employee, no shared logins
- Enable security defaults (free) or Conditional Access (requires Entra ID P1) for MFA
- Use groups to manage access and licences instead of assigning permissions one by one
- Reduce Global Administrator accounts to a minimum and use least-privilege roles
What Microsoft Entra ID is
Microsoft Entra ID is Microsoft's cloud-based identity and access management service. It verifies that users are who they claim to be and applies policies that control what those users can do. Entra ID works with Microsoft 365, Azure, and thousands of third-party software-as-a-service (SaaS) apps via single sign-on.
Related guide: Microsoft 365 Admin Center: A Beginner’s Practical Guide.
Related guide: Microsoft 365 for Small Businesses: What You Actually Need.
The Entra family also includes other products like Entra Permissions Management and Entra Verified ID, but for small businesses, the core Entra ID service is the part you will touch most. When you sign up for Microsoft 365, Entra ID is provisioned automatically as your directory—there is no separate setup step.
Every Entra directory has an initial domain such as yourcompany.onmicrosoft.com. You can add your own custom domain later, but many small businesses keep the default for internal administration.
Practical tip: If you are already using Microsoft 365, open the Entra admin center at entra.microsoft.com with your work account to see your directory.
Users and groups
Users are individual accounts for people in your organisation. Each person gets a unique sign-in and password. Entra ID also supports guest accounts from other organisations, like a contractor or partner, who sign in with their own credentials.
Groups simplify management by bundling users together. Instead of granting access to a dozen people one by one, you grant access to a group and add or remove members. Entra ID has two main group types: security groups for access control and Microsoft 365 groups for collaboration (like a shared mailbox or Teams site).
Setting up users
To create a user in the Entra admin center you need the User Administrator role (or Global Administrator). Fill in the basic details: name, username, and initial password. Decide whether the user is a member or a guest. Members are your full-time employees; guests are external collaborators.
Using groups wisely
Create groups for departments or projects. Security groups can contain users, devices, or even service principals (app identities). Microsoft 365 groups can only contain users. Use assigned membership for simplicity, or dynamic rules if you have Entra ID P1 and want automatic updates based on attributes like job title.
Best practice: give every group at least two owners, use a naming convention, and review membership periodically to remove stale accounts.
Practical tip: Group-based licensing can save time if you assign Microsoft 365 licences to groups rather than individual users.
Authentication and MFA
Authentication is how Entra ID ensures you are really you. The simplest form is a username and password, but that is weak on its own. Multifactor authentication (MFA) requires a second factor from a different category: something you know (password), something you have (phone or hardware key), or something you are (biometrics).
Entra ID supports several MFA methods: Microsoft Authenticator app with push or code, passkeys (FIDO2 security keys), SMS, voice call, OATH tokens, and Windows Hello for Business. Using the Authenticator app or a passkey is more secure than SMS, but any MFA is far better than none.
Security defaults: the fast, free MFA baseline
If your tenant uses Entra ID Free, security defaults are the simplest way to protect everyone. When you turn on security defaults, all users must register for MFA, and anyone with a privileged admin role must use MFA every single sign-in. Legacy authentication protocols (like older email apps) are blocked, and device code flow is blocked.
Conditional Access for more control
With Microsoft Entra ID P1 (included in many Microsoft 365 Business Premium plans), you can use Conditional Access policies for finer control. For example, you can require MFA only when someone signs in from outside your office network, or block sign-ins from countries you do not do business in. If you implement Conditional Access, Microsoft recommends disabling security defaults to avoid conflicts.
Practical tip: Start with security defaults if you are unsure. You can move to Conditional Access later when you understand your risk profile.
Administrative roles
Entra ID has dozens of built-in admin roles. The most powerful is Global Administrator, which can do anything in the tenant. You should keep only a tiny number of Global Admins and use more specific roles for daily tasks.
Least-privilege roles for a small business include User Administrator (create and manage users), Helpdesk Administrator (reset passwords), Billing Administrator (manage invoices and subscriptions), and License Administrator (assign or remove licences).
The Microsoft 365 admin center can manage a few of these roles, but the Entra admin center shows the full list. Role assignments apply across Microsoft services that use Entra identities, so a User Administrator in Entra ID can also create users in Microsoft 365.
Emergency access accounts
Microsoft guidance strongly recommends keeping two cloud-only 'break glass' accounts granted Global Administrator permanently. These are for emergencies only: if your main admin is locked out or compromised. Protect them with very strong passwords stored offline and consider additional safeguards such as dedicated Conditional Access policies that block risky sign-ins.
Practical tip: Use a dedicated admin account for administrative tasks and a separate normal user account for everyday email and documents.
Microsoft 365 relationship
Every Microsoft 365 tenant is automatically a Microsoft Entra ID tenant. Your Microsoft 365 users, groups, and security settings live in Entra ID. The Microsoft 365 admin center gives you a friendly interface for common tasks, while the Entra admin center exposes more advanced identity and access controls.
For example, you can create a user in the Microsoft 365 admin center and that user immediately appears in Entra ID. Or you can manage MFA settings in either place, but Conditional Access policies are only in Entra ID.
This overlap can be confusing at first. A good rule of thumb: use the Microsoft 365 admin center for licensing, billing, and quick user changes; use the Entra admin center for groups, roles, MFA, and security policies.
Practical tip: The Entra admin center URL is entra.microsoft.com. Bookmark it alongside admin.microsoft.com.
Common beginner mistakes
Small businesses often make the same identity mistakes. Here are the most important ones to avoid.
Using a Global Administrator account for daily work: this account should be locked down and used only for administrative tasks. Create a separate normal user account for email and web browsing.
Skipping MFA for admins or service accounts: admins are the highest-value targets. Enable MFA at minimum for all admins, and ideally for all users.
Leaving legacy authentication enabled: older protocols like IMAP and POP3 do not support MFA and are common entry points for attacks. Security defaults block them; if you use Conditional Access, block legacy auth explicitly.
Not setting up emergency access accounts: if you lose your only Global Admin access, Microsoft support cannot get you back in easily. Create at least two break-glass accounts before you need them.
Granting overly broad roles: it is tempting to make helpdesk staff Global Administrators so they never get blocked. Instead, assign roles like Helpdesk Administrator or Password Administrator that match their actual job.
Practical tip: Review admin role assignments monthly. Remove users who no longer need elevated access.
What to learn next
Once you are comfortable with the basics, consider these next steps:
Implement Conditional Access policies (requires Entra ID P1) to replace security defaults for more targeted controls.
Explore self-service password reset so users can reset their own passwords safely.
Set up group-based licensing to automate Microsoft 365 licence assignment.
Learn about app registrations if you need to integrate third-party tools with your tenant.
Investigate Microsoft Entra ID Protection (P2) for risky sign-in detection and automated response.
Frequently Asked Questions
Is Microsoft Entra ID the same as Azure Active Directory?
Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023. The service and features are the same; only the name changed.
How do I access the Entra admin center?
Sign in with your work account at entra.microsoft.com. You need at least a User Administrator role to manage users, and a Global Administrator for tenant-wide settings.
Do I need to pay extra for Microsoft Entra ID?
No, a basic version is included with Microsoft 365 subscriptions. The free tier includes core directory features and security defaults. Premium features like Conditional Access and identity protection require Entra ID P1 or P2 licences.
What is the difference between a member and a guest user?
A member is an internal user who belongs to your organisation. A guest is an external user from another organisation, like a contractor, who authenticates with their own credentials. Guests have more restricted default permissions.
Can I manage Microsoft Entra ID from the Microsoft 365 admin center?
You can manage some user and role settings from the Microsoft 365 admin center, but advanced features like groups, Conditional Access, and MFA policies are only in the Entra admin center.
Final Thoughts
Microsoft Entra ID is not as intimidating as it first appears. For a small business, the key is to lock down the basics: use separate accounts for every employee, enable MFA for everyone, keep Global Administrators rare, and use groups to manage access efficiently. If you are already on Microsoft 365, you have everything you need to start improving your identity security today.
Take small steps. Review your current users and admins, turn on security defaults if you have not already, and experiment with groups. Your future self will thank you.
