Understand the role of Microsoft Entra ID in endpoint management

This set of vocabulary flashcards covers the fundamental roles, device identity types, licensing tiers, and management features of Microsoft Entra ID within an endpoint management infrastructure.

Microsoft Entra ID

The centralized identity provider and access management foundation for Microsoft Intune and modern endpoint management.

Device identity

An object in Microsoft Entra ID that represents a physical device, allowing it to be tracked and managed similarly to user accounts.

Microsoft Entra registration

Also called workplace join, it allows users to register personal devices (BYOD) with an organization to enable single sign-on and basic management.

Microsoft Entra join

Connects corporate-owned Windows devices directly to Microsoft Entra ID without requiring an on-premises Active Directory.

Microsoft Entra hybrid join

Extends on-premises Active Directory-joined devices with a Microsoft Entra identity, serving as an interim step toward full cloud identity.

Mobile Device Management (MDM) certificate

A certificate installed by Intune on a device during enrollment to establish a trusted connection between the device and the Intune service.

Microsoft Entra groups

Security or Microsoft 365 groups used to determine which users and devices receive specific Intune policies and app deployments.

Conditional Access

Policies that enforce access requirements based on user identity, device compliance status, location, and risk level.

Single sign-on (SSO)

A capability for devices with Microsoft Entra identities that reduces authentication prompts when accessing cloud and on-premises resources.

Microsoft Entra ID Free

A subscription tier included with Microsoft 365 and Azure that provides basic user and device management.

Microsoft Entra ID P1

A license required for features like dynamic groups, self-service group management, and hybrid identity infrastructure.

Microsoft Entra ID P2

A license tier that adds identity protection and privileged identity management capabilities.

Microsoft Intune license

Required for mobile device management; often bundled with Microsoft 365 E3, E5, or available as a standalone subscription.

Least-privilege access

An administrative best practice of assigning only the specific permissions needed for individual roles to protect against credential compromise.