Microsoft Entra ID

How it works

Entra ID is a directory in the cloud with an authentication service attached. Accounts either live there natively or get synchronized from an on-premises Active Directory, which is still how most companies with a legacy domain run it. When a user signs in, Entra ID validates the credentials, applies multi-factor authentication if your rules demand it, then issues a token the application trusts. That token is the currency of the whole Microsoft 365 stack.

Groups are where fleet work starts to overlap with identity. A user in the group Field Technicians can receive one set of apps, one compliance profile, one Wi-Fi configuration, while Finance gets another. Devices can also be registered or joined to Entra ID, which gives each machine its own identity in the directory alongside the user's.

Names to keep straight: Azure AD and Entra ID are the same product, and Entra is the umbrella brand that also covers Entra ID Governance and Entra Private Access. Azure AD Domain Services is something else again.

Why it matters for a fleet

Identity is the spine that device management hangs from. Without it, each tool keeps its own user list, and the day someone leaves you go disable accounts in five places and forget one. With a single directory, a leaver is disabled once, and the MDM, the VPN and the app store all stop trusting them.

It also decides the user experience of enrollment. Signing in with a work account the employee already knows beats typing an enrollment code from an email, and it means the device lands in the right group automatically, with the right apps, at the first boot.

How Appaloosa handles it

Appaloosa organizes devices into groups and applies policies, apps and enrollment rules per group, whatever your identity provider is. Where a company runs Entra ID, the compliance state Appaloosa reports on a device can feed the access decisions made on the identity side, so a PC that has lost BitLocker or fallen behind on patches becomes a signal rather than a blind spot. Keep the mapping between directory groups and device groups deliberate and documented; it is the part teams usually improvise and later regret. The Windows side is detailed on the Windows MDM page.