Azure AD Is Now Entra ID: What Changed and What Didn't
In this article
Rewritten October 2026: This started as migration guidance published during the rebrand. That work is finished: the deadlines passed, the legacy modules and the old API are gone, and there is nothing left for anyone to do. What remains useful is the reference, so that is what this now is. If you have landed here because you found “Azure AD” in a runbook, a Terraform comment, a certification guide or a script someone wrote in 2021, this page tells you what it is now, what the rename genuinely touched, and which pieces no longer exist at all.
On 11 July 2023, Microsoft renamed Azure Active Directory to Microsoft Entra ID. Tenants woke up to new labels in the portal, new documentation URLs, and security teams asking whether anything needed to change.
Almost nothing did. The rename itself broke no code. What did eventually force work was a set of retirements that were already in motion and that the rebrand drew attention to, and those have now run their course.
Why the Rename Happened
Azure Active Directory was never Active Directory. It doesn’t use LDAP, it doesn’t run on domain controllers, and it has nothing to do with Group Policy. The name confused people for a decade, and the rename fixed it.
It also made room for a product family. Entra ID is the identity service, and Microsoft uses Entra as the brand for a wider set of identity and access products around it: identity governance, workload identities, verifiable credentials, and the network access products that became Global Secure Access. Not every member survived. Entra Permissions Management, the multicloud CIEM product, stopped being sold on 1 April 2025 and was retired on 1 November 2025, so a document that lists it as part of your identity tooling is describing something that no longer exists.
What Didn’t Change
This is the part worth keeping, because it is what makes old material safe to read.
Microsoft Graph was unaffected. Every call to /users, /groups, /applications or /servicePrincipals works exactly as before, because Graph paths never carried the product name. Azure CLI was unaffected: az ad, az ad sp, az ad app and az ad user are still the commands. HashiCorp’s Terraform provider is still called azuread, resources still use the azuread_ prefix, and state files were never touched. Identity resources in azurerm, such as azurerm_role_assignment, were equally untouched.
Authentication was untouched too. OAuth 2.0 and OpenID Connect flows are identical, the token endpoints and scopes are the same, and login.microsoftonline.com is still the authority. Existing app registrations kept their client IDs, tenant IDs and redirect URIs. Conditional Access policies, PIM assignments and Identity Protection risk policies all kept working without modification, and your tenant’s .onmicrosoft.com domain and tenant ID never moved.
So a 2021 script that authenticates with MSAL and calls Graph is still correct today. A 2021 script that uses the AzureAD PowerShell module is not, for reasons that have nothing to do with the name.
What Did Change
In the portal, “Azure Active Directory” became “Microsoft Entra ID”, and identity management moved to its own admin centre at entra.microsoft.com, where Conditional Access, App Registrations, Enterprise Apps and Identity Protection now live. Documentation moved from docs.microsoft.com/azure/active-directory/ to learn.microsoft.com/entra/, with redirects from the old paths. Licence SKUs were relabelled from Azure AD Free, P1 and P2 to Microsoft Entra ID Free, P1 and P2, with no change to what they include.
Any runbook with a screenshot or a click path starting at “Azure Active Directory” is pointing somewhere that no longer exists in that shape.
What Is Already Gone
Three things that the original version of this article told you to migrate away from have since been retired outright. If you meet them now, you are looking at something broken rather than something to plan around.
The AzureAD and AzureADPreview PowerShell modules. Deprecated on 30 March 2024 and retired during 2025. Scripts built on them no longer run.
The MSOnline PowerShell module. Retired on the same track through 2025.
Azure AD Graph (graph.windows.net). Fully retired on 31 August 2025, at the end of an extended-access window that itself required an explicit opt-in from February 2025. Microsoft Graph at graph.microsoft.com is the only identity API.
If you do find a surviving script on the old modules, the cheapest route is no longer a rewrite. Microsoft Entra PowerShell is built on the Graph PowerShell SDK and ships a compatibility mode that Microsoft puts at over 98% coverage of the AzureAD cmdlets:
# Turn on the AzureAD-compatible aliases, then run the old cmdlets
Enable-EntraAzureADAlias
Connect-Entra -Scopes "User.Read.All"
Get-AzureADUser -ObjectId "user@contoso.com" # resolves to the Entra cmdletThat changes a line or two instead of every call. The original advice here was to rewrite each cmdlet by hand against Microsoft.Graph, which was the only option at the time and is no longer the fastest one.
Microsoft docs: Azure AD is becoming Microsoft Entra ID · Azure AD Graph retirement · Microsoft Entra PowerShell
The Cost That Outlasted the Rename
The rename made nothing more secure. Conditional Access policies did not improve on 12 July 2023, and tokens mint identically.
What it did leave behind is a vocabulary split that still costs time. Half a team searches for “Entra” while the other half wrote the wiki under “Azure AD”, and the mismatch surfaces at the worst moment, when someone is following a runbook during an incident and the portal path in it does not exist. That is the one piece of the original advice still worth acting on: when you touch a document, a Terraform comment or a variable description that says Azure Active Directory, rename it as you pass. Future engineers will search for Entra.
Need help with your Azure security posture?
We help enterprises design and tune Azure security controls: WAF policies, Sentinel ingestion, Defender for Cloud, identity governance, and NIS2/DORA readiness.
More from the blog
When Azure Functions Can Replace Entra Application Proxy and When They Cannot
Zero-Credential Architectures: How Managed Identity Changes Everything
