Entra Id License Types
You choose among entra id license types based on your team login needs. Basic plans handle simple logins, while paid plans add group rules and risk checks. Most IT teams link these plans to cloud roles and database permissions. Still, broad group permissions often give users too much power inside target systems. Once a user logs in, the identity plan stops checking their live actions. How entra id license types work in practice Every cloud setup starts with a base directory for user accounts.
Microsoft Entra ID (Azure AD): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You choose among entra id license types based on your team login needs. Basic plans handle simple logins, while paid plans add group rules and risk checks. Most IT teams link these plans to cloud roles and database permissions. Still, broad group permissions often give users too much power inside target systems. Once a user logs in, the identity plan stops checking their live actions.
How entra id license types work in practice
Every cloud setup starts with a base directory for user accounts. The free tier lets you manage users, set up single sign-on, and sync groups. This base plan works well for small teams with simple cloud apps. Admins create user profiles and place them into basic security groups.
Growing teams often need deeper rules for who can log in. Paid tiers add dynamic groups that assign users based on their job titles. They also include conditional rules that check user location and device health before login. If a login looks risky, the system asks for a second factor right away. Higher tiers also add automated risk checks and periodic role reviews for compliance.
To use these features, admins map directory groups to server or database roles. A user logs in once and gets a token for their assigned tools. The target database or server reads the group claim from that login token. Then the system grants the user a matching local role for their session.
What directory licenses solve and what they miss
Directory plans solve the problem of central user management across many cloud tools. When a person leaves the company, admins disable one account to block all logins. Conditional login rules also stop bad actors at the front door. Teams can enforce multi-factor checks and block unknown devices with simple rules.
Yet a directory license only governs the moment a user logs in. Once the database or server accepts the login token, the directory steps back. The identity plan cannot see what SQL queries or shell commands run next. A developer with a valid group role can still run a bad delete query. They can also read raw customer emails, phone numbers, or card numbers in tables.
Microsoft Entra ID (Azure AD): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Static group roles also lead to permission creep over months of project work. Admins often put engineers into broad admin groups to fix urgent outages fast. Later, nobody removes those users from the high-power groups. Even with paid review tools, managers often approve group renewals without checking daily command logs.
Why teams need command-level controls after login
Real security requires looking past the initial login check. Teams must control what happens inside the active database or server session. Instead of granting full group roles all day, teams should approve single tasks. An engineer might need to run one update script on a production table. Directory groups cannot scope permissions down to a single query or command.
Teams also need to protect sensitive fields during normal read queries. When support staff query a user table, the system should rewrite sensitive columns in results. Masking emails, phone numbers, and national IDs keeps private data safe during daily work. Combining directory logins with query-level rules gives teams complete control over their systems.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Do all users in a tenant need the same directory license?
No, you can mix plans across your user base to save money. You only need paid seats for users who use paid login or group features.
Can directory licenses restrict specific SQL queries in a database?
No, directory plans only verify identity and pass group claims during login. The database itself must handle query rules, or you must use a session control tool.
How do directory groups map to server and database permissions?
Admins link a directory security group to a local role on the target system. Anyone in that group gets all permissions tied to that local role upon login.