Entra ID structure, defined

An access review is a recurring process in which a responsible person certifies that a set of users should still hold a set of access. Compliance frameworks require them; their value depends entirely on whether the reviewer can see what the access actually amounts to.

Admin consent is the mechanism by which a global administrator authorizes an application to access an Entra ID tenant with specific permissions. For application permissions, which operate without a signed-in user, admin consent is mandatory.

Blast radius, applied to a directory, is the complete set of consequences a change would produce: every user who gains access, every user who loses it, and every license assignment that cascades either way. It is the number you need before a change, and the one nothing native computes.

A circular group reference is a membership loop: a chain of nested groups in which following the member-of relationships eventually returns to the starting group. Loops make effective membership ambiguous and are a known cause of provisioning failures.

A delta query is a Microsoft Graph pattern that returns only the changes to a collection since your previous request: created objects, updated objects, and tombstones for deleted ones. It is the efficient alternative to re-reading an entire directory to find out what moved.

Deprovisioning is the teardown half of identity lifecycle: removing access, memberships, and licenses when a person leaves, changes roles, or a project ends. Provisioning gets automated because people complain about missing access; deprovisioning stays incomplete because nobody complains about keeping it.

A Microsoft 365 license reaches a user one of two ways: a direct assignment placed on the user object, or a group-based assignment inherited through membership. The models coexist in most tenants, and the mixture is where licensing confusion concentrates.

Directory drift is the accumulating gap between the structure an organization intends its directory to have and the structure it actually has. Drift is the sum of every reasonable-looking local change whose global consequences nobody evaluated.

A dynamic group computes its membership from a rule over user or device attributes, such as department or employee type, instead of administrators adding members by hand. Membership updates automatically as attributes change.

Effective access is the complete set of resources a user can actually reach once every path is accounted for: direct grants, group memberships, and everything inherited through nesting, plus the licenses granted by their direct memberships. It is the security-relevant truth, and no single native list displays it.

Entra Connect is Microsoft's synchronization service between on-premises Active Directory and Entra ID: users and groups mastered on-premises are projected into the cloud tenant. In hybrid organizations, a large share of the group structure you see in Entra ID was born somewhere else.

A tenant is an organization's dedicated instance of Microsoft Entra ID: the directory holding its users, groups, devices, applications, and license subscriptions, isolated from every other organization's. Everything discussed on this site, nesting, inheritance, drift, happens inside a tenant.

The group expiration policy is an Entra ID lifecycle feature that gives Microsoft 365 groups a lifetime: groups must be renewed before expiry, and inactive ones are deleted, with a restoration window, unless someone acts. It is Microsoft's built-in answer to collaboration group sprawl.

An Entra ID group's members are not just users: a member can be a user, a device, another group, a service principal, or a contact. Every analysis of group structure depends on classifying these correctly, because only group members create nesting.

Group nesting is the practice of adding one group as a member of another group. Members of the nested group become indirect, or transitive, members of the parent, inheriting whatever access and licenses the parent grants.

A group owner is the person accountable for a group: who belongs in it, what it is for, and when it should stop existing. Ownership is the difference between a governed group and an artifact, because every review process ultimately routes its questions to an owner.

Group-based licensing is the Entra ID capability that assigns Microsoft 365 licenses to a group rather than to individual users. Every direct user member inherits the license automatically, and losing membership removes it. Nested groups are not supported: per Microsoft documentation, members of groups nested inside the licensed group do not receive the license.

Keyset pagination is a technique for reading large datasets in pages by remembering the last key seen and asking for rows after it, instead of counting an offset from the start. Its defining property is that page ten thousand costs the same as page one.

License inheritance is the flow of a group-assigned license to a user through group membership. In Microsoft Entra ID the flow is one level deep by design: per Microsoft documentation, only direct user members of the licensed group receive the license, and nested groups do not propagate it.

Microsoft Graph is the unified API for Microsoft 365 and Entra ID: groups, users, memberships, licenses, devices, and much more are all read and written through it. Any tool that analyzes your directory, first party or third party, is a Graph client.

Nesting depth is the number of levels in a chain of nested groups: a group whose member group contains another group sits at depth three. Depth measures how far access and licenses travel from where they are granted to the people who receive them.

An orphaned group is a group that has lost its accountability: it has no owner to answer for it, no members using it, or no remaining purpose anyone can name. Every long-lived tenant accumulates them, because groups are created freely and deleted reluctantly.

A point-in-time snapshot is a complete capture of a directory's structure at a moment: its groups, nesting, memberships, and license assignments as they stood. Two snapshots make history computable: their difference is exactly what changed between the two moments.

Role-based access control, RBAC, grants permissions to roles and assigns people to roles, instead of granting permissions to individuals. Groups are how most organizations implement it: the group is the role, membership is the assignment, and the group's grants are the role's permissions.

Entra ID's two principal group types serve different jobs: security groups control access to resources, while Microsoft 365 groups provision collaboration workloads like a shared mailbox, SharePoint site, and Teams team. Their structural behavior differs in ways that matter for hierarchy design.

A service plan is one individual service inside a Microsoft 365 license SKU: Exchange Online, SharePoint, or Teams inside an E3 or E5, for example. Assignments can disable specific plans, which is how organizations grant a suite while withholding parts of it.

A service principal is the identity an application holds inside a tenant: when an app is granted permissions or added to groups, the service principal is the object doing the holding. Directories increasingly contain as many application identities as human ones.

A SKU, stock keeping unit, is a purchasable Microsoft 365 product: Microsoft 365 E3, E5, F3, or a standalone product like Power BI Pro. A tenant buys a number of seats per SKU, and assignments, direct or group-based, consume them.

Transitive membership is membership in a group through any chain of nesting, rather than by direct addition. If a user is in group C, C is in B, and B is in A, the user is a transitive member of both B and A, and inherits what they grant.

Usage location is a per-user property recording the country where the user consumes services. Some Microsoft services cannot legally be provisioned without it, so a missing usage location can make a license assignment fail even though seats are available and the group is configured correctly.