Microsoft Entra ID Setup Guide for Beginners UK 2026

What is Microsoft Entra ID and why does it matter?

Microsoft Entra ID (formerly known as Azure AD) is the cloud-based identity and access management service that sits at the heart of Microsoft 365, Azure, and thousands of third-party applications. If you're moving into IT or cloud administration, understanding how to set it up properly isn't optional, it's the foundation that everything else rests on.

When you create a Microsoft 365 tenant for an organisation, Entra ID is automatically provisioned. But "automatically there" doesn't mean "correctly configured." Most organisations we work with have inherited tenants with weak security posture, unclear user structures, and licensing chaos. Your job as an IT professional is to build it right from the start.

Understanding Entra ID's core components

Before you touch any settings, you need to understand what you're actually building. Entra ID has four main layers:

Your tenant is the top-level container. Every organisation gets one (or should). Think of it as your organisational identity home.

Directories and subscriptions sit inside your tenant. Users and groups live in your directory. Subscriptions link to Azure services and Microsoft 365 licensing.

Users and groups are the people and collections within your directory. Users are individuals. Groups can be security groups (for access control) or Microsoft 365 groups (for collaborative spaces like Teams or SharePoint).

Applications and service principals are the apps you'll register. These let third-party or internal apps authenticate securely.

Get this structure right early, and everything after is straightforward. Get it wrong, and you'll be rebuilding user access schemes six months later while a healthcare trust scrambles to keep their patient record system running.

Setting up your Entra ID tenant step by step

Step 1: Access the Entra ID admin centre

Log into the Azure portal (portal.azure.com) with a Global Administrator account. Navigate to Microsoft Entra ID (you'll see it in the left sidebar, or search for it directly). Bookmark this page, you'll be here constantly.

You're now in the Entra ID overview blade. This is your command centre. Pin it to your dashboard.

Step 2: Configure basic tenant properties

Go to Manage > Properties. You'll see several fields:

Tenant name: This is your Entra ID tenant name (e.g. "Contoso-IT"). You can't change this later, so choose something clear that reflects your organisation.

Tenant ID: A GUID that uniquely identifies your tenant. Copy this and store it securely. You'll need it for app registrations and troubleshooting.

Country or region: This determines default data residency for some services. For UK organisations, select United Kingdom. This matters for compliance (UK GDPR, NHS data residency rules if you're in health).

Notification language: Leave as English (UK).

Access management for Azure resources: This is critical. If you're managing Azure directly, enable this. If you're purely a Microsoft 365 admin, you can leave it off.

Step 3: Set up custom domain names

By default, your tenant comes with a domain like "contoso.onmicrosoft.com". This works, but it's not professional. Most organisations add their own domain (e.g. "contoso.com").

Go to Manage > Custom domain names > Add custom domain. Enter your domain, then follow the DNS verification steps (Microsoft will give you either TXT or MX records to add to your DNS provider). Once verified, you can set it as the default domain for new user creation.

This sounds simple but gets missed constantly. If you don't do it early, every user created will have an ugly onmicrosoft.com address, and fixing it later is tedious.

Step 4: Create and structure your first users

Navigate to Manage > Users > New user. You can either invite external users via email or create native users directly.

For a beginner setup, create a Global Administrator account for yourself (separate from your main account, always keep a break-glass admin). Then create standard user accounts for your test cohort.

Pro tip: Use a naming convention from day one. "john.smith@contoso.com", not "jsmith" or "johnsmith". Consistency saves chaos later.

Step 5: Create security and Microsoft 365 groups

Go to Manage > Groups > New group.

Security groups are for access control. If you need to grant a set of users access to a shared resource, use a security group. Example: "Finance-Team-Access" for your finance application.

Microsoft 365 groups are for collaboration. They integrate with Teams, SharePoint, and Outlook. Example: "Marketing-Collaboration" creates a shared mailbox, Teams channel, and SharePoint site automatically.

Create groups before you add users. Start small, three to five test groups covering different departments or functions.

Step 6: Configure password policy and MFA

Go to Manage > Security > Authentication methods.

Password policy: Microsoft's defaults are sensible. You used to be able to force complex passwords and 90-day rotations. That's gone in 2026 (it was outdated security theatre). Instead, enable password protection (bans common passwords) and ban previous password reuse.

Multi-factor authentication (MFA): This is non-negotiable. Go to Manage > Security > Conditional Access > Create new policy. Start with a simple rule: "Require MFA for all users, all cloud apps." Yes, this can frustrate users, but it's the single biggest security win you can make.

Healthcare organisations and any sector handling sensitive data should enforce MFA from day one. If you're training in IT for a health trust, this will be your first conversation with security.

Step 7: Set up initial Conditional Access policies

Conditional Access lets you build rules like "Allow access only from UK IP addresses" or "Require MFA if login is from an unusual location".

Start conservative. Add one policy: "Require MFA for all cloud applications for all users". Test with a test group first. Once you're confident, roll to production.

Don't create complex policies until you understand the basics. I've seen admins lock themselves out by stacking conflicting rules.

Common pitfalls to avoid

Forgetting to document your setup: Create a simple spreadsheet noting your tenant ID, domain name, admin accounts, and MFA enforcement date. You'll reference it constantly, and future admins will thank you.

Overcomplicating groups too early: Create only the groups you actually need today. You can add more later. Too many empty groups create maintenance debt.

Not testing conditional access policies: Always test on a pilot group before rolling organisation-wide. A poorly designed policy can lock out your entire user base.

Skipping MFA: This isn't optional. Every organisation that's experienced a breach wishes they'd enforced MFA earlier.

Your next step: building admin competence

Setting up Entra ID is technically straightforward once you know where to click. The harder part is understanding *why* each setting matters and when to tighten or loosen restrictions based on your organisation's actual risk profile.

If you're moving into IT administration or cloud roles and want structured training in Microsoft 365 and Azure, the Microsoft 365 Administrator Programme covers Entra ID setup as part of the broader tenant administration curriculum. It's designed specifically for career changers, you don't need prior Microsoft experience. The programme includes hands-on labs where you'll configure a real Entra ID tenant, not just watch slides.

Frequently asked questions

What's the difference between Entra ID and Azure AD?

Entra ID is the new name (as of 2023) for what was previously called Azure AD. The functionality is identical, Microsoft just rebranded to make it clearer that this is an identity service, not exclusively an Azure service. All documentation and portals have been updated to use "Entra ID", but you'll still see "Azure AD" in older resources.

Do I need an Azure subscription to use Entra ID?

No. Entra ID is automatically included with any Microsoft 365 subscription (Business Basic and above) or standalone Azure subscriptions. Many organisations use Entra ID purely for Microsoft 365 identity and never touch Azure services. You only need an Azure subscription if you're managing Azure cloud resources or want to use advanced Entra features like privileged identity management.

How many users can I add to a single Entra ID tenant?

Technically, there's no hard limit, enterprises manage millions of users in a single tenant. However, for most organisations (certainly in the UK mid-market), you'll stay well below 100,000 users. The real question is whether your licensing supports them (Microsoft charges per user for most services), not whether Entra ID can handle it.

Can I change my tenant name or tenant ID after creation?

You can rename your tenant (the display name), but the tenant ID (the GUID) is permanent and can't be changed. This is why documenting it immediately matters, you'll need it for integrations and backups. The tenant ID is yours for life, even if you rebrand the organisation later.

What happens if I enable MFA and users don't have authenticator apps yet?

Enable MFA via a phased rollout. Start with administrators, then move to sensitive users (finance, HR), then general population. Give users 48 hours notice and clear instructions on setting up Microsoft Authenticator. Most modern users can set it up in under 60 seconds. For older or less tech-savvy users, IT helpdesk should be prepared for increased ticket volume for the first week.