Entra is the new name for Microsoft's family of identity and access technologies brought together in one place and under one portal.This marks Microsoft's foray into a full-suite Identity Management which began with the rebranding of its Azure Active Directory framework. 

However, like any other technology, it comes with its own set of limitations. In this comprehensive guide, we delve into the features of EntraID while simultaneously discussing the boundaries that organizations may encounter when implementing this platform.

Features & Drawbacks of Microsoft EntraID:

1. Access Packages:

One of the core features of EntraID is its "Access Packages." These packages function as an Identity Management (IM) shopping cart, allowing organizations to bundle access rights conveniently. This feature simplifies the process of granting permissions to users, especially in large enterprises with complex access requirements. However, it's essential to recognize that the scope of EntraID's access packages is not without limitations.

Limitation: EntraID's access packages are primarily designed for use within Azure AD. While they simplify access management for Azure resources, these Access Packages are limited to just the roles and objects within your Azure Active Directory. Managing access for users with roles beyond Azure AD, such as Salesforce, SAP, or ServiceNow, is not possible within Entra.

2. Governance Capabilities:

EntraID extends Azure AD's governance capabilities, enabling organizations to define access policies, manage user lifecycles, and enforce security policies. It aims to provide a comprehensive framework for identity governance, which is crucial for compliance and risk management.

Limitation: EntraID's governance capabilities might fall short when dealing with complex multi-system environments. The platform's primary focus is on governing objects within Azure AD, limiting its effectiveness in managing access across disparate directories and systems.

3. Conditional Access and MFA:

EntraID includes robust support for Conditional Access and Multi-Factor Authentication (MFA). These security features play a pivotal role in protecting sensitive data and ensuring that only authorized users gain access to resources.

Limitation: While EntraID excels in securing Azure resources, it may not seamlessly integrate with all external applications and services. Organizations utilizing a diverse set of tools may face challenges in implementing uniform Conditional Access policies across their entire ecosystem.

4. Verified ID and Distributed Identity:

EntraID introduces the concept of "Verified ID," which aligns with the emerging trend of distributed identities and self-sovereign identities. This feature holds the promise of a decentralized, trust-based approach to identity management.

Limitation: The adoption of Verified ID and distributed identity models may require a shift in the way organizations approach identity. Achieving full interoperability and trust between different identity providers can be complex and time-consuming, potentially limiting the immediate practicality of this feature.

Addressing the Limitations:

While Microsoft EntraID offers a robust set of features for identity management and access control, it becomes inherently limited by its sole reliance on Azure AD as its only directory as its identity warehouse to manage all its identities (even across external systems). Thus limiting its management capabilities in various avenues.

1. Integration with External Systems: For managing access to external systems, consider using identity management solutions that offer comprehensive connectors and integration capabilities. This allows you to extend governance beyond Azure AD.

2. Recertification and Compliance: Implement a dedicated recertification solution or process to address the limitations of EntraID in recertifying access across various systems. This can help ensure compliance with security policies.

3. Hybrid Identity Management: In complex multi-cloud or multi-system environments, consider a hybrid identity management approach that combines the strengths of EntraID with other IAM solutions to bridge the gap.

4. Verified ID and Distributed Identity: Embrace the concept of verified and distributed identities gradually. Start by exploring use cases where these models align with your organization's goals and where trust relationships can be established.

Conclusion

Microsoft EntraID presents a compelling solution for identity and access management, particularly within the Azure ecosystem. Its features offer valuable tools for simplifying identity governance and enhancing security. However, organizations must be mindful of its limitations, especially when managing access to external systems and diverse environments.

While Azure AD is a single directory, EmpowerID takes a Meta-Directory approach, encompassing all objects, roles, and users from over 100 different external systems. This provides organizations with comprehensive governance, recertification, and risk management capabilities covering all aspects of identity management and extending well beyond Microsoft Entra.