How to Set Up Microsoft Entra ID for a Small Business

Microsoft Entra ID (formerly Azure Active Directory) is the identity and access management layer that sits underneath every Microsoft 365 tenant. Set up correctly at the start of a small business, it makes onboarding, offboarding, MFA, single sign-on, and conditional access effortless. Set up wrong or ignored, it becomes the reason security audits fail, ex-employees still have access to company files months after leaving, and MFA fatigue is a daily complaint.

This guide walks through setting up Entra ID for a small business from scratch — the specific steps, the security defaults to enable immediately, groups vs users best practices, and the mistakes that cause most small business Entra ID deployments to drift into chaos.

Some links in this post are affiliate links. If you purchase through our links we may earn a small commission at no extra cost to you.

What Entra ID does

Entra ID is the cloud identity platform that authenticates users, enforces access policies, and manages permissions across:

• Microsoft 365 apps (Outlook, Teams, SharePoint, OneDrive)
• Third-party SaaS apps via single sign-on (Salesforce, Slack, Dropbox, hundreds more)
• Windows devices via Entra join (replacing traditional on-prem Active Directory)
• Custom line-of-business apps

Every Microsoft 365 subscription includes basic Entra ID (Entra ID Free tier). M365 Business Premium and Enterprise E3/E5 include Entra ID Premium (P1 or P2) with advanced features like conditional access. See our AD vs Entra ID comparison guide for the full picture.

Prerequisites — before you start

• Microsoft 365 subscription active (Business Basic, Standard, Premium, or Enterprise tier)
• Global Administrator account access to the M365 tenant
• Business domain (yourcompany.com) verified in M365 admin center
• List of current employees with email addresses and roles

If you don’t yet have M365 set up, start with our Microsoft 365 setup for small business guide first.

Step 1 — Access the Entra admin center

Two ways in:

1. Navigate to entra.microsoft.com and sign in with your Global Admin account.
2. Or, from the Microsoft 365 admin center (admin.microsoft.com), click “Show all” in the left nav, then “Identity” under Admin centers.

You land on the Entra ID Overview. Bookmark this URL — you’ll use it weekly for user management, MFA settings, and access reviews.

Step 2 — Turn on Security Defaults immediately

Before you do anything else, verify security defaults are enabled. This one setting turns on:

• MFA registration required for all users
• MFA challenge for administrator actions
• MFA challenge for risky sign-ins
• Legacy authentication protocols blocked (SMTP AUTH, POP, IMAP without OAuth — these are the primary attack vectors for credential stuffing)

To verify: Entra admin center → Identity → Overview → Properties → Manage security defaults. If enabled, you’re set. If not, enable now.

Security defaults are free (part of Entra ID Free tier). They’re the single most impactful security setting you can enable in Microsoft 365. Enable before you invite the first non-admin user.

Step 3 — Set up groups (do this BEFORE adding users)

Groups are how you manage access at scale. Adding a user to a group grants them all the permissions/licenses/apps associated with the group. Manage groups; users inherit correctly.

Create these core groups for a typical small business:

• All Employees: catch-all group for company-wide announcements, calendars, shared drives everyone should see.
• Executives / Leadership: for sensitive documents, executive-only Teams channels.
• By Department: Finance, Sales, Operations, IT, HR, etc. Each gets a group with their department’s file access.
• By Role: Managers group (with elevated permissions where needed), Contractors group (with restricted access).
• Admins: IT administrators who need elevated M365 access.

Create groups: Entra admin center → Groups → All groups → New group. Choose “Microsoft 365 group” type for most (creates group email, Teams team, SharePoint site automatically). Use “Security group” for pure permissions-only groups.

Step 4 — Add users the right way

Two methods:

Individual user creation

For 1-5 users at a time. Entra admin center → Users → New user → Create new user. Fill in name, username, initial password, assign to groups, assign license.

Bulk creation via CSV

For 10+ users. Prepare a CSV with columns: Name, Username, Initial Password, Job Title, Department, etc. Upload via Users → Bulk operations → Bulk create. Bulk-adds to groups if configured.

Best practices for user accounts

• Username = [email protected] (or firstinitial+lastname). Consistent pattern.
• Initial password: require password change on first sign-in. Never use “Welcome123” or similar shared default.
• Assign to groups at creation — don’t leave for later.
• Assign M365 license at creation — otherwise user can’t access anything.
• Set job title and department — enables dynamic groups and reports later.

Step 5 — Configure MFA properly

Security defaults require MFA registration but let users pick their method. For business, guide users to strong methods:

• Microsoft Authenticator app (best): push notifications or Authenticator-generated code. Free, secure, works offline.
• Hardware security key (highest security): YubiKey 5-series or Feitian. For executive/admin accounts, seriously consider hardware keys.
• Phone call / SMS (avoid where possible): vulnerable to SIM swapping. Fallback only, not primary.

For M365 Business Premium tenants (which include Entra ID P1), you can move beyond security defaults to conditional access — granular rules like “require MFA when signing in from outside the office network” or “block sign-in from countries where we have no employees.” Powerful but complex; start with security defaults and add conditional access as you grow.

Step 6 — Onboarding automation via groups

Once groups are set up correctly, new employee onboarding becomes:

1. Create user account.
2. Add to “All Employees” + department group + role group.
3. Assign M365 license.
4. Done. User inherits email, Teams, SharePoint file access, apps.

Compare to the pre-Entra approach of manually granting 10-20 permissions per new hire. Groups turn 30 minutes of clicking into 3 minutes.

Step 7 — Offboarding — the critical process

When an employee leaves, offboarding is where most small businesses’ Entra ID hygiene breaks down. Standard offboarding process:

1. Change user password to something random. Immediately prevents further sign-in.
2. Sign out user from all sessions (Users → user profile → Sign out).
3. Convert mailbox to shared mailbox (removes M365 license cost; preserves email for manager access). Do this via M365 admin center.
4. Remove from all groups except retention (immediately revokes access to files, Teams, apps).
5. Remove M365 license (frees license for reallocation).
6. Delete or soft-delete the account after 30-90 days depending on retention policy.

Do this within 1 hour of termination or resignation acceptance. Delays = risk of ex-employee data access.

Step 8 — Set up admin roles carefully

Entra ID has 90+ built-in admin roles. Most small businesses only need:

• Global Administrator (1-2 accounts): owner-level access. Should be limited to the business owner + trusted IT person. Enable MFA hardware key.
• User Administrator (1-2 accounts): can create/manage users but not tenant settings. Good for HR-lead onboarding role.
• Exchange Administrator (if needed): mailbox management without full tenant access.
• Helpdesk Administrator (if needed): password resets, basic user support.

Rule: minimize Global Admins. Each additional Global Admin is a potential attack path. 1-2 for a small business; anyone else gets a scoped role.

Step 9 — Enable audit logging

Entra ID logs every sign-in, admin action, and permission change. For compliance and incident investigation:

• Sign-in logs: automatically captured; retain for 30 days on Free tier, 90 days on P1, 1 year on P2.
• Audit logs: admin actions, group changes, password resets.
• Risky sign-ins (P1/P2): Entra flags suspicious activity like impossible-location travel.

Review sign-in logs monthly at minimum. Any failed sign-ins from unusual countries or unusual times = investigate.

Step 10 — Conditional access (if on P1/P2)

M365 Business Premium and E3/E5 include Entra ID P1, which unlocks conditional access. Common policies to add:

• Require MFA when signing in from outside company network (trusted IP ranges).
• Block sign-in from countries where you have no employees.
• Require compliant device (managed by Intune) for accessing sensitive apps.
• Require session timeout of X hours for privileged accounts.

Test conditional access policies on a test account BEFORE applying broadly. Overly-aggressive rules lock out legitimate users.

Common mistakes to avoid

• Skipping security defaults. Free, high-impact. Enable before anything else.
• Adding users directly without groups. Doesn’t scale past 20 users.
• Sharing Global Admin password among 3-4 people. Each person needs their own account with appropriate role.
• Not offboarding on time. Ex-employees with active accounts are the #1 preventable security failure.
• Ignoring the sign-in logs. Suspicious activity there is often the first sign of a compromise.
• SMS-based MFA as the only option. SIM swapping bypasses it. Prefer authenticator app or hardware key.

Related M365 admin topics

Entra ID is one layer of the M365 admin stack. See also our M365 Admin Center basics for the broader tenant management, M365 setup for small business for the initial deployment, and SharePoint vs OneDrive vs Google Drive for storage architecture.

Key takeaways

• Enable Security Defaults immediately after tenant creation — MFA + blocked legacy auth = massive security win.
• Create groups BEFORE adding users. Manage access via groups; users inherit correctly.
• Onboarding = create user + add to groups + assign license = 3 minutes. Not 30.
• Offboarding = change password + sign-out sessions + shared mailbox + remove groups + remove license = do within 1 hour of departure.
• Limit Global Admins to 1-2 accounts with hardware MFA. Use scoped roles for everyone else.

FAQ

Do I need Entra ID Premium for a small business? Free tier + security defaults covers 80% of what a small business needs. Premium P1 (included in M365 Business Premium and E3) adds conditional access, dynamic groups, and better audit retention — worth it for regulated industries or businesses with 25+ employees. P2 adds identity protection and privileged identity management — usually enterprise territory.

Can I move from on-prem Active Directory to cloud-only Entra ID? Yes — many small businesses have. Requires migrating users to Entra ID, joining PCs to Entra (Entra join or hybrid join), and rebuilding group permissions in Entra structure. See our AD vs Entra ID guide for the migration decision framework.

What if I already have M365 set up but ignored Entra ID? Not too late. Enable Security Defaults today. Then start building group structure (create groups, add users to appropriate groups). You’ll see permission and license usage improve within the first week. Full cleanup of an ignored Entra tenant is typically a 2-4 week project depending on complexity.