Entra Resilience Deep Dive

Entra Resilience: A Deep Dive

Key Concepts:

• Entra ID (formerly Azure AD) resilience
• Cell-based architecture
• Geographic regions and tenant location
• Partitions and replicas
• Global Gateway and Regional Gateway
• ESTS (Entra Secure Token Service) and ESTSR (Regional STS)
• Directory Proxy
• Backup Authentication (CCS - Cache Credential Service)
• Managed Identities
• Safe Deployment Practices
• SLA (Service Level Agreement)

1. Introduction: The Importance of Entra Resilience

• Entra ID is a critical identity provider for many organizations, controlling access to Microsoft workloads, cloud services, SaaS applications, and even on-premises resources.
• The increasing reliance on Entra as the primary security layer necessitates a deep understanding of its resilience mechanisms.
• Downtime in Entra can disrupt access to essential services like messaging, email, enterprise applications, and data.

2. Tenant Geography and Cell-Based Architecture

• When creating an Entra tenant, a geographic region (geo) is selected, determining the physical location of the tenant's data.
• The available geos are United States, Europe, APAC (Asia-Pacific), and Australia. There is also a rare "global" type and "go local" for specific regions like Japan with strict data residency requirements.
• Entra ID utilizes a cell-based architecture to enhance resilience and limit the blast radius of failures.

3. Understanding the Cell Structure

• Each geo is divided into four distinct regions, forming the "four legs" of a cell. If a geo doesn't have four regions, one region is duplicated to maintain the four-legged structure.
• Each region houses multiple cells, with each cell serving a specific set of tenants.
• Within a cell, tenants are distributed across multiple partitions, which store the actual objects and data.
• Each partition has multiple replicas within each region, providing redundancy and resilience at the data storage level. The exact number of replicas depends on factors like workload and tenant size.
• Tenants can be moved between partitions or even cells if needed, based on workload changes or behavior.
• Changes are actioned by a primary service and replicated to replicas. Replication is terminated if logical corruption is detected, and transactions are rolled back.

4. Client Access and the Global Gateway

• Clients access Entra services through a global gateway layer.
• DNS resolves the login service (login.microsoftonline.com) to the closest gateway instance.
• DNS records for Entra login services are hosted by both Microsoft and Akamai (AI) for DNS resilience.
• The global gateway exists as a slice in every Azure region, not just the four core regions.
• The gateway is an intelligent reverse proxy that terminates TLS connections, extracts the tenant ID, and looks up the corresponding cell.
• The gateway then routes the request to an appropriate instance within the correct cell.
• Gateways are not cell-aligned and follow safe deployment practices using a ring-based approach to roll out changes gradually.

5. ESTS and Directory Proxy

• The ESTS (Entra Secure Token Service), also known as the secure token service, resides within the cell and issues tokens.
• The ESTS is a scalable layer composed of multiple compute instances.
• A directory proxy layer sits between the ESTS and the partitions, handling communication with the data stores.
• The directory proxy is also a scalable layer with a variable number of compute instances.
• The ESTS and directory proxy are independent services within the same cell, running on separate scalable sets.
• Each leg of the cell is isolated, preventing failures from propagating across regions.
• The ESTS can communicate with other cells for certain operations, such as B2B lookups.

6. Regional STS (ESTSR) and Managed Identities

• Regional STS (ESTSR) instances are deployed in most Azure regions, including the four core regions.
• The ESTSR is the same ESTS code but with different configuration flags and a cache of metadata and token material.
• Azure services use a regional gateway (region.login.microsoftonline.com) to access the ESTSR.
• The ESTSR can issue tokens from its cache, reducing reliance on the global ESTS.
• If the ESTSR doesn't have the required material in its cache, it can call the regular ESTS.
• The ESTSR can serve tokens for up to 3 days if an identity has authenticated within that timeframe.
• Managed Identities always use the regional gateway and ESTSR, resulting in longer-lived tokens (24 hours, proactively refreshed at 12 hours) and increased resilience.
• If the ESTSR is down in an availability zone, it will try another AZ within the same region, and if that fails, it will use the regular ESTS.

7. Backup Authentication (CCS)

• Backup Authentication, also known as CCS (Cache Credential Service), is built on the regular ESTS code but runs on a completely separate infrastructure.
• The CCS has a cache of metadata and signing materials.
• The regular ESTS pushes token information to the CCS cache.
• If the global ESTS is unavailable, the gateway can switch over to the CCS and use its cache to issue tokens for identities that have authenticated within the last 3 days.
• The token issuer type in the signing log will show "Azure AD Backup" when CCS is used.
• Backup Authentication does not support all workloads, particularly those using client secrets or SL IDP flows. It is growing to support more services.

8. SLA and Real-World Performance

• The target SLA for Entra ID is four 9s (99.99% uptime).
• Historical data shows that Entra often achieves five 9s (99.999% uptime).
• Users can view their tenant's SLA attainment in the Entra portal under Identity > Health > SLA Attainment.

9. Safe Deployment Practices

• Safe deployment practices are used for all changes to Entra services.
• Changes are rolled out in rings, starting with a small percentage of traffic and gradually increasing as confidence grows.

10. Conclusion: Trusting Entra Resilience

• Entra ID is designed with multiple layers of resilience, including cell-based architecture, regional STS, and backup authentication.
• Understanding these mechanisms can increase confidence in Entra's ability to handle identity management and access control.
• Customers can improve their resilience posture by using managed identities wherever possible.
• Microsoft takes the responsibility of Entra resilience seriously, implementing architectural components to ensure high availability and minimize the impact of potential failures.