If you already know Microsoft Entra ID, this guide maps its concepts, architecture, and workflows to Alibaba Cloud RAM so you can find equivalent features and avoid confusion from terminology differences.
Why you need this guide
RAM and Microsoft Entra share similar goals but differ in terminology and architecture. Applying Azure experience directly can cause confusion. Three common examples:
-
"Role" means different things: In Azure, a role is a collection of permissions. In Alibaba Cloud, a RAM role is an identity entity that other identities assume.
-
Unified vs. separated control: Azure separates identity management (Microsoft Entra) from resource access control (Azure RBAC). Alibaba Cloud RAM manages both within a single service.
-
No service principal concept: Alibaba Cloud does not have a dedicated programmatic identity type. Instead, you use a RAM user with an AccessKey for long-term credentials, or assume a RAM role for temporary access.
This guide maps concepts and scenarios systematically to help you build a mental model for transitioning from Azure/Microsoft Entra to Alibaba Cloud access control.
In this guide
This guide covers:
-
Product mapping: How core Azure services map to Alibaba Cloud services and where design philosophies differ.
-
Core concept mapping: Resource hierarchies, identity entities, and permission models compared side by side.
-
Scenario guidance: Alibaba Cloud equivalents for common Azure workflows — authentication, cross-account access, auditing, and development.
Product mapping
The following table maps core Microsoft Entra services to Alibaba Cloud equivalents.
|
Azure service |
Alibaba Cloud service |
Description |
|
The core identity and access management (IAM) service for each platform. Supports MFA, SSO, application integration, and token issuance. Identity authentication and application integration. |
||
|
RAM uses policies to manage all resources within an account. Permission concept mapping. |
||
|
APIs for managing identity entities, application access, and policy assignments. Development and SDKs. |
||
|
Cross-account/tenant access. Cross-account/tenant access. |
Design philosophy differences
Both platforms provide IAM, but take different architectural approaches:
Microsoft Entra ID is a standalone identity service. An Entra ID tenant acts as a dedicated identity boundary, separate from Azure resource subscriptions. Users, applications, and access policies exist within this tenant.
Alibaba Cloud RAM is built into the Alibaba Cloud account. The account serves as both an identity boundary and a resource boundary. RAM users, roles, and policies are defined within the account scope, making the relationship between identities and resources more direct.
Core concept mapping
This section maps the terminology and key differences between the two platforms across resource architecture, identity entities, and permission models.
Resource management architecture
Both platforms organize resources in a hierarchy, but the names and roles of each level differ.
|
Azure concept |
Alibaba Cloud concept |
Level |
Description |
|
Tenant |
Management account |
Top-level container |
The top-level management container for an enterprise. The management account owns the entire Resource Directory and has full control over the Resource Directory, folders, and member accounts. The Root folder is the top-level node of the directory structure. |
|
Management Group |
Folder |
Organizational unit |
Organizes and manages multiple subscriptions or accounts. Both support nesting. |
|
Subscription |
Member account |
Isolation boundary |
A member account is the Alibaba Cloud equivalent of an Azure subscription — a resource isolation boundary. |
|
Resource Group |
Resource group |
Grouping unit |
A logical container for resources. In Alibaba Cloud, resource groups are not used for lifecycle management. |
|
Resource |
Resource |
Resource |
A cloud resource such as a virtual machine, storage, or database. |
-
Azure resource hierarchy
Azure uses a five-level hierarchy: tenant > management group > subscription > resource group > resource. The tenant is the identity boundary. Management groups enforce compliance across subscriptions. A subscription is the basic billing and isolation unit.
-
Alibaba Cloud resource hierarchy
Alibaba Cloud uses a hierarchy of management account > folder > member account > resource group > resource. The management account owns the Resource Directory. Folders organize member accounts, and member accounts are resource isolation boundaries.
Key differences
-
Identity vs. resource boundaries: An Entra ID tenant isolates identity data (users, apps, policies) and cannot directly contain Azure resources. An Alibaba Cloud management account is an Alibaba Cloud account and can hold resources directly, though creating business resources under the management account is not recommended.
-
Optional Resource Directory: An Azure subscription must belong to a tenant and management group hierarchy. Alibaba Cloud's Resource Directory is optional. The management account and folder hierarchy become available only after you enable it. Without Resource Directory, an account operates as a standalone top-level container.
Identity concept mapping
The following table maps identity entities between the two platforms.
|
Microsoft Entra term |
Alibaba Cloud RAM term |
Entity type |
Description |
|
Human identity |
A RAM user belongs to a single account and cannot span accounts (unlike Entra ID guest users). |
||
|
Programmatic identity |
A RAM user with an AccessKey works like a service principal with a client secret. |
||
|
Programmatic identity |
Credential-free access for workloads. Alibaba Cloud implements this through RAM roles. |
||
|
Grouping |
RAM user groups are used only for batch authorization. |
||
|
User or service principal granted the |
RAM user or RAM role granted the |
Administrator |
A RAM super administrator has full control over all resources (including identities) within the account. An Entra ID global administrator can only manage identities, not subscriptions. |
Key differences
-
Human identity design: Entra ID strictly separates human and programmatic identities. A RAM user is a general-purpose identity — add a console password for human access, or create an AccessKey for programmatic access.
-
Programmatic identity design: Entra ID has a dedicated service principal for application authentication. Alibaba Cloud has no equivalent entity type. Both RAM users (with AccessKeys) and RAM roles can serve programmatic workloads. For temporary, more secure access, a program can assume a RAM role instead of using long-term AccessKeys.
Permission concept mapping
The following table maps permission concepts between the two platforms.
|
Azure/Microsoft Entra term |
Alibaba Cloud RAM term |
Description |
|
A collection of permissions that defines what actions an identity can perform. |
||
|
Associates a policy with an identity. |
||
|
Predefined permissions provided by the cloud provider. |
||
|
User-defined permissions tailored to specific needs. |
||
|
Condition-based access control, such as source IP restrictions or MFA requirements. |
Key differences
-
Semantic differences between roles and policies
This is the most important conceptual difference. An Azure role is a container of permissions, not an identity. A RAM role is an identity entity that must be assumed and granted a policy before it can act. What Azure calls a "role" maps to what Alibaba Cloud calls a "policy."
-
Differences in policy scope
The Microsoft ecosystem splits permissions: Entra RBAC roles control tenant resources (users, groups, apps), while Azure RBAC controls cloud resources (VMs, storage). Alibaba Cloud uses a unified model — a single RAM policy covers all services and resources under one account.
A RAM policy supports granularity from the service level down to individual actions and resources.NotePermission granularity varies by Alibaba Cloud service. Alibaba Cloud services that support RAM.
Scenario guidance
This section maps Azure/Microsoft Entra workflows to Alibaba Cloud equivalents for authentication, cross-account access, auditing, and development.
Identity authentication and application integration
Both platforms support MFA, enterprise SSO, and application integration, but differ in design and implementation.
|
Microsoft Entra |
Alibaba Cloud |
Use case |
Description |
|
RAM user/user group management |
Manage users/groups |
Create, delete, and modify users and user groups. |
|
|
Multi-factor authentication |
RAM supports virtual MFA (equivalent to Entra Software OATH tokens), passkeys, security mobile phones (equivalent to Entra SMS), and security emails. |
||
|
Identity federation |
Alibaba Cloud supports both user-based SSO and role-based SSO for integration with an enterprise IdP. CloudSSO suits multi-account scenarios within a Resource Directory. |
||
|
Enterprise SSO |
OAuth application management provides authorization integration for Alibaba Cloud services. IDaaS acts as an independent IdP for enterprise application integration. |
||
|
- |
Account synchronization |
Synchronize on-premises enterprise identities to the cloud. |
|
|
Credential token service |
Alibaba Cloud STS is used to issue temporary security credentials in role assumption scenarios. The OAuth service is used to issue access tokens for OIDC/OAuth applications. |
Key differences
-
Identity federation
Entra ID can act as both an IdP and a service provider (SP). Alibaba Cloud RAM primarily acts as a service provider, trusting your enterprise IdP.
-
Token services
Entra ID uses a single token endpoint supporting OAuth 2.0 and OIDC natively. Alibaba Cloud splits this into two services:
-
STS: Issues temporary security credentials for role assumption and role-based SSO.
-
OAuth service: Issues JWT access tokens for official tools (like Alibaba Cloud CLI) and OIDC/OAuth applications registered in RAM.
-
Cross-account/tenant access
Both platforms support cross-account access (cross-tenant in Entra ID), but use different mechanisms.
|
Microsoft Entra |
Alibaba Cloud |
Use case |
Description |
|
Cross-account access for enterprise users |
Achieved by assuming a RAM role in the target account. |
||
|
Cross-account access for enterprise applications |
Entra ID supports multi-tenant app registration. Alibaba Cloud uses STS AssumeRole for temporary credentials. |
||
|
Application access for consumer users |
RAM does not provide this feature. Use Alibaba Cloud IDaaS CIAM instead. |
Key differences
In Entra ID, cross-tenant access uses B2B collaboration: the target tenant invites an external user as a guest, adds them to its directory, and assigns roles. This creates a persistent identity in the target tenant.
In Alibaba Cloud, cross-account access uses role assumption without creating any identity in the target account. A user or program calls STS (AssumeRole, AssumeRoleWithSAML, or AssumeRoleWithOIDC) to temporarily assume a RAM role in the target account.
Beyond RAM role assumption, Alibaba Cloud also provides resource-based cross-account authorization (such as OSS Bucket Policy or Resource Sharing) for specific products.
Logging and auditing
Both platforms provide operational auditing and logging.
|
Microsoft Entra |
Alibaba Cloud |
Description |
|
Tracks console and API operations. ActionTrail is a separate Alibaba Cloud service, not a built-in RAM feature. |
||
|
ActionTrail (sign-in events) |
Console sign-in events are recorded in ActionTrail. There is no separate sign-in log service. |
|
|
Configure long-term storage and analysis of audit logs. |
Key differences
-
Log categorization: Entra ID separates sign-in logs from audit logs. Alibaba Cloud consolidates all events into ActionTrail.
-
Audit scope: Entra ID audit logs cover identity operations only; cloud resource operations go into Azure activity logs. Alibaba Cloud ActionTrail covers both RAM identity operations and cloud resource operations in a single service.
Development and SDKs
Both platforms provide development tools and SDKs.
|
Microsoft Entra |
Alibaba Cloud |
Use case |
Description |
|
OAuth/OIDC application integration |
Build OAuth/OIDC applications and integrate with the cloud authentication platform. |
||
|
API calls |
Full lifecycle management for identity entities (users, groups), application access, and policy assignment. |
||
|
Identity authentication SDK |
Both support credential chains for automatic credential resolution. |
||
|
- |
Authentication library |
Alibaba Cloud has no equivalent authentication library. Use a third-party OAuth/OIDC library. |
Only some Alibaba Cloud OpenAPI operations support Bearer Token (access token) authentication. Credentials. All Azure REST API and Microsoft Graph operations use access tokens from the Entra token service.
Key differences
-
API architecture: Microsoft Entra uses a single entry point — all identity, application, and policy operations go through the Microsoft Graph API. Alibaba Cloud RAM uses three independent API endpoints:
-
IMS (Identity Management Service): Manages identity lifecycle (users, groups), SSO configuration, and OAuth application registration.
-
RAM: Policy management and authorization.
-
STS (Security Token Service): Role assumption and temporary credential issuance.
-