Boost Your Remote Work Security with Entra ID: What’s New, What’s Next, and How to Get It Right

Two months ago, an IT team at a global consultancy caught a suspicious login from an employee’s account—coming from an unfamiliar location, outside approved hours. Their legacy MFA setup flagged nothing. What saved them? Microsoft Entra ID’s new adaptive authentication triggers, which demanded a second verification step based on real-time risk signals. That incident underscores a shift: remote work isn’t just about connectivity—it’s about context-aware security, and Entra ID is quietly raising its game.

WHAT’S NEW RIGHT NOW: Entra ID’s Freshest Security Upgrades for Remote Work

As of June 2024, Microsoft has rolled out a cluster of updates in Entra ID aimed squarely at remote work scenarios. The main highlights:

1. Work Location Awareness in Conditional Access

Conditional Access now supports work location profiles, letting admins specify permitted regions, ISPs, or even home office IP ranges. This isn’t just IP whitelisting—it’s dynamic, integrating with Microsoft’s threat intelligence to spot anomalous patterns. The admin path is: Entra admin center → Protection → Conditional Access → New Policy → Locations. For PowerShell, you can use:

New-AzureADMSConditionalAccessPolicy -DisplayName "Work Location Policy" -Conditions @{Locations = @{Include = @("AllTrustedLocations")}} -GrantControls @{BuiltInControls = @("Mfa")}

Edge case: If employees move, the policy can automatically prompt for additional verification until the new location is approved.

2. Improved Authentication Methods Policy

The new Authentication Methods Policy (in Public Preview) gives granular control over which authentication factors are allowed, per user group. You can now enforce FIDO2 for execs, SMS for contractors, and block legacy phone methods globally. Find it at: Entra admin center → Protection → Authentication methods.

3. Verified ID Integration for Employee Onboarding

Microsoft’s Verified ID (Decentralized Identity) is now integrated with Entra ID for remote onboarding. HR teams can send a secure credential to a new hire’s mobile device, and Entra ID uses this for first-time identity verification—no need for physical badge pickup or insecure email links.

4. Real-time Risk Assessment in Access Decisions

Entra ID’s risk engine (formerly Azure AD Identity Protection) now offers real-time risk scoring, not just periodic evaluation. This means access policies can react instantly to signals like impossible travel or leaked credentials. The risk score is accessible via Microsoft Graph:

GET https://graph.microsoft.com/beta/identityProtection/riskDetections

Admins can build custom logic to trigger MFA, block access, or force password resets based on these signals.

WHAT’S COMING: Roadmap Features and Announced Changes

Microsoft has announced several upcoming features for Entra ID that will further bolster remote work security:

1. Passkey Support for Passwordless Remote Access

Later in 2024, Entra ID will support passkeys—cryptographic credentials stored on a user’s device—making passwordless sign-in feasible for remote employees with mobile or desktop devices. This will tie in with Conditional Access, allowing policies like “permit only passwordless” for sensitive apps.

2. Seamless Integration with External Identity Providers (SCIM 2.0)

Enhanced support for external identity providers via SCIM 2.0 will enable organizations to federate identities for contractors and partners, while maintaining central policy control. Expect richer mappings and automated group assignments.

3. Expanded Identity Governance Automation

Scheduled for Q3 2024, new automation features will let admins set up workflows that automatically revoke access based on inactivity, role changes, or detected risk—without manual review.

WHY THIS APPROACH IS BETTER: Concrete Improvements Over Legacy Methods

Let’s get specific. The old way—simple MFA, static IP, basic group-based access—is increasingly brittle. Here’s what’s changed:

1. Adaptive, Context-Aware Access Decisions

Legacy Conditional Access only considered static factors. The new engine integrates risk signals, work location profiles, and device compliance in real time. This closes gaps where attackers spoof locations or reuse credentials.

2. Granular Authentication Method Control

Previously, admins could only enable or disable MFA globally. Now, you can set policies like “only allow FIDO2 for privileged accounts, block phone call MFA for all users.” This lets organizations tailor authentication strength based on risk and role.

3. Decentralized Identity for Remote Onboarding

Traditional onboarding involved insecure email links or in-person checks. Verified ID uses cryptographically signed credentials tied to Entra ID, reducing phishing risk and enabling onboarding from anywhere.

4. Real-Time Risk-Based Remediation

Identity Protection used to flag risky users but couldn’t always act immediately. Now, risk signals are actionable in Conditional Access, letting you force MFA or block access in seconds, not hours.

Step-by-Step: Implementing Entra ID’s New Remote Work Security Features

1. Define Work Location Profiles

In the Entra admin center, create logical location groups for home offices, regional VPNs, and trusted networks. Use Microsoft’s threat intelligence feeds to dynamically update these.

2. Set Up Authentication Methods Policy

Navigate to Protection → Authentication methods, define method assignments per group, and disable legacy methods where needed. For PowerShell:

Set-AzureADMSAuthenticationMethodPolicy -PolicyType 'FIDO2' -State 'enabled' -IncludeTargets @{Type='group';Id='[Group GUID]';TargetType='group'}

3. Integrate Verified ID for Onboarding

Connect your HR platform to Entra ID and configure Verified ID issuance via https://aka.ms/entra-verifiedid-docs. Issue credentials to new hires and require them for first login.

4. Configure Real-Time Risk-Based Conditional Access

In Protection → Conditional Access, add risk conditions from Identity Protection, and set policy actions for each risk level. Example policy snippet:

{
 "conditions": {
   "signInRiskLevels": ["high"],
   "locations": ["AllTrustedLocations"]
 },
 "grantControls": {
   "builtInControls": ["Mfa", "block"]
 }
}

Case Study: Remote Work Security in Action

A multinational legal firm recently migrated to Entra ID’s new features. Before, 12% of remote login attempts triggered no extra checks—even from risky geographies. After enabling work location profiles and real-time risk-based policies, only 0.7% of logins skipped MFA, and suspicious activity dropped by 41%. Verified ID onboarding cut account provisioning times from three days to under two hours.

Practical Takeaway: What to Do Next

If your organization is relying on legacy MFA or static access policies for remote work, now is the time to pilot Entra ID’s adaptive features. Start with a test group, define work location profiles, and enforce strong authentication methods. Check licensing: most features require Entra ID P2, and Verified ID is in public preview. Monitor Microsoft’s roadmap for passkey support and expanded governance automation. The goal: remote work that’s not just flexible, but inherently secure—by design, not by workaround.