Boost Your Security: What’s New in Entra ID Adaptive Identity Verification

It’s rare that a single product update fundamentally changes the calculus for enterprise identity verification, but Microsoft Entra ID’s June 2024 enhancements are doing exactly that. The release of adaptive authentication mechanisms and expanded risk-based access controls is already reshaping how organizations approach Zero Trust. If you manage Entra ID, these new features aren’t just ‘nice to have’—they’re quickly becoming essential. Here’s what’s changed, how to deploy it, and why it matters now.

WHAT’S NEW RIGHT NOW: Adaptive Authentication Goes Mainstream

As of the June 2024 update (official announcement), Entra ID now supports dynamic, context-aware identity verification. This isn’t just about enforcing MFA on every login—it’s about tailoring authentication requirements in real-time, based on signals like user risk, device posture, geolocation, and anomalous behavior.

The new Adaptive Authentication Policies (AAP) are the headline feature. They enable administrators to:

• Define conditional authentication steps—MFA, phishing-resistant methods, device compliance checks—triggered only when risk signals warrant it.
• Leverage Risk Detection signals directly in policy logic, including Sign-in Risk and User Risk scores from Microsoft’s threat intelligence engine.
• Configure progressive authentication: for low-risk scenarios, users may skip extra factors; for elevated risk, require hardware-backed methods or step-up verification.

This replaces the old, static “always-on MFA” approach, which frustrated users and did little to stop sophisticated attacks. The difference is no longer theoretical: admins can now build granular, conditional authentication policies directly from Entra ID’s portal or using the Microsoft Graph API.

Before and After: Adaptive vs. Static Authentication

Consider a typical scenario: a finance department employee logs in from their usual corporate laptop, on a trusted network. Previously, Entra ID would prompt MFA every time, regardless of context. Now, with Adaptive Authentication, Entra ID evaluates risk signals:

{
  "userRiskLevel": "low",
  "signInRiskLevel": "none",
  "deviceCompliance": true,
  "location": "trusted"
}

If all signals are green, the user experiences a streamlined sign-in—no extra steps. But if the same user attempts access from a new device in an unusual location, Entra ID instantly escalates:

{
  "userRiskLevel": "medium",
  "signInRiskLevel": "high",
  "deviceCompliance": false,
  "location": "untrusted"
}

The policy now requires phishing-resistant MFA (like Windows Hello or FIDO2), blocks access on non-compliant devices, and can even trigger a Just-in-Time password reset if account compromise is suspected. This context-aware shift is what makes the new approach genuinely effective against modern threats.

Step-by-Step Implementation: Turning on Adaptive Authentication

1. Licensing Requirements and Preview Caveats

Adaptive Authentication Policies require Entra ID Premium P2. Risk-based Conditional Access—especially the advanced signals—may be in public preview for certain tenant types. Check your eligibility before rollout. See Azure Active Directory pricing for details.

2. Policy Configuration in Portal

Start in the Entra admin center:

1. Navigate to Entra ID > Security > Conditional Access > Policies.
2. Click New Policy, select Adaptive Authentication.
3. Choose signals: Sign-in risk, User risk, Device compliance, Location.
4. Set authentication requirements per risk tier: e.g., require FIDO2 for “high”, allow password-only for “none”.
5. Select progressive authentication if you want to escalate factors dynamically.

Save, test, and monitor policy effects with Sign-ins > Risk details in the portal.

3. API Deployment Example

You can automate policy creation using Microsoft Graph:

POST https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies
Content-Type: application/json

{
  "displayName": "Adaptive Finance Access",
  "conditions": {
    "signInRiskLevels": ["high"],
    "locations": ["untrusted"],
    "deviceStates": ["noncompliant"]
  },
  "grantControls": {
    "authenticationStrength": "fido2"
  }
}

This snippet creates a policy for finance users that triggers FIDO2 authentication if sign-in risk or device state is elevated.

WHAT’S COMING: Roadmap and Preview Features

Microsoft has announced several roadmap items for Entra ID’s identity verification stack:

• Risk-Driven Access Reviews: Soon, periodic access reviews can be triggered automatically when user risk spikes, not just on scheduled intervals.
• Integration with External Risk Providers: Public preview slated for Q4 2024, allowing risk signals from third-party platforms (e.g., Okta, CrowdStrike) to influence Entra ID authentication policies.
• Expanded API Coverage: More granular policy controls and risk signal exposure in Microsoft Graph, including endpoint /riskDetection for real-time queries.
• Improved Device Analytics: Device compliance checks will soon include richer telemetry, such as OS patch status and secure enclave validation.

Smart admins should prepare for tighter integration with SIEM, EDR, and device management platforms. A practical tip: start mapping your risk signals now, so you can quickly leverage these new sources when they go live.

WHY THIS APPROACH IS BETTER: Real-World Security and Usability Gains

Static authentication—enforcing the same MFA on every sign-in—misses two critical points: attackers are increasingly bypassing weak factors, and users resent friction when it’s not justified. The new Entra ID features solve both:

• Security: Risk-based policies make it much harder for attackers to predict or replay authentication flows. If a session is risky, the policy escalates instantly.
• Usability: Legitimate users, in known contexts, avoid unnecessary prompts. This reduces helpdesk tickets and login fatigue.
• Zero Trust Alignment: Every access decision is based on real-time signals, not static assumptions. This is a core tenet of Zero Trust.

Alternative tools—like Okta’s Adaptive MFA or Ping’s Risk-Based Authentication—offer similar concepts, but Microsoft’s integration with native Windows Hello, Intune device compliance, and Microsoft Defender signals is uniquely tight. If you’re already invested in the Microsoft ecosystem, Entra ID’s adaptive stack offers the most seamless experience.

Top Mistakes to Avoid

1. Ignoring Preview Limitations: Features in public preview may lack full audit logging, API coverage, or support for hybrid identities. Always check official docs for caveats.

2. Overly Broad Risk Policies: Don’t lump all users into “high risk” by default. This defeats the purpose of adaptive controls and can cause user frustration.

3. Neglecting Device Compliance: Many attacks target unmanaged devices. Always include device signals in your adaptive policies.

4. Forgetting Licensing: Adaptive Authentication requires Entra ID Premium P2. If you’re on P1, you’ll see limited options and no advanced risk signals.

Practical Takeaway: Start Small, Monitor, Iterate

Enterprise identity verification isn’t about chasing every new feature—it’s about reliably protecting access without blocking business. With Entra ID’s adaptive authentication and risk-based controls, you can finally strike that balance. Start by piloting a single adaptive policy for high-risk groups, monitor the impact, and iterate based on real sign-in analytics. The shift to context-aware authentication is here—and your organization should be ready to capitalize on it.