Mastering Zero Trust with Entra ID: The Security Features Every IT Admin Needs to Know in 2024

What’s New Right Now: Fresh Features Reshaping Entra ID Security

Last quarter, Microsoft rolled out three major Entra ID updates: Continuous Access Evaluation (CAE) is now generally available across all tenants; the new Authentication Methods Policy replaces the legacy MFA/SSPR controls; and granular session controls are live in Conditional Access. Each of these targets the core weaknesses Zero Trust frameworks are meant to solve: stale sessions, risky credentials, and over-broad access.

Perhaps most significant, CAE now enforces near-real-time policy evaluation—no more relying on token expiry windows to cut off access when a risk event is detected. Microsoft’s June 2024 Entra announcements also introduced Authentication Strengths, allowing admins to mandate phishing-resistant methods like FIDO2 or Certificate-Based Authentication for specific apps or roles, right from new policy blades in the portal (Entra ID > Protection > Authentication methods).

For teams grappling with credential sharing and shadow access, these tools aren’t just incremental—they’re a generational upgrade. And as security incidents tied to token theft and lateral movement keep climbing, the pressure to adopt these features is immediate and practical, not just theoretical.

Step-By-Step: Implementing Continuous Access Evaluation

Implementing CAE is straightforward, but the nuances matter. CAE requires supported applications and the right Conditional Access (CA) policies. Microsoft 365, Exchange Online, SharePoint Online, Teams, and most Graph API endpoints are CAE-ready as of early 2024. Custom apps must use the latest msal libraries and support login_hint and sid claims.

# Example: Enabling a CA policy for CAE
Connect-MgGraph -Scopes 'Policy.ReadWrite.ConditionalAccess'
New-MgConditionalAccessPolicy -DisplayName "Block stale sessions on risk" -State "enabled" `
    -Conditions @{ Users = @{ IncludeUsers = @("All") }; Applications = @{ IncludeApplications = @("All") } } `
    -GrantControls @{ Operator = "OR"; BuiltInControls = @("Block") }

After deployment, CAE listens for signals like user account disablement, password reset, or network location change. If a session becomes out-of-policy (say, a user is suspended or marked high-risk), access is revoked within minutes—not hours. This closes a notorious gap where attackers could leverage stolen refresh tokens even after credential resets.

Gotchas: CAE Limitations in Hybrid and Third-Party Apps

CAE doesn’t apply to legacy authentication or non-compliant apps. Hybrid scenarios—such as on-premises Exchange or third-party SAML apps—still rely on token lifetime policies. To fully benefit, phase out non-CAE-aware applications and update all custom integrations to the latest Microsoft libraries (see Microsoft docs for a compatibility list).

Authentication Methods Policy: The End of Legacy MFA Settings

Microsoft’s new Authentication Methods Policy now governs MFA, SSPR, and passwordless configuration from a unified control plane. This change isn’t just cosmetic: you can now scope methods by user group, set authentication strength per application, and enforce phishing-resistant MFA (FIDO2, CBA) at scale.

# Assign authentication method policy to require FIDO2 for privileged users
Connect-MgGraph -Scopes 'Policy.ReadWrite.AuthenticationMethod'
Update-MgAuthenticationMethodPolicy -PolicyId default -Fido2MethodsEnabled $true
New-MgAuthenticationStrengthPolicy -DisplayName "Privileged FIDO2 Only" `
    -AllowedCombinations @("Fido2") -IncludeUsers @("AdminsGroupId")

If you’re still using the legacy Multi-Factor Authentication or Self-Service Password Reset blades, migration is strongly recommended. The new policy is enforced for all tenants created after March 2024, and Microsoft has announced the deprecation timeline for the old controls (see official security blog).

Pitfall: Break-Glass and Service Accounts

Don’t overlook service accounts or break-glass identities. Exclude these from strict authentication strengths, and monitor sign-ins using Entra ID’s Sign-in logs to detect bypass attempts. Consider registering FIDO2 keys with physical possession controls for emergency accounts.

Advanced Session Controls: Real-Time Policy Enforcement

Conditional Access’s new Session Controls let you enforce policies based on real-time signals—user risk, device posture, network location—during the session, not just at sign-in. This is critical for Zero Trust, where context can change rapidly, and static decisions expose risk.

For example, you can now require re-authentication if a user moves to an untrusted network mid-session, or restrict download actions in SharePoint if a device falls out of compliance. These controls are defined in Entra ID > Protection > Conditional Access > Session Controls and support fine-grained targeting.

# Example: Create a session control policy for SharePoint downloads
New-MgConditionalAccessPolicy -DisplayName "Restrict SP Online downloads" -State "enabled" `
    -Conditions @{ Users = @{ IncludeUsers = @("All") }; Applications = @{ IncludeApplications = @("SharePointOnline") } } `
    -SessionControls @{ ApplicationEnforcedRestrictions = $true }

These controls are especially valuable for scenarios like BYOD or partner access, where device state and location can change unexpectedly. But note: session controls require supported Microsoft 365 apps, and licensing at Entra ID P1 or P2 (see the official blog for details).

What’s Coming: Prepare for Policy Stacking and Enhanced Logs

Looking to the next two quarters, Microsoft has publicly previewed Policy Stacking—the ability to layer multiple Conditional Access policy types (user, device, session, workload) and visualize their combined effect before enforcement. This is a long-awaited feature for complex enterprises with overlapping policies. Early documentation is live in the Entra admin center under Preview features.

On the observability front, Microsoft is piloting enhanced sign-in and access logs with near-real-time event streaming to Azure Event Hubs and Sentinel, making it easier to trace policy effects and investigate advanced attacks. Expect general availability by late 2024, along with improved Graph API endpoints (notably /identity/conditionalAccess/policies and /auditLogs/signIns).

Finally, support for step-up authentication and policy chaining is in private preview. This will allow runtime re-evaluation and challenge—if a user attempts a sensitive operation, they can be prompted for stronger auth without full sign-out.

Why This Approach Is Better: Concrete Gains and Fewer Blind Spots

Compared to classic Azure AD and legacy MFA, these new Entra ID controls bring:

• Faster response to risk: CAE and session controls close the window between incident detection and access revocation from hours to minutes.
• More granular policy scope: Authentication Methods Policy and strengths let you require phishing-resistant MFA for admins but not contractors, all in one place.
• Unified, auditable management: No more toggling between MFA, SSPR, and CA dashboards—enforce and report all auth methods centrally, with full Graph API support.

Alternative tools—like Okta or Ping—offer similar “adaptive” policies, but Microsoft’s integration with M365 workloads and CAE-aware APIs is uniquely deep. If you’re a Microsoft shop, native Entra ID controls now deliver what once required multiple point products.

Practical Takeaway: Zero Trust Is Now Achievable—If You Move Fast

The Zero Trust journey is no longer limited by what Entra ID can do—it’s limited by how quickly organizations update policies, migrate legacy controls, and educate users. For security teams, the next steps are clear:

1. Audit application and user compatibility with CAE and new authentication strengths.
2. Phase out legacy MFA/SSPR, moving to the unified Authentication Methods Policy.
3. Review all Conditional Access policies for session control and real-time enforcement opportunities.
4. Sign up for public previews—especially Policy Stacking and enhanced access logs—to prep for the next wave of features.

Zero Trust isn’t a checkbox, but with these Entra ID updates, it’s more actionable and less disruptive than ever. The window for attackers to exploit stale sessions and weak credentials is closing—if, and only if, you adopt the tools now available. Start piloting these features in your lab or pilot tenant today: the security ROI is immediate, and attackers won’t wait.