Securing Hybrid Work: Entra ID’s Latest Identity Protection Features Explained

Early in 2024, a regional healthcare provider faced a familiar challenge: their on-premises Active Directory was still mission-critical, but remote clinicians needed seamless, secure cloud access. A recent spike in credential stuffing attacks targeting legacy on-prem apps exposed weak spots in their hybrid identity design. Their pivot? Microsoft Entra ID’s newly released enhanced Identity Protection for hybrid environments, building on risk-based user verification and adaptive policies that now reach deeper into both on-prem and cloud resources.

WHAT’S NEW RIGHT NOW: Adaptive Identity Protection for Hybrid Environments

Microsoft announced in May 2024 a set of Entra ID enhancements designed for organizations straddling on-prem and cloud infrastructure. The standout change: risk-based user validation now spans users synchronized from on-premises AD via Azure AD Connect or Microsoft Entra Connect. Where previously Identity Protection was limited mostly to cloud-only users, hybrid identities can now benefit from risk scoring and automated Conditional Access based on real-time signals.

Key features include:

• Hybrid Identity Risk Detection: Entra ID now tracks sign-in anomalies, unfamiliar locations, and credential leaks for synced users.
• Conditional Access Integration: Risk signals trigger policy enforcement for both cloud and on-prem resource access.
• Risk Remediation Workflows: Self-service password reset and step-up MFA are now optionally required for risky hybrid accounts.

To see this in action, navigate to Entra admin center > Protect > Identity Protection > Risk policies. You’ll now find synced accounts eligible for risk-based policy assignment, with granular controls per user type (cloud-only, synced, federated).

WHAT’S COMING: Roadmap and Preview Features

Looking ahead, Microsoft has previewed:

• Granular Risk Assessment for Service Accounts: Soon, Entra ID will differentiate between interactive and non-interactive hybrid identities, enabling policy decisions based on service account risk impact.
• Integration with Microsoft Defender for Identity: Signals from on-prem AD (e.g., lateral movement, unusual privilege escalation) will feed directly into Entra ID’s risk scoring, available in public preview Q3 2024.
• SCIM-based hybrid provisioning: To streamline lifecycle management for hybrid apps, Entra ID will support SCIM provisioning for on-premises targets (e.g., legacy HR systems), currently in private preview.

IT teams should monitor Microsoft 365 message center and Entra release notes for early access and licensing requirements. Many of these new features require Microsoft Entra ID P2 licensing, especially risk-based policies and advanced auditing.

WHY THIS APPROACH IS BETTER: Concrete Improvements Over Previous Methods

Legacy hybrid identity protection often relied on static controls: group membership, static MFA, and manual reviews. These approaches missed key attack vectors:

• Credential replay and session hijacking were undetected unless a user signed in to cloud resources.
• On-premises AD signals (like password spray or DC replication abuse) rarely informed cloud access policies.
• Risk remediation was mostly manual, requiring admin review and user intervention long after threats occurred.

Entra ID’s latest features address these gaps:

• Unified risk scoring for all identities, regardless of source, using signals from both Microsoft and third-party threat feeds.
• Automated Conditional Access triggers based on real-time risk, not just static user attributes.
• Self-healing workflows (e.g., forced password reset, step-up MFA) for users flagged as high-risk, minimizing admin overhead.

Example: If a synced user’s credentials leak in a public dump, Entra ID will automatically flag the account as high-risk, prompt for password reset, and block access to both SharePoint Online and on-prem IIS applications until remediation completes.

Implementation Best Practices

1. Enable Hybrid Risk Detection

Ensure your hybrid identities are visible by updating to the latest Entra Connect (v2.1.0+) and confirming Identity Protection is enabled for both cloud and synced users. Check via:

# Validate hybrid identity sync
Get-MgUser -Filter "UserType eq 'Member' and DirSyncEnabled eq true"

In the Entra portal, assign risk policies under Identity Protection > User risk policy and include synced accounts.

2. Design Conditional Access for Hybrid Risk Signals

New policy controls allow you to set conditions for hybrid risk signals:

{
  "if": {
    "userRiskLevel": "high",
    "userType": "hybrid"
  },
  "then": {
    "require": ["passwordChange", "multiFactorAuthentication"]
  }
}

In the portal: Entra admin center > Protect > Conditional Access > New Policy, select User risk as a condition and configure controls for both cloud and on-prem applications.

3. Integrate Defender for Identity Signals

Connect your on-prem AD to Microsoft Defender for Identity and ensure risk signal integration is enabled. These signals (e.g., abnormal lateral movement) appear in Entra ID and trigger remediation policies.

Portal path: Entra admin center > Protect > Identity Protection > Settings, toggle Defender for Identity integration.

4. Monitor and Audit Hybrid Risk Events

Use Entra ID Activity Logs to track risk events for hybrid users:

Get-MgAuditLogSignIn -Filter "UserType eq 'hybrid' and RiskLevel eq 'high'"

Export logs regularly for compliance review and incident response.

Case Study: Healthcare Provider Fends Off Hybrid Attacks

When the provider mentioned at the outset rolled out Entra ID’s hybrid risk protection, they saw a 40% reduction in successful password spray incidents within two months. Automated remediation forced affected users to reset credentials before accessing critical patient data apps, both in the cloud and in their on-prem SQL environment. The security team credited the real-time, unified risk signals and the ability to enforce policies across all endpoints—something legacy solutions couldn’t achieve.

Common Pitfalls and Gotchas

Despite the improvements, practitioners should watch for:

• Licensing gaps: Most advanced features require Entra ID P2. Hybrid risk signals won’t appear on P1 or free tiers.
• Sync latency: Risk signals may lag if Entra Connect sync intervals aren’t tuned. Set delta sync to at least every 30 minutes for timely risk response.
• Application compatibility: On-prem legacy apps may need updates to honor Conditional Access enforcement. Test policy impact before full rollout.
• Service account exclusions: By default, service accounts are excluded from risk policies. Review exclusions regularly, as attackers often target these for lateral movement.

Microsoft’s official documentation covers these caveats, but in practice, teams often discover them only after incidents.

Takeaway: Move Fast, Monitor Closely, Prepare for Next Steps

Microsoft Entra ID’s new hybrid identity protection features close critical gaps for organizations navigating complex, multi-environment architectures. For IT admins and security engineers, the actionable steps are clear: enable hybrid risk detection, integrate on-prem signals, design responsive Conditional Access policies, and audit regularly. Stay ahead by monitoring the preview roadmap—granular service account controls and deeper Defender for Identity integration are coming soon. As hybrid work and Zero Trust become the norm, these capabilities aren’t just nice-to-have; they’re essential for resilience and regulatory compliance.