Unlocking New Security Layers: Entra ID’s Latest Identity Protection Features for Zero Trust

When Microsoft quietly rolled out adaptive authentication policies and granular risk detection tuning in Entra ID this spring, many IT teams missed the significance: these updates aren’t cosmetic. They’re foundational shifts in how identity protection works within a Zero Trust architecture—and they’re reshaping how organizations manage user verification, risk mitigation, and privileged access. If your organization relies on Entra ID for identity, here’s why these changes demand your attention right now.

WHAT’S NEW RIGHT NOW: Adaptive Authentication and Risk Insights

Microsoft Entra ID (formerly Azure AD) now supports:

• Adaptive authentication policies that respond to real-time signals, not just static conditions.
• Granular risk detection controls—you can now fine-tune responses to specific risk types (e.g., sign-in from unfamiliar locations, malware-infected devices, impossible travel).
• Continuous access evaluation (CAE) that instantly revokes sessions if risk is detected, versus periodic checks or user reauthentication prompts.
• Improved user verification flows—including passwordless onboarding and enhanced MFA fatigue protections.

These features are generally available as of June 2024, with rollout notes at Microsoft Security Blog. To see them in your tenant, navigate to Entra ID > Security > Identity Protection in the portal, or use PowerShell:

# List new risk detection policies
Get-MgIdentityProtectionRiskDetection | Select-Object RiskType, DetectionTimingType, Status

If you’re on Entra ID P2 licensing, all new features are unlocked; P1 tenants see only basic risk detection and can’t customize adaptive authentication flows.

Step-by-Step: Deploying Adaptive Authentication

Configure Risk-Based Policies

Instead of static ‘block vs. allow’ policies, start with adaptive authentication:

1. Go to Entra ID > Security > Conditional Access > Policies.
2. Create a new policy. Under Assignments, set Users and Cloud Apps as usual.
3. In Conditions, select Sign-in Risk. Choose Medium and above—or customize per your risk tolerance.
4. Under Access Controls, select Require passwordless authentication and Require device compliance.
5. Enable Continuous Access Evaluation (CAE). This ensures sessions are revoked if risk status changes.

CAUTION: CAE can disrupt legacy apps and service accounts. Test with non-human accounts—some legacy mail clients and scripts fail silently when sessions are revoked mid-operation.

Fine-Tune Risk Detection

Recent updates allow you to customize responses to specific risk detections:

1. In Entra ID > Security > Identity Protection > Risk Policies, click Edit under User risk policy.
2. For each risk type—like Impossible Travel or Malware Detection—define separate actions (e.g., require reauthentication, block access, trigger PIM approval).
3. Save your policy and monitor the results via Entra ID > Security > Identity Protection > Risky Users.

PowerShell snippet for reviewing risky users:

Get-MgIdentityProtectionRiskyUser | Where-Object {$_.RiskLevel -eq "high"} | Select-Object UserPrincipalName, RiskLevel, RiskState

Enhanced MFA and User Verification: Stopping MFA Fatigue Attacks

One of the most exploited attack vectors in 2023 was MFA fatigue—attackers bombarding users with endless push notifications until they approve in frustration. Microsoft’s new enhanced MFA protections address this:

• Configurable limits on push prompts per session or per time window.
• Real-time detection of unusual MFA patterns (e.g., multiple prompts in under a minute).
• Integration with Authenticator App number matching, requiring users to match a number displayed on the device.

Enable these features at Entra ID > Security > Authentication Methods > Policies. For number matching:

Set-MgAuthenticationMethodsPolicy -DefaultMfaMethod "NumberMatching" -State "enabled"

Don’t deploy organization-wide immediately—first test with pilot users, as some older devices or users with accessibility needs may struggle with number matching.

WHAT’S COMING: Roadmap and Preview Features

Microsoft has announced several upcoming enhancements:

• Risk-aware sign-out—automatic sign-out from all sessions (including legacy and non-browser apps) when high risk is detected. Public preview slated for Q3 2024.
• SCIM-based automated remediation—when a user is flagged as risky, Entra ID can trigger automated group membership changes or entitlement revocation via SCIM (preview expected late 2024).
• Expanded device signals—integration with Defender for Endpoint to use device risk as a condition for authentication, not just access control. Early preview available now for select tenants.

To monitor preview features, subscribe to the Microsoft Security Blog and check Entra ID > Security > Preview Features regularly. Licensing for advanced features remains tied to Entra ID P2.

WHY THIS APPROACH IS BETTER: The Zero Trust Advantage

Traditional identity protection—static access policies, periodic user risk reviews, and basic MFA—cannot keep pace with modern threats. The new Entra ID features are a clear upgrade:

• Real-time risk response vs. daily/weekly reviews.
• Granular policy controls—different actions for different risk types, rather than “one policy fits all”.
• Continuous session evaluation—no waiting for the next login to enforce policy changes.
• Enhanced MFA fatigue detection—stop attackers who exploit user psychology, not just technical loopholes.

Compared to tools like Okta or Ping Identity, Entra ID’s integration with Microsoft 365 and Defender for Endpoint makes risk signals and policy actions more actionable—especially for organizations already invested in Microsoft’s ecosystem.

But there are gotchas:

• Licensing requirements—most advanced features require Entra ID P2, and some preview features are tenant-limited.
• Legacy app compatibility—adaptive authentication and CAE may disrupt non-modern clients.
• Policy complexity—with granular controls comes risk of misconfiguration. Always test in a pilot group before broad rollout.

Best Practices and Top Mistakes to Avoid

Do:

• Test adaptive policies with a subset of users before full deployment.
• Monitor Risky Users and Risk Detections dashboards weekly.
• Document all changes—especially new CAE and MFA configurations.
• Integrate device signals for more robust risk assessment.

Don’t:

• Apply CAE to legacy service accounts without testing.
• Rely solely on default policy settings—customize for your organization’s threat profile.
• Ignore licensing boundaries; advanced features won’t work without P2.

Takeaway: Action Steps for IT Teams

Microsoft Entra ID’s new identity protection features are not just incremental upgrades—they’re a reset in how Zero Trust is implemented. If you’re responsible for identity security:

• Review your existing conditional access and risk policies today.
• Enable adaptive authentication and CAE for pilot groups.
• Test enhanced MFA fatigue protections and integrate device signals.
• Plan for upcoming features—especially risk-aware sign-out and SCIM-based remediation—to future-proof your architecture.

As cyber threats escalate and compliance demands tighten, these features offer a practical path to continuous verification and robust identity protection. Don’t wait for the next audit or incident—start refining your Entra ID policies now, and keep monitoring Microsoft’s roadmap for the next security leap.