What’s New in Entra ID: Key Features You Need to Know for Stronger Identity Security

On June 11th, 2024, Microsoft shipped a dense package of security improvements to Entra ID (formerly Azure AD), pushing identity security deeper into the Zero Trust stack. With phishing-resistant authentication, automated threat detection, and improved governance controls hitting general availability, enterprise IT teams can now defend against attacks that weren’t even on the radar a year ago. But these features aren’t just incremental updates—they fundamentally reshape how organizations manage and defend digital identities at scale.

WHAT’S NEW RIGHT NOW: Major Entra ID Enhancements Live in June 2024

Microsoft’s most recent Entra ID release cycles have targeted several longstanding pain points in enterprise identity management. Here’s what just landed—and why it matters for your security posture.

1. Phishing-Resistant Authentication with Passkeys (FIDO2)

It’s official: Entra ID now supports FIDO2 passkeys across all supported platforms, not just for Windows Hello or select mobile flows. This means users can register and authenticate using platform or roaming passkeys—such as those stored in the iCloud Keychain or Android’s password manager—directly within Entra ID. The goal: kill off password-based attacks and eliminate OTP fatigue.

“Entra ID supports registration and sign-in with FIDO2 passkeys—platform and cross-device—on all major browsers as of June 2024.”

To enable:

# In Entra admin center: Identity > Authentication methods > Policies
# Enable 'FIDO2 Security Key' and set 'Target' to 'All users' or selected groups

For deeper control, configure policy settings such as Enforce attestation or Allow self-service setup as needed for your environment.

2. Adaptive Access Policies Powered by Entra ID Protection

Risk-based Conditional Access is no longer a preview: adaptive policies that respond in real-time to risky sign-ins, location anomalies, or impossible travel are now GA for all tenants with P2 licensing. Microsoft’s ML-driven risk detection has been tuned for higher signal-to-noise, thanks to feedback from recent nation-state attack campaigns.

# Example: Require re-authentication for sign-ins detected as high-risk
New-AzureADMSConditionalAccessPolicy -DisplayName "Block High-Risk Sign-ins" \
  -Conditions @{ SignInRiskLevels = @("high") } \
  -GrantControls @{ BuiltInControls = @("block") }

Administrators can now trigger just-in-time access reviews or require phishing-resistant auth only when risk spikes—no more blanket MFA prompts for every user, every time.

3. Automatic Lifecycle Workflows for Identity Governance

Entra ID’s Lifecycle Workflows (formerly preview) are now generally available, with expanded triggers for joiner-mover-leaver scenarios. You can automate onboarding, offboarding, and access recertification using templates or PowerShell/Graph automation.

For example, you can trigger a workflow to revoke credentials and disable access when a user’s employment status changes in Workday or SuccessFactors via SCIM provisioning.

“Lifecycle workflows are now driven by real-time events, not just scheduled syncs—reducing orphaned accounts and stale access.”

Configure via:

Entra admin center > Identity Governance > Lifecycle Workflows

4. Conditional Access Authentication Strengths

With Authentication Strengths (GA), you can now enforce types of MFA—such as only allowing FIDO2 or Certificate-based Authentication (CBA)—for sensitive apps or roles. This addresses compliance requirements that generic ‘MFA’ can’t satisfy. The enforcement is granular: you can apply it per app, per group, or as part of a PIM eligible role activation.

Entra admin center > Protection > Conditional Access > Authentication Strengths

WHAT’S COMING: Roadmap & Preview Features to Watch

Microsoft is signaling a rapid cadence for Entra ID enhancements throughout 2024. Here’s what’s in public preview or announced:

• Identity Threat Detection with Microsoft Copilot: Integration with Copilot for Security is slated for Q3 2024, bringing natural language incident summaries and recommended mitigation workflows into Entra ID alerts.
• Continuous Access Evaluation (CAE) Expansion: CAE is rolling out for more app types (including legacy Office clients), enabling real-time session revocation based on risk or device posture changes.
• Custom Claims and Attributes via Microsoft Graph: The ability to issue custom claims or transform attributes at token issuance—critical for complex B2B and B2C scenarios—is moving from preview to GA in H2 2024.
• Policy Analytics: Deeper analytics and simulation tools for Conditional Access policies are in private preview, promising to reduce misconfigurations that lock out users or inadvertently weaken security.

Stay tuned to the Microsoft Security Blog for detailed release notes and pilot opportunities.

WHY THIS APPROACH IS BETTER: Concrete Improvements Over Legacy Methods

Entra ID’s new features aren’t just marketing hype—they address specific weaknesses in older Azure AD and hybrid AD patterns:

• Phishing-resistant authentication eliminates credential phishing threats that still bypass legacy MFA (notably SMS- or app-based push fatigue attacks).
• Adaptive policies replace static rules, meaning access isn’t just ‘allowed’ or ‘denied’—it’s tuned to real-time risk, reducing both business disruptions and attack windows.
• Automated governance workflows finally move identity lifecycle from manual, error-prone scripts or paper processes to reliable, event-driven automation.
• Authentication strengths close compliance gaps where auditors require specific factors (e.g., FIDO2 only), not just any MFA.

Compared to previous generations of Azure AD, these updates:

• Reduce complexity: No more Frankenstein’s monster of custom scripts, on-premises joiners/leavers, and disjointed MFA setups
• Lower risk of misconfiguration: Policy analytics and built-in recommendations help avoid accidental lockouts
• Deliver better user experience: Passwordless flows are faster and less error-prone than classic MFA

Implementation: Steps to Use the New Features Now

Ready to put these features to work? Here’s how to move from pilot to production.

Enable Passkeys and Authentication Strengths

1. Go to Entra admin center > Identity > Authentication Methods
2. Enable 'FIDO2 Security Key' and set appropriate targeting
3. In Conditional Access > Authentication Strengths, define required factors
4. Attach strengths to sensitive apps or privileged role activations

Deploy Adaptive Conditional Access Policies

1. Review risky sign-in detection settings under Entra ID Protection
2. Create or update Conditional Access policies targeting high-risk scenarios
3. Test policies using the 'What If' tool for impact simulation
4. Monitor enforcement via Sign-ins > Risk detections

Automate Lifecycle with Workflows

1. Navigate to Identity Governance > Lifecycle Workflows
2. Use built-in templates or author custom steps for joiner, mover, leaver
3. Integrate with HR systems via SCIM or Graph API triggers
4. Audit and refine with workflow run history

Licensing, Limitations, and Gotchas

As always, there are some catches IT teams should plan for:

• Licensing: Most advanced features—adaptive risk policies, lifecycle workflows, and authentication strengths—require Entra ID P2 licenses for all covered users. FIDO2 passkeys require at least Entra ID P1.
• Hybrid Environments: Some features (e.g., passkey sign-in) don’t yet extend to on-premises AD-joined devices without cloud join/hybrid join. Plan hybrid migrations carefully.
• Supported Apps: Authentication strengths can only be enforced on modern auth apps (OAuth2, OpenID Connect) and not on legacy protocols (ADFS, or LDAP/SAML apps without modern integration).
• Preview Status: Some roadmap features (e.g., Policy Analytics, Copilot incident summaries) are in preview and may change before GA.

Takeaway: Secure Your Identity Perimeter Before Attackers Do

Entra ID’s June 2024 security enhancements are the strongest evidence yet that identity is the new perimeter. Organizations that deploy phishing-resistant authentication, adaptive risk-based policies, and automated lifecycle governance will be dramatically better equipped against modern attacks. But these features only pay off if implemented with clear policies, adequate licensing, and real testing—not just in the lab, but in production workflows.

Now’s the time to pilot these controls in a test tenant, simulate your riskiest scenarios, and plan for full rollout before attackers catch up. Bookmark the official release blog for deep dives, and don’t wait for the next headline breach to get started with Entra ID’s new security stack.