Identity Protection provides policies for a few common scenarios.
These policies require an AAD P2 license
Conditional Access policies could be used in place of Identity Protection policies to achieve similar things. It is broader in scope, but includes capabilities that overlap with Identity Protection.
-
These are under Azure AD/Manage/Security/Identity Protection/Protect and include these:
Azure AD MFA registration policy - requires users to register for MFA
Sign-in risk policy - a risk score is calculated to indicate the likelihood that a sign-in was not performed by the user. Based on this score administrators can choose to block access, allow access or allow access but require multi-factor authentication.
User risk policy - a risk score is calculate to indicate the likelihood that a user account has been compromised. Based on this score administrators can choose to block access, allow access or allow access but require a password change.
Identity Protection is a tool that allows organizations to accomplish three key tasks:
Automate the detection and remediation of identity-based risks.
Investigate risks using data in the portal.
Export risk detection data to third-party utilities for further analysis.
Requires an AAD P2 license
AAD has three Identity Protection policies by default:
The signals generated by and fed to Identity Protection, can be further fed into tools like Conditional Access to make access decisions, or fed back to a security information and event management (SIEM) tool for further investigation based on your organization's enforced policies.
The risk signals can trigger remediation efforts such as requiring users to: perform Azure AD Multi-Factor Authentication, reset their password using self-service password reset, or blocking until an administrator takes action.