2.3. Microsoft Entra ID Protection

💡 First Principle: Humans can't review millions of sign-ins, but a model watching global signal can score each one: how likely is this sign-in not the owner? and how likely is this account already compromised? ID Protection turns those two probabilities into first-class policy inputs — risk becomes just another condition your access engine reacts to, automatically.

The payoff is scale and speed: leaked credentials get remediated by forcing a secure password change at the next sign-in instead of waiting for an analyst; an impossible-travel sign-in gets an MFA challenge in the moment. The cost of misunderstanding is failing the domain's favorite discriminator — user risk vs sign-in risk — or assuming detection implies response (it doesn't; you must wire policies).

⚠️ Common Misconception: "ID Protection protects by default." Out of the box it only detects and reports. Protection begins when you connect risk to enforcement: risk-based Conditional Access policies (the modern path) or the legacy ID Protection policies. No policy, no remediation — just a growing risky-users report.