Identity Protection in Azure AD B2C: A Comprehensive Guide for Infrastructure Planning

Introduction and Context

Today, it is important to protect user identities when it comes to dealing with protecting the applications and making applications comply with standards for security purposes. Azure AD B2C Identity Protection helps to identify and mitigate user identity risks, employing advanced security controls and mitigates the risk of threats such as compromised accounts, atypical user behavior, and malicious sign-ins.

This blog is a comprehensive overview of Identity Protection in Azure AD B2C, outlining its benefits, advantages, disadvantages, licensing requirements, key use cases, and why it is a necessity to consider during user migration.

What is Identity Protection in Azure AD B2C?

Azure AD B2C Identity Protection helps organizations discover, investigate, and remediate identity-based risks in their customer identity environments. It works by analyzing user risk (probability that an identity is compromised) and sign-in risk (probability of a malicious authentication attempt).

Benefits of Identity Protection

1. Enhanced Security and Risk Detection
   • Automatically identifies threats like sign-ins from malware-linked IPs, anonymous proxies, or unfamiliar locations.
   • It proactively mitigates identity-based risks before they escalate into breaches.
2. Simplifies Threat Investigation
   • Administrators can view detailed reports to understand the nature and context of risks.
   • Offers filtering and export capabilities for seamless integration with external tools like Power BI or Microsoft Sentinel.
3. Supports Risk-Based Access Control
   • Identity Protection works seamlessly with Conditional Access policies to enforce actions like MFA or block access based on risk levels.
4. Automation of Risk Mitigation
   • Reduces operational overhead with automated workflows to remediate compromised accounts (e.g., password reset prompts).

Licensing Requirements, Costs

To use Identity Protection in Azure AD B2C, organizations need the following licenses:

• Azure AD Premium P1: Includes basic Identity Protection features like Risky Users Reports with moderate visibility.
• Azure AD Premium P2: Adds advanced features like Risk Detections Reports and advanced visibility.

Example Pricing

Pricing Structure

1. Free Tier:
   • The first 50,000 MAUs per month are free for both Premium P1 and Premium P2 features.
2. Beyond the Free Tier:
   • Premium P1 Features: After the initial 50,000 free MAUs, each additional MAU is billed at $0.0028.
   • Premium P2 Features: Similarly, beyond the free tier, each additional MAU is charged at $0.016425.
3. Multi-Factor Authentication (MFA):
   • SMS/Phone-based MFA incurs a separate charge of $0.03 per authentication attempt.
4. Azure AD Premium P1:
   • Does not include automated risk-based remediation.
   • Conditional Access policies can be configured to require MFA or block access based on pre-defined conditions, but these policies are not dynamically adjusted based on real-time risk assessments.
   • No risk-based Conditional Access. Security responses are static and do not adapt to evolving risk levels.
5. Azure AD Premium P2:
   • Includes full Identity Protection capabilities, including risk-based Conditional Access.
   • Automatically enforces security actions based on real-time risk analysis, such as:
   • Blocking high-risk sign-ins.
   • Enforcing MFA or password resets for suspicious activity.
   • Detecting and mitigating compromised accounts using AI-driven risk signals.
   • Continuously refines risk scoring based on behavioral patterns, past threats, and Microsoft's global security intelligence.

Identity Protection Reports

Azure AD Identity Protection provides security insights through primary reports, which vary by licensing tier:

1. Risky Users Report:
   • Identifies users flagged for potential compromise based on detected anomalies.
   • P1: Basic visibility with limited insights.
   • P2: Risky Users Report Details Includes detailed risk history, trends, and remediation options.
   • P1 & P2: Risky Users Report Remediation
2. Risk Detections Report:
   • Breaks down individual risk events (e.g., unfamiliar locations, malware activity, credential stuffing attacks).
   • P1: Shows some detection data but lacks deep insights.
   • P2: Risk Detection Report Details Includes detailed event forensics, timestamps, and recommended mitigation actions.
   • P1 & P2: Report downloads, and MS Graph API Access

Key Takeaways

Gotchas to Consider

Advantages of Identity Protection

Disadvantages of Identity Protection

When to Use Identity Protection

Key Considerations for Infrastructure Planning

Why Considering Identity Protection Matters Before User Migration

User migration introduces new risks, especially if your existing user base has compromised or high-risk accounts. Implementing Identity Protection before migration ensures the following:

Conclusion

Identity Protection in Azure AD B2C provides a robust solution for customer identity protection and risk mitigation. Although specific licensing comes with a cost, all things considered, the addition of security and scalability is of more importance to organizations concerned with such issues.

Before diving into user migrations or adopting new customer identity solutions, Identity Protection serves as an essential tool for ensuring a robust security foundation. For organizations of all sizes, it's worth evaluating whether the investment aligns with your infrastructure and security goals.