Identity Protection
Microsoft's risk engine for Entra ID, scoring sign-ins and users as risky based on behavior and known threat signals.
It flags things like impossible travel, sign-ins from anonymized IP addresses, and credentials appearing in a leak, then exposes that risk score to conditional access so policy can respond automatically.
The automation is where the value sits: forcing a password change on a confirmed compromised user without waiting for a human to read a report. It requires Entra ID P2.
Where this comes up
Identity Protection sits inside our identity and access work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.