Protected Actions Help Keep Entra ID Secure

• Protected actions offer a final conditional access check before administrators can make core changes to Entra ID.
• This can help protect Entra ID from attack by ensuring an administrator is legitimate before making critical changes.
• The feature only requires Entra ID P1, which is included in all Microsoft 365 subscriptions.

Protected actions are Entra ID permissions that have been specifically set to require an additional conditional access check before administrators can make high-impact changes. Examples include creating or deleting conditional access policies or permanently deleting tombstoned Entra ID objects (objects previously marked for deletion). By offering a last opportunity for a conditional access check on these core permissions, protected actions in Entra ID can help defend against attack by rogue entities, even if using compromised administrator credentials. 

What Are Protected Actions?