In short: CrowdStrike Falcon Identity Threat Protection is identity threat detection and response (ITDR) on the Falcon platform. It monitors authentication across Active Directory and cloud identity providers such as Entra ID and Okta, detects credential-based attacks and can enforce MFA or block access as risk rises. It is licensed per user, with a managed Complete version.
What Falcon Identity Threat Protection is
Many attacks rely on stolen or misused credentials: an attacker logs in rather than breaking in, then moves laterally using legitimate accounts. Falcon Identity Threat Protection is CrowdStrike's identity threat detection and response (ITDR) module, built to spot and stop that activity.
It watches authentication traffic across on-premises Active Directory and cloud identity providers including Entra ID and Okta, builds a picture of normal behaviour for every account, and flags or blocks activity that looks like an attack: unusual logons, credential theft techniques, privilege escalation and lateral movement. Because it runs on the Falcon platform, identity detections are correlated with endpoint detections from the same sensor and console.
CrowdStrike groups its identity products under the name Falcon Next-Gen Identity Security. Identity Threat Protection is the ITDR module we supply, in a standard and a managed Complete version.
What it includes
| Capability | What it gives you |
|---|---|
| Authentication monitoring | Visibility of logons across Active Directory and cloud identity |
| Identity-based attack detection | Credential theft, privilege escalation and lateral movement techniques |
| Risk-based conditional access | Require MFA, force a password reset or block access as an account's risk changes |
| MFA for legacy systems | Add an MFA step in front of older systems and tools that cannot do it natively |
| Account classification | Automatically classifies user, privileged and service accounts |
| Hybrid coverage | On-premises, cloud and hybrid identity from one console |
Extending MFA to legacy systems that cannot do it natively, such as older line-of-business applications and admin tools on Active Directory, is often the deciding feature for hybrid estates.
How it is licensed
Identity Threat Protection is licensed per user, rather than per endpoint, and comes in two versions:
| Option | What you get | Term |
|---|---|---|
| Identity Threat Protection | The ITDR module, run by your team | Monthly, per user |
| Identity Threat Protection Complete | The same module, with CrowdStrike's Falcon Complete team monitoring and responding to identity threats 24/7 | Monthly, per user |
The Complete version pairs naturally with Falcon Complete Defend, so one managed service covers both endpoints and identities. Ask us for a quote. See per-user vs per-device licensing.
Requirements and deployment
For on-premises Active Directory, the Falcon sensor is installed on your domain controllers, where it can see authentication traffic directly. Cloud identity providers are connected to the Falcon console through integrations. We usually run in monitoring mode first to learn normal behaviour and classify accounts, then introduce MFA and blocking policies gradually, starting with the riskiest accounts and protocols.
Who it suits and how we help
Identity Threat Protection suits organisations with hybrid Active Directory and Entra ID that want to detect credential misuse, protect privileged accounts and add MFA where it is hard to deploy. It is also a strong answer to cyber insurance questions about privileged access and lateral movement.
We license it alongside your Falcon endpoint bundle on one Forever Systems account, deploy the sensor to domain controllers, connect your cloud identity provider and tune the policies with you. For cloud-first MFA and single sign-on, see also Cisco Duo. Compare options in identity, MFA and privileged access.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is CrowdStrike Identity Protection licensed per user or per device?
Per user. Identity Threat Protection and Identity Threat Protection Complete are counted by user, unlike Falcon endpoint bundles, which are counted per endpoint.
Does Falcon Identity Threat Protection work with Entra ID?
Yes. CrowdStrike supports on-premises Active Directory and Microsoft Entra ID, and its ITDR also extends to cloud identity providers such as Okta and Ping, so hybrid environments are covered from one console.
What does Identity Threat Protection Complete add?
The Complete version adds CrowdStrike's Falcon Complete team monitoring and responding to identity threats around the clock, rather than your own team handling the alerts.
Do I need the sensor on domain controllers?
For on-premises Active Directory, yes: the Falcon sensor on each domain controller is what lets CrowdStrike see and act on authentication traffic. We handle that deployment.