Press play to start listening
Key Takeaways
- Microsoft Entra authenticates accounts and governs applications that federate to it. Several security functions sit outside that boundary by design, and Microsoft’s own documentation points to partners for them.
- The gaps worth closing are specific rather than general: document and biometric proofing, privileged session control, cloud entitlement management, legacy protocol coverage, hardware authenticators and directory recovery.
- Integration depth varies more than feature lists suggest. Some add-ons are click-to-configure through Microsoft Security Store; others need their own billing contract and REST work.
Most Entra deployments reach a similar point. Conditional Access is tuned, MFA is enforced, access reviews are running, and then a set of problems turns up that the licence does not cover. A user loses every registered authentication method and the helpdesk becomes the weakest link. A privileged session needs recording for an auditor. A service account authenticating over Kerberos sits entirely outside Conditional Access.
None of that is a flaw in Entra. It is the edge of what an identity provider does, and Microsoft documents the handoff in several places, including one capability it retired outright and pointed customers to a partner for.
At a Glance
- AU10TIX: document and biometric identity proofing for onboarding and account recovery
- Silverfort: extends Conditional Access to legacy protocols and unmanaged assets
- Delinea: cloud entitlement management after Microsoft retired Permissions Management
- CyberArk: credential vaulting and privileged session isolation beyond what PIM provides
- Yubico: hardware phishing-resistant authenticators with attestation support in Entra
- Semperis: Active Directory forest recovery and Tier 0 attack path discovery
- Saviynt: identity governance breadth across non-Microsoft applications
What Entra Covers Natively and Where It Hands Off
Entra’s native security surface is wide. Conditional Access and role-based access control come with P1, risk-based access and ID Protection with P2, and entitlement management, access reviews, lifecycle workflows and Privileged Identity Management with Entra ID Governance.
FIDO2 and passkeys are supported in every edition at no extra licence cost, and Entra Backup and Recovery became generally available in 2026 with daily automatic backups covering users, groups, conditional access policies, named locations, applications and service principals.
The handoffs are equally documented. The clearest is identity proofing. Entra Verified ID provides the credential platform and Face Check compares a live selfie against a photo already inside a credential, using the Azure AI Vision Face API and returning only a confidence score to the verifier.
What Face Check does not do is capture or authenticate an identity document, which is why Microsoft’s partner documentation describes these scenarios as using government ID checks delivered through identity verification and proofing services.
Entra ID Account Recovery makes the dependency explicit. It exists because self-service password reset needs at least one registered method and cannot help a user who has lost all of them, and because helpdesk-driven recovery is exposed to social engineering.
Microsoft’s documentation states that verification is performed by a third-party identity verification provider rather than by Microsoft or the helpdesk, with the user redirected out to that provider for a government ID check with liveness and facial recognition, then issued a Verified ID credential in Microsoft Authenticator and a Temporary Access Pass to re-register methods.
Three other handoffs matter. Privileged Identity Management activates roles just in time but does not vault credentials, isolate or record sessions. Conditional Access governs applications that federate to Entra, which leaves Kerberos, NTLM, LDAP, RDP, SSH, file shares and databases outside its reach. And cloud infrastructure entitlement management left the product line entirely when Microsoft retired Entra Permissions Management in late 2025, with Microsoft’s own offboarding guidance naming a third-party product as the comparable replacement.
The 7 Best Security Add-Ons for Microsoft Entra in 2026
1. AU10TIX
AU10TIX is the best security add-on for Microsoft Entra because it closes the one gap Microsoft requires a partner to fill rather than merely benefits from one. Entra ID Account Recovery cannot complete a recovery without a third-party identity verification provider, and the same proofing step underpins remote onboarding and governance access packages.
AU10TIX performs that step with document forensics, facial matching and active liveness detection in a hosted session triggered through the Entra Request Service API, after which the credential is issued and stored in Microsoft Authenticator with the private keys held on the device.
Its position in Microsoft’s partner structure is the detail worth checking against alternatives. Microsoft splits Verified ID identity verification partners into two groups, and AU10TIX is in both. The smaller group is Security Store integration partners, where the offer is click-to-configure, purchasable against existing Azure commitments, and works with Entra ID Account Recovery and Entra ID Governance access packages without a custom billing contract.
The larger group integrates through REST APIs and requires a direct billing contract with the vendor. AU10TIX was named a premier identity verification issuer on the Entra platform in December 2025, and it adds Serial Fraud Monitor, which uses consortium data to detect repeat fraud attempts across platforms before onboarding begins.
Key features:
- Document forensics, facial matching and active liveness detection in a session triggered from Entra
- Available as a click-to-configure offer through Microsoft Security Store, usable against Azure commitments
- Supports Entra ID Account Recovery and Entra ID Governance access packages without a separate billing contract
- Credentials issued into Microsoft Authenticator, with verification reusable across onboarding and recovery
- Serial Fraud Monitor applying consortium data to detect repeat fraud attempts across platforms
2. Silverfort
Silverfort applies MFA and access policy to resources that cannot be modified to support modern authentication, which is the category Conditional Access cannot reach. Microsoft’s own tutorial lists the targets: legacy and homegrown applications, Remote Desktop and SSH, command-line and administrative access, file shares and databases, infrastructure and industrial systems, plus AD FS and RADIUS.
The integration is the best documented in this group. A bridge connector is configured in the Silverfort console against the tenant ID, an adapter is added as an enterprise application, and a policy set to Entra ID Bridge passes the access decision to Entra for Conditional Access evaluation.
Key features:
- Bridge connector passing authentication decisions from legacy protocols to Entra Conditional Access
- Coverage for Kerberos, NTLM, LDAPS, RDP, SSH, file shares, databases and RADIUS
- Bridged assets surfaced as enterprise applications and targetable by Conditional Access policy
- Listed by Microsoft as a per-application Conditional Access secure hybrid access partner
3. Delinea
Delinea covers the capability Microsoft removed. When Entra Permissions Management was retired in late 2025, Microsoft’s offboarding documentation named Delinea’s Privilege Control for Cloud Entitlements as providing comparable functionality, including continuous discovery of entitlements for human and machine identities. That is an unusually direct handoff, and it makes Delinea the default answer for teams who lost cloud infrastructure entitlement management.
Its platform integration synchronises users, groups and roles from Entra on setup and refreshes them on a schedule, in either read-only or read/write mode. Identity Threat Protection discovers users, groups, roles, applications, managed identities, app registrations and sign-in activity, and Privilege Control for Cloud Entitlements adds Azure subscriptions, resource groups and resources with their privileges.
Key features:
- Named in Microsoft’s offboarding guidance as comparable to the retired Entra Permissions Management
- Continuous entitlement discovery across Azure subscriptions, resource groups and resources
- Discovery of Entra users, groups, roles, app registrations, managed identities and sign-in activity
- Read-only or read/write integration modes, with vaulting and session management in the wider platform
4. CyberArk
CyberArk addresses what Privileged Identity Management does not. PIM activates Entra and Azure roles just in time with approval workflows, but it does not vault credentials, broker or isolate sessions, record them for audit, or manage secrets for non-Microsoft targets. CyberArk’s Privileged Access Manager, Privilege Cloud and Secure Cloud Access lines cover that ground.
Microsoft publishes a gallery application for CyberArk SAML Authentication against a PVWA endpoint, though that tutorial documents no automated user provisioning, so account lifecycle stays a separate process. CyberArk states separately that its Workforce Identity adaptive MFA can act as an Entra external authentication method.
Key features:
- Credential vaulting, session isolation and session recording beyond the scope of Entra PIM
- Microsoft-published gallery application for SAML single sign-on against a PVWA endpoint
- Vendor-stated external authentication method integration for adaptive MFA
- Just-in-time privileged access to Azure workloads without standing privileges
5. Yubico
Yubico fills a hardware gap rather than a protocol gap. Entra supports FIDO2 and passkeys natively in every edition, including Free, so the question is not whether Entra speaks the standard. It is that Microsoft does not manufacture, distribute, replace or lifecycle-manage physical authenticators, and device-bound keys remain the only workable option for shared workstations, air-gapped environments and users without a phone.
Microsoft maintains a list of FIDO2 key models eligible for attestation with Entra ID, built from the FIDO metadata service, and Yubico appears across it with the YubiKey 5 series, Security Key NFC and YubiKey Bio variants. Administrators can restrict registration to specific models by AAGUID and require attestation at enrolment.
Key features:
- Device-bound FIDO2 keys for shared workstations, air-gapped sites and users without a phone
- Listed across Microsoft’s attestation-eligible FIDO2 vendor table, filterable by AAGUID
- Attestation at registration, letting administrators restrict enrolment to approved key models
- Published per-user subscription tiers with replacement allowance and delivery services
6. Semperis
Semperis focuses on directory resilience, and its strongest capability is one Entra does not address at all. Active Directory Forest Recovery handles cyber-first recovery of an on-premises forest, which sits entirely outside Entra’s scope and remains relevant to any organisation still running hybrid identity. Directory Services Protector covers threat detection and response across both AD and Entra ID, and Disaster Recovery for Entra Tenant covers Entra resources.
Microsoft did narrow part of this ground in 2026, since Entra Backup and Recovery is now generally available, so the question has shifted to what its exclusions leave uncovered, which include hard-deleted objects, changes to on-premises-synced objects and dynamic group rules.
Key features:
- Active Directory Forest Recovery for cyber-first recovery of an on-premises forest
- Directory Services Protector covering threat detection and response across AD and Entra ID
- Purple Knight and Forest Druid offered free for posture assessment and Tier 0 attack path discovery
- Microsoft Intelligent Security Association member with a Sentinel integration and Azure Marketplace listing
7. Saviynt
Saviynt extends governance past the Microsoft-centric scope of Entra ID Governance. Entra covers HR-driven inbound provisioning from Workday and SuccessFactors, entitlement management access packages, access reviews, lifecycle workflows and PIM. Saviynt targets fine-grained in-application entitlements, separation of duties for ERP systems, cross-platform role modelling and connector breadth across non-Microsoft applications, spanning human, non-human and AI agent identities.
It publishes its own Entra ID connector covering full and incremental import of accounts and access, provisioning and deprovisioning, password reset, service account management, and entitlement management across groups, directory roles, app roles and Teams channels.
Key features:
- Vendor-built Entra ID connector for import, provisioning, deprovisioning and entitlement management
- Separation of duties and fine-grained entitlement governance for ERP and non-Microsoft applications
- Governance covering human, non-human and AI agent identities in one platform
- Application access governance and identity security posture management alongside IGA
Which Entra Gap Each Add-On Actually Closes
The useful way to compare these is not by feature count, since they barely overlap. It is by which documented boundary of Entra each one sits past, and how much integration work that costs.
| Add-on | The Entra gap it covers | Integration path |
|---|---|---|
| AU10TIX | Document and biometric proofing at onboarding and recovery | Security Store, click to configure |
| Silverfort | Conditional Access for legacy protocols and unmanaged assets | Bridge connector plus gallery app, agent required |
| Delinea | Cloud entitlement management after Permissions Management retired | Directory sync, read-only or read/write |
| CyberArk | Credential vaulting and privileged session recording | Gallery app for SSO, vendor-stated MFA method |
| Yubico | Physical phishing-resistant authenticators and their lifecycle | Native FIDO2, attestation by AAGUID |
| Semperis | Forest recovery and Tier 0 attack path discovery | Vendor platform, Sentinel integration |
| Saviynt | Governance breadth beyond Microsoft-centric applications | Vendor-built connector |
Frequently Asked Questions
Does Microsoft Entra verify a user’s identity documents?
Not on its own. Entra Verified ID issues and validates credentials, and Face Check matches a live selfie against a photo already inside a credential. Capturing and authenticating a government ID is performed by an identity verification partner, which is why Entra ID Account Recovery requires a third-party provider to complete.
What is the difference between authentication and identity proofing?
Authentication confirms that whoever is signing in holds the right credential. Identity proofing confirms that a real, unique person matches the identity being claimed, using document checks and biometrics. An attacker with a stolen phone passes authentication. Proofing is what stops them at enrolment or recovery.
Why would an organisation need an add-on if it already pays for Entra ID P2?
P2 adds risk-based access and ID Protection, not the functions outside an identity provider’s scope. Credential vaulting, session recording, legacy protocol coverage, document proofing, physical keys and forest recovery are separate disciplines, and Microsoft retired its own cloud entitlement management product rather than developing it further.
What happened to Microsoft Entra Permissions Management?
Microsoft retired it in late 2025 and stopped selling it, with data collection discontinued at offboarding. Its offboarding documentation points customers to a third-party product as providing comparable functionality for continuous entitlement discovery, making cloud infrastructure entitlement management a partner capability for Entra customers.
