CrowdStrike Falcon Identity Protection

Overview

CrowdStrike Falcon Identity Protection extends the Falcon platform from endpoints into identity, detecting credential-based attacks across Active Directory and Entra ID. It is a module of a broader security platform rather than a standalone product (ITDR within XDR), and benefits from CrowdStrike's threat intelligence and scale. See the ITDR category and the best ITDR tools.

CrowdStrike agreed to acquire SGNL on 8 January 2026 for approximately 740 million dollars, adding CAEP-based continuous access evaluation and just-in-time access to a Falcon identity business already past 435 million dollars in annual recurring revenue. The deal is expected to close in CrowdStrike's fiscal 2027, so continuous authorization is not yet a shipped part of this module.

What it is good at

Correlation is the advantage. Because Falcon already sees endpoint and workload activity, identity threats like Pass-the-Hash, Kerberoasting, and lateral movement are analyzed with full context, and the platform can trigger risk-based step-up MFA in real time when behavior looks anomalous. Coverage of hybrid AD and Entra ID is strong, and the unified console plus shared threat intelligence are clear strengths for a SOC already operating in Falcon.

Where it falls short

The real value shows up when you run the wider Falcon platform, so standalone adoption is uncommon and the economics assume the broader licensing. It emphasizes detection and conditional enforcement over directory hardening and recovery, with no automated forest rebuild. Pricing is quote-based. Teams wanting a vendor-neutral, directory-specialist tool, or AD recovery, should look elsewhere.

Pricing

Quote-based and not published, sold as a module within Falcon platform bundles and scaling with users and the broader Falcon licensing you carry. Model the full commitment with the TCO calculator.

Best for, and who should look elsewhere

Choose Falcon Identity Protection if you already run Falcon and want identity detection unified with endpoint telemetry and real-time MFA enforcement. For the Microsoft-native alternative, compare CrowdStrike Falcon Identity vs Microsoft Defender for Identity; for AD recovery, see Semperis; for agentless protocol coverage, see Silverfort.

Bottom line

A strong fit for Falcon customers wanting identity detection unified with endpoint telemetry and real-time MFA enforcement, and less compelling as a standalone directory-recovery tool.