CrowdStrike Falcon Identity Threat Protection is an identity threat detection and response (ITDR) capability that detects and disrupts identity-based attacks—including credential theft, lateral movement, Kerberos abuse, and suspicious authentications—across hybrid Active Directory and Microsoft Entra ID environments by correlating Falcon platform telemetry and threat intelligence.
Published Oct 15, 2026
| Starting Price | Quote-based (not published as standard list price) | Commonly licensed via Microsoft suites; public price references exist for some licensing bundles (varies by agreement/region) | Quote-based; vendor pricing typically requires contact |
| Recommended for | Organizations standardized on Falcon platform seeking ITDR integrated with endpoint/XDR/SIEM/MDR | Microsoft-centric enterprises using AD/Entra and Microsoft 365 security stack | Environments with legacy or heterogeneous authentication paths where additional enforcement controls are required |
| Key Strength | Integration of Falcon telemetry and threat intelligence; platform consolidation; available managed option | Native integration with Microsoft identity signals and conditional access controls; potentially lower incremental cost if Microsoft licensing is already in place | Adds enforcement and MFA controls across legacy authentication paths without replacing primary IAM |
| Key Weakness | Higher-than-average pricing noted by some buyers; tuning and operational burden reported in some deployments | May be less compelling in heterogenous stacks not aligned with Microsoft; functionality focused on Microsoft identity signals | May not provide the same single-pane-of-glass XDR experience; requires integration planning with existing IAM |
—