Part 7: Advanced Features and Enterprise Scenarios

Explore advanced MS Entra capabilities including Conditional Access, MFA, Continuous Access Evaluation, Managed Identities, B2B/B2C, custom claims, and enterprise SSO

Introduction

After working with MS Entra for several years across different enterprise environments, I've learned that mastering the basics is just the beginning. The real power comes from understanding advanced features like Conditional Access, Managed Identities, and Continuous Access Evaluation. In this part, I'll share my experiences implementing these advanced capabilities in production systems.

When I transitioned from simple authentication flows to enterprise-grade identity solutions, I discovered features that dramatically improved security posture, reduced operational overhead, and enhanced user experience. Let me show you how to leverage these advanced capabilities.

Prerequisites

Before diving in, you should be familiar with:

• MS Entra fundamentals (Parts 1-2)

• Authentication flows (Part 3)

• Token management (Part 4)

• API protection (Part 6)

• Azure services and resources

Conditional Access Policies

Understanding Conditional Access

Conditional Access is MS Entra's policy engine for applying access controls based on signals like user, location, device, application, and risk.

┌──────────────────────────────────────────────┐
│          Access Request                      │
└──────────────┬───────────────────────────────┘
               │
┌──────────────▼───────────────────────────────┐
│         Evaluate Signals                     │
│   • User/Group                               │
│   • Location (trusted IPs)                   │
│   • Device state (managed/compliant)         │
│   • Application                              │
│   • Sign-in risk                             │
│   • User risk                                │
└──────────────┬───────────────────────────────┘
               │
┌──────────────▼───────────────────────────────┐
│       Apply Access Controls                  │
│   • Block access                             │
│   • Require MFA                              │
│   • Require compliant device                 │
│   • Require hybrid Azure AD joined device    │
│   • Require app protection policy            │
│   • Require password change                  │
│   • Persist browser session                  │
└──────────────┬───────────────────────────────┘
               │
┌──────────────▼───────────────────────────────┐
│         Grant or Deny Access                 │
└──────────────────────────────────────────────┘

Handling Conditional Access in Applications

When a Conditional Access policy requires additional action (like MFA), the token request fails with a specific error:

// src/services/conditional-access.service.ts
interface ConditionalAccessError {
  error: string;
  error_description: string;
  error_codes: number[];
  suberror?: string;
  claims?: string;  // Base64 encoded claims challenge
}

export class ConditionalAccessHandler {
  /**
   * Check if error is due to Conditional Access
   */
  isConditionalAccessError(error: any): boolean {
    return (
      error.error === 'interaction_required' ||
      error.error === 'consent_required' ||
      error.error_codes?.includes(50076) ||  // MFA required
      error.error_codes?.includes(50079) ||  // Enrollment required
      error.error_codes?.includes(50005) ||  // Device not compliant
      error.error_codes?.includes(53000) ||  // Device not managed
      error.error_codes?.includes(53001) ||  // Compliant device required
      error.error_codes?.includes(53003)     // Conditional Access policy blocks
    );
  }

  /**
   * Extract claims challenge from error
   */
  extractClaimsChallenge(error: ConditionalAccessError): string | null {
    if (error.claims) {
      try {
        // Decode base64 claims
        const claims = Buffer.from(error.claims, 'base64').toString('utf-8');
        return claims;
      } catch (e) {
        console.error('Failed to decode claims:', e);
      }
    }
    return null;
  }

  /**
   * Get user-friendly error message
   */
  getErrorMessage(error: ConditionalAccessError): string {
    if (error.error_codes?.includes(50076)) {
      return 'Multi-factor authentication is required to access this resource';
    }
    if (error.error_codes?.includes(50079)) {
      return 'You need to enroll in multi-factor authentication';
    }
    if (error.error_codes?.includes(50005)) {
      return 'Access from this device is not allowed by policy';
    }
    if (error.error_codes?.includes(53000) || error.error_codes?.includes(53001)) {
      return 'Access requires a managed or compliant device';
    }
    if (error.error_codes?.includes(53003)) {
      return 'Access is blocked by Conditional Access policy';
    }
    return error.error_description || 'Access denied';
  }
}

Client-Side Conditional Access Handling

Here's how I handle Conditional Access challenges in a React application:

// src/auth/ConditionalAccessProvider.tsx
import { useEffect, useState } from 'react';
import { useMsal } from '@azure/msal-react';
import { InteractionRequiredAuthError } from '@azure/msal-browser';

export function useProtectedResource(scopes: string[]) {
  const { instance, accounts } = useMsal();
  const [accessToken, setAccessToken] = useState<string | null>(null);
  const [error, setError] = useState<Error | null>(null);
  const [loading, setLoading] = useState(false);

  const acquireToken = async (claims?: string) => {
    setLoading(true);
    setError(null);

    try {
      const request: any = {
        scopes,
        account: accounts[0],
      };

      // Include claims challenge if provided
      if (claims) {
        request.claims = claims;
      }

      // Try silent acquisition first
      const response = await instance.acquireTokenSilent(request);
      setAccessToken(response.accessToken);
    } catch (err) {
      if (err instanceof InteractionRequiredAuthError) {
        try {
          // Interactive acquisition required
          const response = await instance.acquireTokenPopup(request);
          setAccessToken(response.accessToken);
        } catch (popupErr) {
          setError(popupErr as Error);
        }
      } else {
        setError(err as Error);
      }
    } finally {
      setLoading(false);
    }
  };

  useEffect(() => {
    acquireToken();
  }, []);

  return {
    accessToken,
    error,
    loading,
    retry: acquireToken,
  };
}

API Response with Conditional Access Challenge

Here's how to return a claims challenge from your API:

// src/middleware/conditional-access-challenge.middleware.ts
import { Request, Response, NextFunction } from 'express';

export function requireStrongAuth() {
  return (req: Request, res: Response, next: NextFunction) => {
    const user = req.user;
    if (!user) {
      return res.status(401).json({ error: 'unauthorized' });
    }

    // Check if user authenticated with MFA
    const amr = user.amr || [];  // Authentication Methods Reference
    const hasMFA = amr.includes('mfa');

    if (!hasMFA) {
      // Return claims challenge
      const claimsChallenge = {
        access_token: {
          acrs: {
            essential: true,
            value: 'urn:microsoft:req1'  // Require MFA
          }
        }
      };

      return res.status(401).json({
        error: 'insufficient_claims',
        error_description: 'Multi-factor authentication required',
        claims: Buffer.from(JSON.stringify(claimsChallenge)).toString('base64'),
      });
    }

    next();
  };
}

Multi-Factor Authentication (MFA)

Enforcing MFA

Here's how to check MFA status in your application:

// src/services/mfa-validation.service.ts
interface TokenClaims {
  amr?: string[];  // Authentication Methods Reference
  acrs?: string;   // Authentication Context Class Reference
}

export class MFAValidationService {
  /**
   * Check if user authenticated with MFA
   */
  hasMFA(claims: TokenClaims): boolean {
    const amr = claims.amr || [];
    return amr.includes('mfa');
  }

  /**
   * Get authentication methods used
   */
  getAuthMethods(claims: TokenClaims): string[] {
    return claims.amr || [];
  }

  /**
   * Check specific authentication method
   */
  hasAuthMethod(claims: TokenClaims, method: string): boolean {
    const amr = claims.amr || [];
    return amr.includes(method);
  }

  /**
   * Validate authentication context
   */
  hasRequiredContext(claims: TokenClaims, required: string): boolean {
    return claims.acrs === required;
  }
}

// Common AMR values:
// - pwd: Password
// - mfa: Multi-factor authentication
// - otp: One-time password
// - sms: SMS
// - tel: Phone call
// - oath: OATH token
// - rsa: RSA SecurID
// - wia: Windows Integrated Authentication
// - fed: Federation

MFA Middleware

// src/middleware/mfa.middleware.ts
import { Request, Response, NextFunction } from 'express';
import { MFAValidationService } from '../services/mfa-validation.service';

const mfaService = new MFAValidationService();

export function requireMFA() {
  return (req: Request, res: Response, next: NextFunction) => {
    if (!req.user) {
      return res.status(401).json({ error: 'unauthorized' });
    }

    // Check if MFA was used
    const hasMFA = mfaService.hasMFA(req.user as any);

    if (!hasMFA) {
      // Return claims challenge for MFA
      const claimsChallenge = {
        access_token: {
          acrs: {
            essential: true,
            value: 'urn:microsoft:req1'
          }
        }
      };

      return res.status(401).json({
        error: 'mfa_required',
        error_description: 'Multi-factor authentication is required',
        claims: Buffer.from(JSON.stringify(claimsChallenge)).toString('base64'),
      });
    }

    next();
  };
}

// Usage in routes
app.post('/api/sensitive/operation',
  authMiddleware.authenticate(),
  requireMFA(),
  async (req, res) => {
    // Only accessible with MFA
    res.json({ status: 'success' });
  }
);

Continuous Access Evaluation (CAE)

Understanding CAE

Continuous Access Evaluation allows critical security events to revoke access tokens in near real-time, rather than waiting for token expiration.

// src/services/cae.service.ts
export interface CAEClaims {
  xms_cc?: string[];  // Client capabilities claim
  xms_tcdt?: number;  // Token creation date-time
}

export class CAEService {
  /**
   * Check if token supports CAE
   */
  supportsCAE(claims: CAEClaims): boolean {
    const clientCaps = claims.xms_cc || [];
    return clientCaps.includes('cp1');  // CAE capability
  }

  /**
   * Handle CAE claim challenge
   */
  handleCAEChallenge(error: any): string | null {
    // Look for WWW-Authenticate header with claims challenge
    const wwwAuth = error.headers?.['www-authenticate'];
    if (!wwwAuth) return null;

    // Parse claims from WWW-Authenticate header
    const claimsMatch = wwwAuth.match(/claims="([^"]+)"/);
    if (claimsMatch && claimsMatch[1]) {
      return Buffer.from(claimsMatch[1], 'base64').toString('utf-8');
    }

    return null;
  }
}

CAE-Enabled Client Configuration

// src/auth/msal-config.ts
import { Configuration } from '@azure/msal-browser';

export const msalConfig: Configuration = {
  auth: {
    clientId: 'your-client-id',
    authority: 'https://login.microsoftonline.com/your-tenant-id',
  },
  cache: {
    cacheLocation: 'sessionStorage',
    storeAuthStateInCookie: false,
  },
  system: {
    loggerOptions: {
      logLevel: 'Info',
    },
  },
};

// Request with CAE client capabilities
export const tokenRequest = {
  scopes: ['api://your-api/.default'],
  claims: JSON.stringify({
    access_token: {
      xms_cc: {
        values: ['cp1']  // Request CAE-enabled token
      }
    }
  }),
};

API Middleware for CAE

// src/middleware/cae.middleware.ts
import { Request, Response, NextFunction } from 'express';
import { CAEService } from '../services/cae.service';

const caeService = new CAEService();

export function validateCAE() {
  return (req: Request, res: Response, next: NextFunction) => {
    const user = req.user as any;
    
    if (!user) {
      return res.status(401).json({ error: 'unauthorized' });
    }

    // Check if CAE is supported
    if (!caeService.supportsCAE(user)) {
      // Token doesn't support CAE - optionally require it
      console.warn('Token does not support CAE');
    }

    // For critical operations, you can enforce CAE
    const isCriticalOperation = req.path.includes('/critical');
    if (isCriticalOperation && !caeService.supportsCAE(user)) {
      return res.status(403).json({
        error: 'cae_required',
        message: 'This operation requires a CAE-enabled token',
      });
    }

    next();
  };
}

Managed Identities

Using Managed Identity in Azure

Managed identities eliminate the need for credentials in your code:

// src/services/azure-storage.service.ts
import { BlobServiceClient } from '@azure/storage-blob';
import { DefaultAzureCredential } from '@azure/identity';

export class AzureStorageService {
  private blobServiceClient: BlobServiceClient;

  constructor() {
    // Use managed identity (no credentials needed!)
    const credential = new DefaultAzureCredential();
    
    const accountName = process.env.AZURE_STORAGE_ACCOUNT!;
    this.blobServiceClient = new BlobServiceClient(
      `https://${accountName}.blob.core.windows.net`,
      credential
    );
  }

  async uploadFile(containerName: string, blobName: string, data: Buffer) {
    const containerClient = this.blobServiceClient.getContainerClient(containerName);
    const blockBlobClient = containerClient.getBlockBlobClient(blobName);
    
    await blockBlobClient.upload(data, data.length);
  }

  async downloadFile(containerName: string, blobName: string): Promise<Buffer> {
    const containerClient = this.blobServiceClient.getContainerClient(containerName);
    const blockBlobClient = containerClient.getBlockBlobClient(blobName);
    
    const downloadResponse = await blockBlobClient.download();
    return await this.streamToBuffer(downloadResponse.readableStreamBody!);
  }

  private async streamToBuffer(stream: NodeJS.ReadableStream): Promise<Buffer> {
    return new Promise((resolve, reject) => {
      const chunks: Buffer[] = [];
      stream.on('data', (chunk) => chunks.push(chunk));
      stream.on('end', () => resolve(Buffer.concat(chunks)));
      stream.on('error', reject);
    });
  }
}

Calling APIs with Managed Identity

// src/services/api-client.service.ts
import { DefaultAzureCredential } from '@azure/identity';
import axios from 'axios';

export class APIClientService {
  private credential: DefaultAzureCredential;

  constructor() {
    this.credential = new DefaultAzureCredential();
  }

  /**
   * Call protected API using managed identity
   */
  async callProtectedAPI(endpoint: string, scope: string) {
    try {
      // Get token using managed identity
      const tokenResponse = await this.credential.getToken(scope);
      
      // Call API with token
      const response = await axios.get(endpoint, {
        headers: {
          'Authorization': `Bearer ${tokenResponse.token}`,
          'Content-Type': 'application/json',
        },
      });

      return response.data;
    } catch (error) {
      console.error('API call failed:', error);
      throw error;
    }
  }

  /**
   * Call Microsoft Graph using managed identity
   */
  async callGraph(endpoint: string) {
    return this.callProtectedAPI(
      `https://graph.microsoft.com/v1.0${endpoint}`,
      'https://graph.microsoft.com/.default'
    );
  }

  /**
   * Call custom API using managed identity
   */
  async callCustomAPI(endpoint: string, apiScope: string) {
    return this.callProtectedAPI(endpoint, `${apiScope}/.default`);
  }
}

Managed Identity in Kubernetes

# kubernetes/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: payment-api
spec:
  template:
    metadata:
      labels:
        app: payment-api
        aadpodidbinding: payment-api-identity
    spec:
      containers:
      - name: payment-api
        image: paymentapi:latest
        env:
        - name: AZURE_CLIENT_ID
          value: "managed-identity-client-id"

// Using AAD Pod Identity
const credential = new DefaultAzureCredential();

// Or explicitly use managed identity
import { ManagedIdentityCredential } from '@azure/identity';
const credential = new ManagedIdentityCredential(
  process.env.AZURE_CLIENT_ID  // Optional: specify which identity
);

B2B and B2C Scenarios

Azure AD B2B (Business-to-Business)

B2B allows external users to access your applications:

// src/services/b2b.service.ts
import { Client } from '@microsoft/microsoft-graph-client';
import { TokenCredentialAuthenticationProvider } from '@microsoft/microsoft-graph-client/authProviders/azureTokenCredentials';
import { ClientSecretCredential } from '@azure/identity';

export class B2BInvitationService {
  private graphClient: Client;

  constructor() {
    const credential = new ClientSecretCredential(
      process.env.TENANT_ID!,
      process.env.CLIENT_ID!,
      process.env.CLIENT_SECRET!
    );

    const authProvider = new TokenCredentialAuthenticationProvider(credential, {
      scopes: ['https://graph.microsoft.com/.default'],
    });

    this.graphClient = Client.initWithMiddleware({ authProvider });
  }

  /**
   * Invite external user
   */
  async inviteUser(email: string, redirectUrl: string) {
    const invitation = {
      invitedUserEmailAddress: email,
      inviteRedirectUrl: redirectUrl,
      sendInvitationMessage: true,
      invitedUserMessageInfo: {
        customizedMessageBody: 'You have been invited to access our application',
      },
    };

    try {
      const result = await this.graphClient
        .api('/invitations')
        .post(invitation);

      return {
        inviteRedeemUrl: result.inviteRedeemUrl,
        userId: result.invitedUser.id,
      };
    } catch (error) {
      console.error('Failed to send invitation:', error);
      throw error;
    }
  }

  /**
   * Check if user is external
   */
  isExternalUser(user: any): boolean {
    // Guest users have userType = 'Guest'
    return user.userType === 'Guest';
  }

  /**
   * Get external user's home tenant
   */
  getHomeTenant(user: any): string | null {
    // External users have UPN like: email_domain.com#EXT#@yourtenant.onmicrosoft.com
    const upn = user.upn || user.email;
    if (upn && upn.includes('#EXT#')) {
      const match = upn.match(/(.+)#EXT#@/);
      return match ? match[1].replace('_', '@') : null;
    }
    return null;
  }
}

Handling B2B Users in API

// src/middleware/b2b.middleware.ts
import { Request, Response, NextFunction } from 'express';

export function handleExternalUsers() {
  return (req: Request, res: Response, next: NextFunction) => {
    const user = req.user;
    if (!user) {
      return res.status(401).json({ error: 'unauthorized' });
    }

    // Check if user is external (guest)
    const isExternal = user.userType === 'Guest';

    if (isExternal) {
      // Apply additional restrictions for external users
      console.log('External user access:', {
        userId: user.oid,
        email: user.email,
        homeTenant: user.tid,
      });

      // Optionally: Check if external users are allowed
      const allowExternal = process.env.ALLOW_EXTERNAL_USERS === 'true';
      if (!allowExternal) {
        return res.status(403).json({
          error: 'external_users_not_allowed',
          message: 'External users are not permitted',
        });
      }
    }

    // Attach external user flag
    (req as any).isExternalUser = isExternal;
    next();
  };
}

Azure AD B2C Integration

B2C is for customer-facing applications:

// src/auth/b2c-config.ts
import { Configuration, PublicClientApplication } from '@azure/msal-browser';

export const b2cPolicies = {
  names: {
    signUpSignIn: 'B2C_1_signupsignin',
    forgotPassword: 'B2C_1_reset',
    editProfile: 'B2C_1_edit_profile',
  },
  authorities: {
    signUpSignIn: {
      authority: 'https://yourtenant.b2clogin.com/yourtenant.onmicrosoft.com/B2C_1_signupsignin',
    },
    forgotPassword: {
      authority: 'https://yourtenant.b2clogin.com/yourtenant.onmicrosoft.com/B2C_1_reset',
    },
    editProfile: {
      authority: 'https://yourtenant.b2clogin.com/yourtenant.onmicrosoft.com/B2C_1_edit_profile',
    },
  },
  authorityDomain: 'yourtenant.b2clogin.com',
};

export const msalConfig: Configuration = {
  auth: {
    clientId: 'your-b2c-client-id',
    authority: b2cPolicies.authorities.signUpSignIn.authority,
    knownAuthorities: [b2cPolicies.authorityDomain],
    redirectUri: '/auth/callback',
  },
  cache: {
    cacheLocation: 'localStorage',
    storeAuthStateInCookie: false,
  },
};

export const msalInstance = new PublicClientApplication(msalConfig);

Custom Claims and Token Customization

Adding Custom Claims

You can add custom claims using optional claims configuration or claims mapping policy:

// Application Manifest - optionalClaims
{
  "optionalClaims": {
    "accessToken": [
      {
        "name": "email",
        "essential": false
      },
      {
        "name": "groups",
        "essential": false
      }
    ],
    "idToken": [
      {
        "name": "email",
        "essential": false
      }
    ]
  }
}

Using Extension Attributes

// src/services/user-attributes.service.ts
import { Client } from '@microsoft/microsoft-graph-client';

export class UserAttributesService {
  private graphClient: Client;

  constructor(graphClient: Client) {
    this.graphClient = graphClient;
  }

  /**
   * Set extension attribute
   */
  async setExtensionAttribute(userId: string, appId: string, name: string, value: any) {
    const extensionName = `extension_${appId.replace(/-/g, '')}_${name}`;
    
    await this.graphClient
      .api(`/users/${userId}`)
      .patch({
        [extensionName]: value,
      });
  }

  /**
   * Get extension attribute
   */
  async getExtensionAttribute(userId: string, appId: string, name: string) {
    const extensionName = `extension_${appId.replace(/-/g, '')}_${name}`;
    
    const user = await this.graphClient
      .api(`/users/${userId}`)
      .select(extensionName)
      .get();

    return user[extensionName];
  }
}

// Usage
const attributeService = new UserAttributesService(graphClient);

// Set custom attribute
await attributeService.setExtensionAttribute(
  'user-id',
  'app-id',
  'department',
  'Engineering'
);

// This attribute can then be included in tokens via optional claims

Custom Claims Transform

// src/services/claims-transformer.service.ts
export class ClaimsTransformerService {
  /**
   * Transform raw token claims to application-specific format
   */
  transformClaims(tokenClaims: any): any {
    return {
      userId: tokenClaims.oid,
      email: tokenClaims.email || tokenClaims.preferred_username,
      name: tokenClaims.name,
      roles: tokenClaims.roles || [],
      department: tokenClaims.extension_department,
      employeeId: tokenClaims.extension_employeeId,
      groups: tokenClaims.groups || [],
      tenant: tokenClaims.tid,
      isGuest: tokenClaims.userType === 'Guest',
      authenticationMethods: tokenClaims.amr || [],
      scope: tokenClaims.scp,
    };
  }

  /**
   * Enrich claims with additional data
   */
  async enrichClaims(claims: any): Promise<any> {
    // Add business logic data
    const permissions = await this.getUserPermissions(claims.userId);
    const preferences = await this.getUserPreferences(claims.userId);

    return {
      ...claims,
      permissions,
      preferences,
    };
  }

  private async getUserPermissions(userId: string) {
    // Fetch from database
    return ['read', 'write'];
  }

  private async getUserPreferences(userId: string) {
    // Fetch from database
    return { theme: 'dark', language: 'en' };
  }
}

Enterprise SSO

Configuring Enterprise Application SSO

// src/config/enterprise-sso.config.ts
export interface EnterpriseSSOConfig {
  appId: string;
  tenantId: string;
  replyUrls: string[];
  logoutUrl: string;
  samlMetadataUrl: string;
}

export const enterpriseSSOConfig: EnterpriseSSOConfig = {
  appId: process.env.ENTERPRISE_APP_ID!,
  tenantId: process.env.ENTRA_TENANT_ID!,
  replyUrls: [
    'https://app.example.com/auth/callback',
    'https://app.example.com/silent-renew',
  ],
  logoutUrl: 'https://app.example.com/logout',
  samlMetadataUrl: `https://login.microsoftonline.com/${process.env.ENTRA_TENANT_ID}/federationmetadata/2007-06/federationmetadata.xml`,
};

Home Realm Discovery

// src/services/home-realm-discovery.service.ts
export class HomeRealmDiscoveryService {
  /**
   * Determine user's home realm from email
   */
  async discoverHomeRealm(email: string): Promise<{
    type: 'managed' | 'federated';
    federationUrl?: string;
  }> {
    const domain = email.split('@')[1];

    try {
      // Call MS Entra HRD endpoint
      const response = await fetch(
        `https://login.microsoftonline.com/common/userrealm/${email}?api-version=2.0`
      );
      
      const data = await response.json();

      if (data.account_type === 'Federated') {
        return {
          type: 'federated',
          federationUrl: data.federation_protocol_url,
        };
      }

      return { type: 'managed' };
    } catch (error) {
      console.error('HRD failed:', error);
      return { type: 'managed' };
    }
  }

  /**
   * Build login URL with domain hint
   */
  buildLoginUrl(email: string, clientId: string, redirectUri: string): string {
    const domain = email.split('@')[1];
    
    const params = new URLSearchParams({
      client_id: clientId,
      response_type: 'code',
      redirect_uri: redirectUri,
      scope: 'openid profile email',
      domain_hint: domain,  // Speeds up federation
      login_hint: email,     // Pre-fills username
    });

    return `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?${params}`;
  }
}

Risk-Based Access Control

Handling Identity Protection Signals

// src/services/risk-detection.service.ts
export interface RiskClaims {
  'riskLevel'?: string;          // low, medium, high
  'riskState'?: string;          // confirmedSafe, remediated, atRisk
  'riskDetail'?: string;         // Reason for risk
  'riskEventTypes'?: string[];   // Types of risk events
}

export class RiskDetectionService {
  /**
   * Evaluate user risk
   */
  evaluateRisk(claims: RiskClaims): {
    level: string;
    shouldBlock: boolean;
    shouldRequireMFA: boolean;
  } {
    const riskLevel = claims.riskLevel || 'none';
    const riskState = claims.riskState || 'none';

    // Block high-risk users
    if (riskLevel === 'high' || riskState === 'atRisk') {
      return {
        level: 'high',
        shouldBlock: true,
        shouldRequireMFA: true,
      };
    }

    // Require MFA for medium risk
    if (riskLevel === 'medium') {
      return {
        level: 'medium',
        shouldBlock: false,
        shouldRequireMFA: true,
      };
    }

    return {
      level: 'low',
      shouldBlock: false,
      shouldRequireMFA: false,
    };
  }

  /**
   * Check for specific risk events
   */
  hasRiskEvent(claims: RiskClaims, eventType: string): boolean {
    const riskEvents = claims.riskEventTypes || [];
    return riskEvents.includes(eventType);
  }
}

Key Takeaways

1. Conditional Access: Use policy-based access control for dynamic security

2. MFA Enforcement: Validate authentication methods in your application

3. CAE Integration: Leverage near real-time token revocation

4. Managed Identities: Eliminate credentials from your code

5. B2B/B2C: Support external users and customer scenarios

6. Custom Claims: Enrich tokens with business-specific data

7. Enterprise SSO: Enable seamless authentication across applications

8. Risk Detection: Implement adaptive authentication based on risk signals

9. Home Realm Discovery: Optimize federated authentication flows

10. Claims Transformation: Adapt token claims to your application needs

Common Patterns

Pattern 1: Progressive Security

// Low security: Basic authentication
app.get('/api/data',
  authMiddleware.authenticate(),
  getData
);

// Medium security: Require specific scopes
app.post('/api/data',
  authMiddleware.authenticate(),
  requireScopes('Data.Write'),
  createData
);

// High security: Require MFA
app.delete('/api/data/:id',
  authMiddleware.authenticate(),
  requireScopes('Data.Delete'),
  requireMFA(),
  deleteData
);

// Critical security: Require MFA + managed device
app.post('/api/sensitive',
  authMiddleware.authenticate(),
  requireScopes('Admin.Full'),
  requireMFA(),
  requireManagedDevice(),
  criticalOperation
);

Pattern 2: Tenant-Aware Operations

// Single tenant with managed identity
const credential = new ManagedIdentityCredential();

// Multi-tenant with specific tenant
const credential = new ClientSecretCredential(
  tenantId,
  clientId,
  clientSecret
);

// Dynamic tenant switching
const getTenantCredential = (tenantId: string) => {
  return new ClientSecretCredential(
    tenantId,
    multiTenantClientId,
    multiTenantClientSecret
  );
};

Next Steps

In Part 8: Production Best Practices, we'll cover:

• Security hardening and threat mitigation

• Monitoring and logging strategies

• Performance optimization

• Troubleshooting common issues

• Disaster recovery

• Compliance and auditing

Additional Resources

• Conditional Access Documentation

• Continuous Access Evaluation

• Managed Identities

• Azure AD B2B

• Azure AD B2C

---

This is part 7 of the MS Entra 101 Series. Continue to Part 8: Production Best Practices for production deployment guidance.