What is ITDR, and why you probably already pay for it

What is identity threat detection and response?

ITDR is the set of controls that monitor identities in use and respond when one starts behaving like it has been taken over. It scores sign-ins and accounts for risk, watches sessions after authentication, and then does something about it: forcing a step-up prompt, killing the session, or resetting the password without waiting for a human to read an alert.

The word covers a capability, not a product category you have to go shopping for. Microsoft and Okta both ship it inside their identity platforms. The interesting question for a buyer is not which ITDR vendor to pick, it is which parts you already hold a licence for and whether any of them are set to act.

What does ITDR cover that MFA and SSO do not?

Single sign-on and multi-factor authentication decide who gets in. Both make their decision once, at the door, and then stop paying attention. ITDR deals with everything after that moment: a session token lifted from a laptop, an attacker who has already passed MFA, a push prompt someone finally approved at the end of a long day.

This is why an estate with strong SSO and enforced MFA can still be compromised without a single failed login appearing anywhere. The attacker did not break authentication, they inherited it. Detection has to run continuously against live sessions and account changes, and the response has to be automatic, because the attack does not wait for office hours.

If you are still working out the layer underneath this, our plain English guide to identity and access management covers SSO, MFA and provisioning first.

Who provides affordable ITDR tools for Microsoft Entra or Okta users?

Microsoft and Okta themselves. The affordable option is almost always a tier already on your invoice: Entra ID Protection comes with the P2 tier that is bundled into Microsoft 365 E5, and Okta includes ThreatInsight in the base platform. The cheapest real coverage is normally the step up to P2, or Okta's Identity Threat Protection add-on, and not a separate vendor at all.

That answer disappoints people who arrive expecting a shortlist of challenger products. It is still the right one. A third product adds a second console, a second alert queue and a second renewal, and it detects a large overlap of what you already hold. Spend the money on getting the licence you own set to act instead.

Volobyte configures either platform and will tell you when you already hold the licence and only need it switched on. Our identity and access management service starts from £4,999 for a single identity provider, and risk policy configuration is part of that work rather than a separate line.

How ITDR works with Microsoft Entra ID

Entra ID Protection scores every sign-in and every user for risk, using signals such as leaked credentials, anonymised IP addresses and improbable travel. Its real value is that those scores are available as a condition inside Conditional Access, so a risky sign-in can be forced through step-up authentication or blocked outright with nobody reading an alert. It needs the P2 tier, which is included in Microsoft 365 E5.

Device health is part of the same decision. Conditional Access reads compliance straight from Intune and threat signal from Microsoft Defender, so an unencrypted or out-of-date endpoint can be refused with no extra plumbing.

One thing teams miss: if your estate still has domain controllers, Defender for Identity is the piece that watches on-premise Active Directory, and it is a separate product from Entra ID Protection. A cloud-only risk policy says nothing about what is happening in the directory the cloud syncs from.

How ITDR works with Okta

Okta splits the same job in two. ThreatInsight is included in the base platform and works before authentication, blocking or flagging requests from IP addresses already behaving badly across Okta's customer base. Continuous evaluation during a live session, meaning risk is reassessed after login and the session is cut when it changes, is Okta Identity Threat Protection, a separately licensed add-on.

For device health, Okta Device Trust takes the posture signal from Jamf, IRU, CrowdStrike or SentinelOne. That is the better fit for a Mac-first or mixed fleet that Intune does not manage, and it is the main reason Okta keeps winning in estates with a lot of Apple hardware and a lot of non-Microsoft SaaS.

The blunt version: on Okta, budget for the add-on explicitly or accept that your detection stops at the front door.

Do I need a third-party ITDR tool on top of Okta or Entra ID?

Usually not, and rarely as the first purchase. Most estates we audit already own detection they have not enabled, or have every risk policy left in report-only mode, which produces alerts nobody reads and no actual protection.

Configure automated response first: step-up authentication, session revocation, forced password reset. That is the part that works outside office hours, and it is the part that costs nothing beyond the licence you hold. A dedicated ITDR product earns its place once identity signals need correlating with endpoint and network data across a security team that is staffed to act on them. If nobody owns the alert queue, a fourth console makes things worse.

How does Okta Identity Engine compare with Entra ID and CrowdStrike?

It is not a three-way choice, because those three products do different jobs. Okta Identity Engine is the authentication policy layer, covering per-application rules, FastPass passwordless and step-up prompts. Entra ID is the equivalent for a Microsoft estate, with Conditional Access as its policy layer. CrowdStrike is endpoint detection that feeds device and threat signal into whichever of the two you run.

So the real decision is Okta or Entra ID as your identity provider, then CrowdStrike wired in behind it as the device signal. Anyone presenting the three as competing line items on the same quote has misread what you are buying.

What Volobyte actually deploys

We deploy and support both identity platforms and recommend on fit, not margin. On the identity threat side the work is almost always the same four steps, in this order.