CrowdStrike Falcon Identity Protection review
Broad hybrid identity defense with detection, enforcement, and automated response.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
CrowdStrike Falcon Identity Protection is an identity threat detection and response product for organizations securing hybrid identity environments. It monitors human and service accounts, correlates identity and endpoint activity, and detects compromised credentials, lateral movement, privilege escalation, and directory-service threats. Its coverage spans on-premises Active Directory, cloud identity stores, and related applications, making it suited to enterprises managing both traditional and cloud-based identity infrastructure.
The product’s two plans are Falcon Identity Threat Detection and Falcon Identity Threat Protection. Both are licensed per active identity, while the higher tier adds response alongside identity threat detection. The offering includes a 15-day trial and no free plan. Its core strength is the combination of behavior baselining and AI-powered anomaly detection with coverage for NTLM, Kerberos, SMB and LDAP/S protocol threats, as well as Golden Ticket, Pass-the-Hash, service-account abuse, and privilege escalation. Risk-based conditional access, MFA step-up, automated access revocation, and privilege reduction extend detection into enforcement.
Integration breadth is central to the platform’s hybrid focus. It connects with Microsoft Active Directory, Microsoft Entra ID, Okta, AD FS, PingFederate, PingID, RSA CAS, and Duo, while API integrations support SIEM, SOAR, ticketing, and asset-management systems. Threat hunting across hybrid identity stores gives security teams a way to investigate activity across environments rather than treating directories in isolation. Organizations seeking broad identity coverage, machine-identity monitoring, and automated response should consider Falcon Identity Protection. Teams wanting a free product or straightforward self-service pricing should look elsewhere.
CrowdStrike Falcon Identity Protection pros and cons
- Where it wins
- Detects credential theft, directory attacks, and privilege abuse in real time
- Covers human and machine identities across hybrid identity stores
- Automates MFA step-up, access revocation, and privilege reduction
- Where it doesn't
- Pricing requires contacting sales
- No free plan is available
- Licensing is based on active identities
CrowdStrike Falcon Identity Protection fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update