Explanation:
To implement Microsoft Entra protected actions, you need to configure Conditional Access policies and authentication contexts, then link those to specific permissions within Microsoft Entra ID. This allows you to enforce additional security requirements, like multi-factor authentication or compliance checks, before certain actions can be performed.
Step 1: Create an authentication context
Create a new authentication context: In the Microsoft Entra admin center, navigate to Entra ID > Protection > Conditional Access > Authentication contexts and create a new authentication context with a unique name and description.
Define authentication requirements: Specify the required authentication methods (e.g., multi- factor authentication, compliant device) for this context.
Publish the context: Make sure the context is enabled for use in Conditional Access policies.
Step 2: Create a Conditional Access policy
Create a new policy: In the Microsoft Entra admin center, navigate to Entra ID > Protection > Conditional Access > Policies and create a new policy.
Define policy scope: Specify which users, groups, or applications the policy applies to.
Choose the authentication context: Select the authentication context you configured in step 1.
Enable the policy: Set the policy to "On" or "Report-only" for testing.
Step 3: Add the protected actions:
Navigate to Protected Actions:
In the Microsoft Entra admin center, navigate to Entra ID > Roles & admins > Protected actions.
Add a new protected action:
Click "Add protected actions" and select the authentication context you configured in step 1.
Select permissions:
Choose the specific permissions you want to protect with the Conditional Access policy.
Save the protected action:
Click "Save" to link the authentication context and permissions.
Reference:
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/protected-actions-overview