SC-500 Advanced Microsoft Security

Zero Trust Maturity Model (CISA): 5 pillars — Identity, Devices, Networks, Applications & Workloads, Data — each with 4 stages: Traditional → Initial → Advanced → Optimal. Not a binary on/off — progressive maturity across all pillars. Used to assess current state and plan ZT roadmap over 3–5 years.

Microsoft ZT implementation pillars: Verify explicitly (strong auth — MFA/FIDO2 + CA + device compliance on every access request). Use least-privilege access (JIT/JEA via PIM, just-enough-admin, RBAC scoped narrowly). Assume breach (segment blast radius — VNet microsegmentation, network isolation; encrypt all data E2E; use analytics to detect anomalies).

ZTNA (Zero Trust Network Access): replaces VPN with application-specific access. User authenticates with MFA + device compliance → access granted to specific app (not the whole network). Microsoft's ZTNA: Entra Private Access (private apps) + Entra Internet Access (internet-bound traffic — SWG). Together form Microsoft's Global Secure Access (GSA) platform.

Microsegmentation: divide workloads into small trust zones. Azure: NSG + Azure Firewall policy in Hub-Spoke model + Azure Virtual Network Manager for at-scale segment policies. M365: Information Barriers (user segment). On-prem: AD OU structure + group policy for workstation/server tier separation.

Advanced KQL operators: arg_max() (get most recent record per entity — find last logon per user). mv-expand (expand arrays/dynamic fields into individual rows — expand JSON arrays from API logs). join kind=leftouter (enrichment without dropping unmatched rows). let statements for modular, readable queries. materialize() for expensive subqueries used multiple times.

ASIM (Advanced Security Information Model): schema normalization layer. Instead of querying device-specific table (Cisco Syslog with vendor fields), query normalized ASIM parsers (imDns, imNetworkSession, imAuthentication) that work identically regardless of data source. Write one detection rule that works across all firewalls and endpoint types — no vendor-specific field names.

Custom data connectors: Logstash (collect from non-standard sources → send to Log Analytics via Azure Monitor HTTP Data Collector API). Functions Apps (poll REST APIs periodically — e.g., pull alerts from third-party security tools every 5 minutes). Azure Event Hub (stream high-volume sources like network flow logs). DCR (Data Collection Rule) — newer, recommended approach for custom log ingestion with transformation at ingestion time.

Cost optimization: Basic vs Analytics tier per table (Basic tier = cheap storage, 8-day search, no analytics queries — use for verbose logs like raw flow data). Commitment tiers (1–100 GB/day → 30–65% discount). Ingestion filtering: DCR transformations filter rows before storage — drop known-noisy events at ingestion. Auxiliary tables for cold storage of rarely-queried compliance logs (PCI-DSS raw audit events).

Microsoft Purview AI Hub: visibility and governance for Microsoft 365 Copilot and other AI services. Tracks: what sensitive data Copilot is accessing in user prompts, what data surfaces in Copilot responses, overshared content accessible via Copilot (SharePoint files with broad permissions that should be restricted). DLP policies extend to Copilot interactions — block sensitive data from being included in AI prompts/responses.

Copilot data governance: before deploying M365 Copilot, run SharePoint data access governance report → identify overshared sites (anyone with link, external sharing enabled for sensitive content). Restrict access, apply sensitivity labels → then deploy Copilot. Copilot respects sensitivity label encryption — Highly Confidential files remain restricted in Copilot responses.

eDiscovery Premium — Review Sets: import documents into a Review Set for in-place analysis — no export/import cycle needed. Apply: near-duplicate grouping (review one canonical document for a cluster of near-identical versions), email threading (review only the latest email in a thread — contains all prior context), predictive coding (AI learns relevance from 500 seed documents → scores all 50,000 docs → review top 20% to find 90% of relevant content).

Communication Compliance + AI: use built-in trainable classifiers (Regulatory Compliance, Harassment, Profanity, Threat) + Teams AI meeting summaries. New: detect AI-generated content in communications (deepfake audio in Teams calls flagged for compliance review). Communication Compliance now reviews Teams chat, email, Teams meetings transcript, and Viva Engage posts.

Entra Lifecycle Workflows: automate Joiner-Mover-Leaver at scale. Joiner workflow (triggered by HR: generate Temporary Access Pass → send welcome email → add to groups → enable account → assign license — all before day 1). Mover workflow (department change → update group memberships → revoke old app access → notify new manager). Leaver workflow (last day: disable account, revoke sessions, block sign-in, remove from groups → D+30: delete account + archive mailbox → D+90: purge).

Microsoft Entra Verified ID: decentralized identity based on W3C Verifiable Credentials standard. Organizations issue credentials (employee badge, education diploma, professional certification) that users hold in their Microsoft Authenticator wallet. Third-party verifiers can verify credentials without calling back to the issuer — no central identity authority required. Use case: credential verification for new employee onboarding without manual HR document review.

Entra Permissions Management (CIEM): Cloud Infrastructure Entitlement Management for Azure, AWS, GCP. Discovers all permissions granted vs permissions actually used. Permission Creep Index (PCI): high PCI = users/apps have far more permissions than needed. Right-size recommendations: shrink permissions to what was used in last 90 days. Automated remediation: create just-in-time permission requests.

Global Secure Access — Microsoft's SSE: Security Service Edge. Two components: Entra Internet Access (Secure Web Gateway — filter web traffic, URL categorization, TLS inspection, block malware) + Entra Private Access (ZTNA — replace VPN for private app access). Deployed via Global Secure Access client on endpoints. Universal Conditional Access: CA policies apply to all traffic (not just Entra-auth apps).