Security, Compliance, and Identity Fundamentals

Confidentiality ensures that information is accessible only to authorized individuals. Mechanisms include encryption, access control lists, and role-based permissions. A breach of confidentiality means unauthorized parties can read sensitive data — for example, an attacker reading encrypted health records after intercepting unprotected network traffic.

Integrity guarantees that data has not been altered without authorization. It is enforced through hashing algorithms (SHA-256), digital signatures, and audit trails. A breach of integrity means data has been tampered with — for example, an attacker modifying a financial transaction record in transit.

Availability ensures that systems and data are accessible to authorized users when needed. It is protected by redundancy, disaster recovery, load balancing, and DDoS mitigation. A breach of availability is a Denial-of-Service attack that prevents a hospital from accessing patient records during an emergency.

The Zero Trust security model operates on the principle "never trust, always verify." Unlike the traditional perimeter model (trust everything inside the corporate network), Zero Trust assumes breach and verifies every request explicitly, regardless of whether it originates inside or outside the network. It replaces implicit trust based on network location with explicit, continuous trust based on identity, device, and context.

Verify explicitly — always authenticate and authorize using all available data points: identity, location, device health, service or workload, data classification, and behavioral anomalies. No request is trusted by default, even from inside the corporate network or from a previously trusted device.

Use least privileged access — limit user access with just-in-time (JIT) and just-enough-access (JEA), adaptive risk-based policies, and data protection. Users get only the permissions they need, only when they need them, and access is revoked when the task is complete.

Assume breach — design with the assumption that the perimeter is already compromised. Minimize blast radius by segmenting access so that a compromised account or endpoint cannot move laterally across the entire network. Encrypt end-to-end. Use analytics for visibility and to drive threat detection and response.

Defense-in-depth applies multiple layers of security so that if one layer is breached, subsequent layers continue to provide protection. The layers from outer to inner are: Physical, Identity & Access, Perimeter, Network, Compute, Application, and Data. Microsoft aligns its products to these layers — for example, Microsoft Entra ID protects the Identity layer, Azure Firewall protects the Perimeter layer, and Microsoft Purview Information Protection protects the Data layer.

Authentication (AuthN) is the process of proving that a person is who they claim to be. It answers the question "Who are you?" Modern authentication uses credentials such as passwords, PINs, biometrics, smart cards, or one-time codes. Strong authentication combines multiple factors from different categories: something you know (password), something you have (phone/security key), and something you are (fingerprint).

Authorization (AuthZ) is the process of determining what an authenticated user is allowed to do. It answers the question "What are you allowed to do?" Authorization occurs after authentication. For example, a user may authenticate to Microsoft 365 but only be authorized to read emails — not to access SharePoint sites or manage user accounts. Role-based access control (RBAC) is the most common authorization model.

Identity as the security perimeter: In the modern cloud-first world, the traditional network perimeter has dissolved. Employees work from home, use personal devices, and access corporate SaaS apps from everywhere. Identity has become the new security perimeter — every access request must be validated against the user's identity, device health, location, and the sensitivity of the resource being accessed.

Identity providers (IdP) create, maintain, and manage identity information. Microsoft Entra ID is Microsoft's cloud-based identity provider. Social providers (Google, Facebook, Apple) are external identity providers. An IdP issues security tokens after successful authentication — these tokens contain claims (user attributes) that downstream applications use to make authorization decisions without re-authenticating the user.

Federation establishes a trust relationship between two identity domains, allowing users authenticated in one domain to access resources in another domain without a separate account. For example, a company can federate with a partner organization so that partner employees can access shared resources using their own corporate credentials. Single Sign-On (SSO) extends this so that a user authenticates once and gains access to multiple systems without re-entering credentials for each application.

The Shared Responsibility Model defines what Microsoft is responsible for securing and what the customer is responsible for. In an on-premises deployment, the customer is responsible for everything. In the cloud: Microsoft is always responsible for the physical datacenter, network infrastructure, and hypervisor. The responsibility for identity, applications, and data shifts depending on the service type: in IaaS, customers manage OS and apps; in PaaS, Microsoft manages the OS; in SaaS, Microsoft manages nearly everything except data governance and access configuration.

Data residency refers to the physical location where data is stored. Organizations — especially in regulated industries — must ensure that personal or sensitive data stays within specific geographic boundaries to comply with local regulations. For example, the European Union's GDPR restricts transfer of personal data outside the EU/EEA unless adequate protections are in place. Microsoft allows customers to choose their Azure region and provides data residency commitments for most services.

Data sovereignty is related but broader: it refers to the concept that data is subject to the laws of the country or region in which it is stored. A company storing data in Germany must comply with German and EU law, even if the company is headquartered in the US. Microsoft's data center locations and contractual commitments help organizations meet sovereignty requirements.

Data privacy is about giving individuals control over how their personal information is collected, used, and shared. Key regulations include GDPR (EU), CCPA (California), LGPD (Brazil), and PDPA (Thailand). Microsoft provides tools like Microsoft Priva and the Service Trust Portal to help organizations understand and demonstrate their compliance with privacy regulations.

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. It provides identity services for Microsoft cloud applications (Microsoft 365, Azure, Dynamics 365) and thousands of third-party SaaS applications. Unlike traditional on-premises Active Directory Domain Services (AD DS) which uses Kerberos/NTLM and LDAP, Entra ID uses modern protocols: OAuth 2.0, OpenID Connect, SAML, and WS-Federation. It is a multi-tenant, globally distributed service with 99.99% availability SLA.

Cloud identities are users created and managed entirely within Entra ID — no on-premises AD required. Their UPN ends in the tenant's onmicrosoft.com domain or a verified custom domain. Any attribute change is made directly in Entra ID and takes effect immediately.

Directory-synchronized identities are on-premises Active Directory users synchronized to Entra ID via Microsoft Entra Connect. The source of authority remains on-premises AD — attributes changed in the cloud are overwritten at the next sync cycle. Password changes must originate in on-premises AD unless password writeback is configured.

Guest users are external partners, vendors, or customers invited to the tenant via B2B collaboration. They authenticate using their home organization's identity (or a Microsoft account) and appear in the directory with a #EXT# suffix in their UPN. Guest access permissions are configurable separately from member user permissions.

Service principals and Managed Identities are non-human identities for applications, services, and automation scripts. A system-assigned managed identity is tied to the Azure resource lifecycle and deleted when the resource is deleted. A user-assigned managed identity exists independently and can be shared across multiple resources — both eliminate the need to manage credentials in code.

Hybrid identity connects on-premises Active Directory with Microsoft Entra ID, giving users one identity for both on-premises and cloud resources. Microsoft Entra Connect synchronizes user accounts, group memberships, and password hashes from on-premises AD to Entra ID. Microsoft Entra Cloud Sync is a newer, lightweight alternative using a small provisioning agent — it supports multi-forest synchronization without a full Entra Connect server installation.

Free tier is included with any Microsoft cloud subscription. It provides basic user and group management, SSO for up to 10 apps, self-service password change for cloud users, and basic security reports.

Microsoft 365 Apps is included with M365 commercial subscriptions. It adds Identity Protection signals for Microsoft 365 apps, self-service password reset (SSPR) for cloud-only users, and two-way sync for Teams and SharePoint group membership.

P1 (Premium 1) unlocks Conditional Access policies, hybrid identity with Entra Connect, dynamic groups, group-based licensing, SSPR with on-premises password writeback, and Microsoft Entra application proxy for publishing on-premises apps.

P2 (Premium 2) includes all P1 features and adds Identity Protection with risk-based Conditional Access, Privileged Identity Management (PIM) for just-in-time access, Entitlement Management, Access Reviews, and Lifecycle Workflows.

Entra ID supports multiple authentication methods: Password (traditional, weakest — vulnerable to phishing and credential stuffing); Multi-Factor Authentication (MFA) — requires a second verification factor: Microsoft Authenticator push notification, OATH hardware token, SMS/voice call (least preferred, SMS is vulnerable to SIM swapping), or email OTP. MFA dramatically reduces the risk of account compromise — Microsoft reports that MFA blocks 99.9% of automated identity attacks.

Passwordless authentication replaces the password entirely with a phishing-resistant credential. Windows Hello for Business uses biometric recognition (fingerprint, facial) or a PIN tied to a specific device. The credential is protected by the device's TPM chip and never transmitted across the network — even the PIN never leaves the device.

FIDO2 security keys are hardware devices (such as YubiKey, Feitian, or Identiv) that use public-key cryptography for passwordless sign-in. During registration, the key generates a key pair and stores the private key securely on the hardware — it never leaves the device. Authentication requires physical possession of the key and, depending on configuration, a PIN or biometric.

Microsoft Authenticator passwordless sign-in lets users approve a sign-in on their phone using biometric or PIN instead of a password. As of 2024, Authenticator also supports Passkeys — FIDO2-compliant credentials stored within the Authenticator app itself, synchronized across all registered devices via the Microsoft account, enabling phishing-resistant authentication without a hardware key.

Self-Service Password Reset (SSPR) allows users to reset their own passwords without calling the help desk, reducing IT support costs. Users must pre-register at least one verification method (email, phone, authenticator app, security questions). Admins configure SSPR for all users, a selected group, or no users. In hybrid environments, password writeback ensures that when a cloud user resets their password, the change is written back to on-premises AD in real time via Entra Connect — without writeback, on-premises authentication would still use the old password.

External authentication methods allow organizations to use a third-party MFA provider (such as Duo or RSA) as a primary MFA option within Entra ID Conditional Access, satisfying Authentication Strength requirements without migrating users to Microsoft Authenticator.

Conditional Access is Entra ID's policy engine that brings signals together from identity, device, location, and application to make real-time access decisions. Every sign-in is evaluated against all active CA policies. A CA policy has two components: Assignments (the conditions that trigger the policy — who, which apps, what conditions) and Access controls (what happens when the policy is triggered — grant with requirements, or block). Requires Entra ID P1 or higher.

Identity and risk signals Conditional Access evaluates: user and group membership, directory roles assigned, sign-in risk (elevated when Entra's ML model detects anomalous behavior such as atypical travel or anonymous IP use), and user risk (elevated when credentials may be compromised, as detected by Entra ID Protection — risk policies require P2).

Device and location signals: device platform (Windows, iOS, Android, macOS, Linux); device compliance state (managed and marked compliant by Intune); named locations (defined corporate IP ranges, or country/region lists); client application type (modern authentication browser or app vs legacy authentication client vs Exchange ActiveSync); and real-time session context via Continuous Access Evaluation (CAE).

Require MFA for all admins — any user holding a privileged role (Global Administrator, Exchange Administrator, etc.) must complete MFA at every sign-in. This is the highest-priority CA policy in most organizations and should always be in Report-only mode before enforcing.

Block legacy authentication — blocks Basic Auth, SMTP Auth, and other legacy protocols that do not support modern MFA challenges. This is critical: legacy authentication clients completely bypass MFA, and the majority of password-spray attacks target legacy auth endpoints.

Require compliant device for sensitive apps — only devices managed by Intune and marked compliant (correct OS version, encryption enabled, no jailbreak) can access Exchange Online, SharePoint Online, or other sensitive workloads. Drives device enrollment adoption.

Block access from untrusted countries — named locations define allowed countries; access attempts originating outside these locations are blocked. Combined with sign-in risk, this significantly reduces exposure to credential attacks from high-risk regions.

Global Administrator has unrestricted access to all Entra ID and Microsoft 365 admin features. This role should be held by fewer than 5 accounts, all of which must be cloud-only, MFA-protected, and monitored via PIM.

User Administrator can create and manage users and groups, reset passwords for non-admin users, and manage licenses. Security Administrator can manage security policies, configure Conditional Access policies, and read security reports and alerts. Conditional Access Administrator can create and modify CA policies without needing the full Security Administrator role. Assign the narrowest role that allows the person to complete their task.

Identity Governance helps organizations ensure the right people have the right access to the right resources, at the right time, and for the right reasons — while also providing audit evidence of these access decisions. It balances security and productivity: too little access blocks users from doing their jobs; too much access (access accumulation over time) creates security risk.

Privileged Identity Management (PIM) provides just-in-time privileged access. Instead of permanently assigning powerful roles (Global Administrator, Exchange Administrator), users are made "Eligible" — they must request activation, provide justification, optionally get approval, and the role activates for a limited time (1–24 hours). This reduces the standing attack surface: a compromised account that only has eligible assignments cannot be used for privilege escalation without going through the activation workflow.

Entitlement Management automates access request, approval, and removal workflows. Admins define access packages — bundles of groups, applications, and SharePoint sites — with policies governing who can request them and how long access lasts. Users visit the My Access portal to discover and request packages. When an assignment expires, access to all included resources is revoked automatically. This eliminates the manual process of provisioning and deprovisioning access.

Access Reviews enable periodic, structured reviews of access to ensure it remains appropriate. A resource owner or manager reviews which users still need membership in a group or access to an application, approves or denies continued access, and results are automatically applied. This addresses the common problem of "access accumulation" — employees who move between roles accumulate access from previous jobs that is never removed.

Lifecycle Workflows (Entra ID Governance feature) automate identity lifecycle tasks using a no-code workflow designer. Workflows are triggered either on a schedule or by attribute changes — for example, a workflow can fire automatically when the employeeHireDate attribute matches the current date. Each workflow calls built-in or custom tasks (add to group, generate TAP, send email, call Logic App).

Joiner scenario — when a new employee is hired, Lifecycle Workflows can automatically: generate a Temporary Access Pass (TAP) for first-day passwordless sign-in, add the user to the appropriate department groups and distribution lists, assign licenses, and send a welcome email to the user and manager before the first day of work.

Mover scenario — when an employee changes roles or departments, workflows update group memberships (removing old team groups, adding new team groups), reassign licenses appropriate to the new role, and notify stakeholders of the transfer — ensuring access reflects the current job, not the previous one.

Leaver scenario — when an employee leaves the organization, workflows disable the account, remove all group memberships and licenses, forward the manager a list of revoked access, archive the mailbox, and schedule account deletion after a configurable number of days (to allow recovery if the departure is reversed). This fully automated offboarding eliminates manual deprovisioning steps that are easily missed.

Azure DDoS Protection defends Azure resources against Distributed Denial-of-Service attacks. DDoS Network Protection (Basic, free) is automatically enabled for all Azure services and provides always-on traffic monitoring and mitigation of common network-layer attacks. DDoS IP Protection (paid) adds adaptive tuning, attack analytics, telemetry, and SLA guarantee with cost protection. DDoS protection works at layers 3 and 4 (network and transport) of the OSI model.

Azure Firewall is a managed, cloud-native, fully stateful network firewall service with built-in high availability and unrestricted cloud scalability. Unlike NSGs (which are basic packet filters on subnets and NICs), Azure Firewall is a centralized network security service deployed in a hub VNet and inspects all traffic flowing through the hub in hub-spoke architectures.

Network traffic filtering supports FQDN (fully qualified domain name) rules — allowing or blocking traffic to external domains like storage.azure.com — in addition to IP address and port rules. Threat Intelligence-based filtering automatically blocks outbound traffic to known malicious IPs and domains, updated continuously from Microsoft's global threat intelligence feed.

DNS proxy and TLS inspection allow Azure Firewall to decrypt HTTPS traffic (using a certificate) so that FQDN rules and Threat Intelligence can be applied to encrypted web traffic — not just metadata. The Premium SKU adds IDPS (Intrusion Detection and Prevention System), which uses signature-based detection to identify and block attack patterns in network traffic in real time.

Web Application Firewall (WAF) protects web applications from common exploits and vulnerabilities — specifically OWASP Top 10 attacks such as SQL injection, cross-site scripting (XSS), and command injection. Azure WAF can be deployed on Azure Application Gateway (regional, for apps within a region), Azure Front Door (global, for apps served worldwide), and Azure CDN. WAF uses managed rule sets that are automatically updated as new threats emerge.

Network Security Groups (NSGs) are the basic network traffic filter for Azure. An NSG contains a list of security rules that allow or deny inbound or outbound traffic based on source/destination IP, port, and protocol. NSGs can be applied to subnets (affecting all VMs in the subnet) or individual network interface cards (NICs). Rules are evaluated in priority order (lower number = higher priority); if no rule matches, the default rules allow VNet-to-VNet traffic and deny all internet inbound.

Azure Bastion provides secure, browser-based RDP and SSH connectivity to VMs directly through the Azure portal, without exposing VMs to the public internet. Instead of opening port 3389 (RDP) or 22 (SSH) to the internet, admins connect through Bastion over HTTPS (port 443). Bastion is deployed in the virtual network and provides a managed jump host experience — no public IP is needed on the target VM.

Microsoft Defender for Cloud (formerly Azure Security Center + Azure Defender) is a unified cloud security posture management (CSPM) and cloud workload protection (CWP) platform. It helps organizations prevent, detect, and respond to threats across Azure, on-premises, and multi-cloud environments (AWS and Google Cloud via Azure Arc). It provides two distinct capabilities: security posture assessment and workload threat protection.

Secure Score is Defender for Cloud's posture measurement tool. It aggregates security assessments across subscriptions and resources into a single percentage score (0–100%). A higher Secure Score means better security posture. Defender for Cloud provides prioritized security recommendations with remediation steps — for example, "Enable MFA for accounts with owner permissions on your subscription" or "Apply Just-In-Time access control to virtual machines." Each recommendation shows its impact on the Secure Score if remediated.

Regulatory compliance in Defender for Cloud maps your resources against industry standards and regulatory benchmarks: Microsoft Cloud Security Benchmark (MCSB), CIS Azure Foundations, PCI-DSS, ISO 27001, NIST SP 800-53, SOC 2, HIPAA, and others. The compliance dashboard shows which controls are passing and which are failing, providing audit-ready evidence for compliance assessments.

Cloud Workload Protection (enhanced security features) provides advanced threat detection for specific Azure resource types. Each plan is enabled per subscription and per resource type — organizations pay only for the workloads they protect.

Defender for Servers integrates Microsoft Defender for Endpoint on Azure VMs, providing EDR, just-in-time (JIT) VM access (open RDP/SSH only on demand to eliminate standing attack surface), file integrity monitoring, and adaptive application controls (allowlist for processes expected to run on a given VM).

Defender for Storage scans every blob uploaded to Azure Storage for malware using Microsoft Threat Intelligence and detects access from anomalous sources, sensitive data exfiltration patterns, and unusual geographic access. Defender for SQL monitors Azure SQL databases and SQL Server on machines for SQL injection attempts, unusual authentication patterns, and brute-force attacks against the database engine.

Defender for Containers provides threat detection at the Kubernetes cluster level (AKS and Arc-enabled clusters): detects runtime threats on nodes, suspicious container activity, privilege escalation, and cryptocurrency mining. It also includes registry vulnerability scanning and CI/CD pipeline integration via admission controllers. Additional plans — Defender for App Service, Defender for Key Vault, and Defender for DNS — extend coverage to PaaS services.

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. As a SIEM, it collects, aggregates, and analyzes security data from across the enterprise to detect threats. As a SOAR, it automates investigation and response to detected threats using playbooks. Sentinel is built on top of Azure Monitor Log Analytics and uses KQL (Kusto Query Language) for querying log data.

Data connectors are how Sentinel ingests data from different sources. Microsoft provides hundreds of built-in connectors for: Microsoft services (Microsoft 365, Entra ID sign-in logs, Defender products); Azure resources (Azure Activity logs, NSG flow logs); third-party security products (firewalls, endpoint protection from Palo Alto, Fortinet, CrowdStrike, etc.); custom sources via Syslog, CEF (Common Event Format), or REST API. Data is stored in a Log Analytics workspace, priced per GB ingested.

Analytics rules run continuously on ingested data to detect threats and create incidents — security alerts grouped into a single investigation case containing all related alerts, entities (users, IPs, hosts), and evidence. Sentinel offers five rule types, each suited to different detection scenarios.

Scheduled rules run a KQL query against the Log Analytics workspace on a configurable schedule (e.g., every 5 minutes, every hour). Analysts write these queries to define exactly what constitutes a threat — for example, "more than 10 failed sign-ins followed by a successful sign-in within 5 minutes from the same IP." This is the most flexible rule type and covers the majority of custom detection logic.

Near Real-time (NRT) rules run a single-table KQL query once per minute. They sacrifice scheduling flexibility for low-latency detection — useful for high-severity, time-sensitive threats where a 5-minute delay is unacceptable.

Fusion rules use ML to correlate low-fidelity signals across multiple data sources into high-confidence multi-stage attack incidents. Fusion detects attack kill chains (initial access → lateral movement → data exfiltration) that would generate too many false positives if each individual signal were treated as an alert.

Anomaly rules use ML to build a behavioral baseline per entity (user, host, IP) and fire when behavior deviates significantly — for example, a user downloading 10× their normal data volume, or a service account authenticating at an unusual hour.

Microsoft Security rules automatically forward alerts from connected Defender products (Defender for Endpoint, Defender for Office 365, Defender for Identity) into Sentinel as incidents. This provides a single investigation pane across all Microsoft security signals.

Playbooks (built on Azure Logic Apps) automate response actions when an incident is created. Common automated responses: send Teams/email alert to the SOC team; block a suspicious user in Entra ID; isolate a compromised VM; add an IP to a firewall block list; create a ServiceNow/Jira ticket. Playbooks can be triggered manually or automatically when an analytics rule fires. This is the SOAR capability that reduces mean time to respond (MTTR).

Microsoft Defender XDR (formerly Microsoft 365 Defender) is an integrated eXtended Detection and Response (XDR) solution that natively coordinates detection, prevention, investigation, and response across endpoints, email, identities, cloud apps, and data. XDR automatically correlates signals from multiple sources to surface high-confidence incidents, reducing alert fatigue compared to reviewing individual product alerts separately.

Microsoft Defender for Endpoint (MDE) is an enterprise endpoint security platform for Windows, macOS, Linux, iOS, and Android. It integrates multiple protection layers that work together across the attack lifecycle.

Threat and vulnerability management (TVM) continuously discovers software vulnerabilities, misconfigurations, and missing patches across enrolled devices. It prioritizes them by exploitability and business impact, giving security teams a ranked remediation backlog without running manual scans.

Attack surface reduction (ASR) rules block specific malicious behaviors before they execute — such as credential dumping from LSASS, Office application spawning child processes, macro-based payload execution, and executable content launched from email. ASR rules can run in audit mode for testing before enforcement.

Next-generation protection is an AI-based antivirus and behavior monitoring engine. It detects malware using file-based signatures, cloud-delivered ML models, and real-time behavioral analysis — catching fileless attacks and living-off-the-land techniques that signature-only engines miss.

Endpoint Detection and Response (EDR) records rich telemetry from devices and detects advanced post-breach activity — lateral movement, credential theft, persistence mechanisms — surfaced as alerts in the Defender XDR portal. Automated investigation and remediation (AIR) uses playbooks to automatically investigate alerts, determine scope, and remediate threats without requiring analyst intervention for every alert.

Microsoft Defender for Office 365 (MDO) protects email and collaboration from advanced threats — phishing, malware, business email compromise, and spam — that bypass standard Exchange Online Protection (EOP) filtering.

Safe Attachments detonates every email attachment in a cloud-hosted virtual sandbox before delivery. If the attachment triggers malicious behavior (drops a payload, contacts a C2 server, encrypts files), it is blocked and never delivered. This protects against zero-day malware and weaponized Office documents with no signature available yet.

Safe Links rewrites URLs in emails and Office documents at delivery time, then re-checks each link against Microsoft's threat intelligence at the moment the user clicks it. If the destination URL has been identified as malicious between delivery and click (a common tactic called "time-of-click URL detonation"), the user is blocked and warned.

Anti-phishing policies protect against impersonation attacks — domain spoofing, look-alike domains (m1crosoft.com vs microsoft.com), display name spoofing ("CEO Name" sent from an external address), and mailbox intelligence-based impersonation. MDO Plan 2 adds threat hunting with Advanced Hunting queries, Attack Simulator for running phishing simulations against your own users, and campaign view for understanding coordinated attack campaigns.

Microsoft Defender for Identity (MDI) uses on-premises Active Directory signals to detect advanced threats, compromised identities, and malicious insider actions. MDI sensors (installed on Domain Controllers) monitor AD authentication traffic — Kerberos, NTLM, LDAP — and detect attacks like pass-the-hash, overpass-the-hash, golden ticket, DCSync, and reconnaissance. Alerts are surfaced in the Defender XDR portal with investigation context.

Microsoft Defender for Cloud Apps (MDCA, formerly MCAS) is a Cloud Access Security Broker (CASB) that sits between users and cloud services to enforce security policies across sanctioned and unsanctioned apps.

Shadow IT discovery identifies all cloud apps in use by analyzing network traffic logs from firewalls or proxies. Each discovered app receives a risk score based on data handling practices, certifications, and regulatory compliance. Admins can sanction apps (allow), block apps, or tag them for monitoring — without requiring agents on user devices.

Session control uses a reverse proxy to enforce real-time policies during active sessions — for example, blocking file downloads from Salesforce on unmanaged devices, or restricting copy-paste of sensitive data in browser-based SaaS applications. Unlike traditional CASB that only blocks at the IP level, session control allows fine-grained in-session enforcement.

Information protection applies Microsoft Purview DLP policies to SaaS applications (Salesforce, Box, ServiceNow, and others). MDCA scans files stored in connected apps for sensitive content and can apply sensitivity labels, quarantine files, or alert administrators when policy violations are found — extending on-premises DLP coverage to the cloud.

Microsoft Purview is the unified data governance and compliance solution, consolidating what was previously split across the Microsoft 365 Compliance Center and Azure Purview. It covers information protection, data lifecycle management, insider risk, eDiscovery, audit, and data governance for the entire data estate.

Sensitivity labels (Microsoft Purview Information Protection, formerly AIP) classify documents and emails and enforce protection policies that travel with the content — inside or outside the organization. A label can apply three types of protection simultaneously.

Visual markings add headers, footers, and watermarks so users and recipients immediately know the sensitivity level of the content (e.g., "CONFIDENTIAL - Internal Use Only" stamped on every page of an exported document).

Encryption uses Azure Rights Management (ARM) to protect content cryptographically. Only authorized users can open the file, regardless of where it is stored — email attachments, SharePoint, USB drives, or third-party cloud storage. Permissions can be granular: some users may read-only, others may edit, and expiration dates can force the content to become inaccessible after a set date.

Access restrictions enforce behavioral controls on Office content: no forwarding of emails, no copy-paste from Word documents, no screenshots in Teams meetings. Labels can also trigger DLP policy enforcement automatically based on the label applied.

Labels can be applied manually by users, recommended by the client based on content detected, or applied automatically by the service when sensitive information types (credit cards, health records, custom patterns) are found in document content.

Data Loss Prevention (DLP) policies detect and protect sensitive information from being shared inappropriately. DLP scans content in Exchange Online (email), SharePoint Online, OneDrive, Teams chat, and endpoints (with Endpoint DLP — requiring an MDE-enrolled device). When a policy matches a sensitive information type (credit card numbers, Social Security numbers, health record identifiers, or custom regex patterns), DLP applies a configured response.

DLP response actions range from passive to blocking: alert the admin silently; notify the user with an inline policy tip explaining why the action is restricted; block the action outright (prevent the email from being sent, prevent the file from being uploaded); or require business justification — the user must type an override reason, which is logged for audit. This graduated approach balances protection with user productivity.

Retention labels and policies (Data Lifecycle Management) ensure data is kept for as long as required by regulation and deleted when it's no longer needed. A retention policy applies to an entire location (all Exchange mailboxes, all SharePoint sites); a retention label applies to individual items and can be applied manually or automatically. Retention is critical for organizations subject to regulations like FINRA (7 years for financial records), HIPAA (6 years for medical records), or SEC Rule 17a-4.

Compliance Manager (in Microsoft Purview) helps organizations manage compliance posture by mapping Microsoft's built-in controls to regulatory requirements. It provides a compliance score (percentage of completed controls), pre-built assessment templates for over 350 regulations (GDPR, ISO 27001, NIST CSF, SOC 2, HIPAA, FedRAMP), and recommended improvement actions with implementation guidance. Compliance Manager tracks both Microsoft's responsibilities (what Microsoft handles as the cloud provider) and customer responsibilities.

The Service Trust Portal (servicetrust.microsoft.com) is Microsoft's central repository for transparency documentation — third-party audit reports, compliance guides, privacy principles, and data protection resources — that organizations can reference when demonstrating Microsoft's security and compliance posture to their own auditors and regulators.

Audit reports on the portal include independent third-party assessments: SOC 1, SOC 2, and SOC 3 reports; ISO 27001 and ISO 27018 certifications; PCI-DSS attestation; FedRAMP authorization packages; and regional and industry-specific certifications. Downloading and presenting these reports to regulators proves Microsoft meets its obligations without requiring customers to audit Microsoft's datacenters directly.

Insider Risk Management (Microsoft Purview) detects, investigates, and acts on potentially risky activities from within the organization — particularly around data theft, data leakage, and policy violations. Common risk scenarios: data theft by departing employees (correlates HR system termination data with file upload/download activity); email policy violations; sharing confidential data with competitors. Insider Risk Management uses ML to detect behavioral anomalies and creates alerts for security teams to investigate. It is privacy-preserving by design — sensitive user data is pseudonymized and investigators must have specific roles to view de-anonymized details.

eDiscovery (electronic discovery) supports legal and compliance investigations by allowing authorized personnel to search, hold, and export content from Microsoft 365 (email, Teams, SharePoint, OneDrive, Yammer). Microsoft Purview eDiscovery (Standard) provides basic hold and export capabilities. eDiscovery (Premium) (formerly Advanced eDiscovery) adds: near-duplicate detection, email threading, smart tags, predictive coding (ML-based relevance ranking), and attorney-client privilege detection — reducing the volume of data that legal teams must review.