SC-900 Study Guide

The shared responsibility model explains who secures what once you move to the cloud. The further up the stack you go, from on-premises to IaaS to PaaS to SaaS, the more the cloud provider takes on, but some responsibilities never transfer. Expect at least one question that gives you a service model and asks who owns a particular layer.

What you need to know

• Four things are always yours, whichever model you pick: your data, your identities and access, your endpoints, and your configuration choices.
• The AI shared responsibility model splits an AI-enabled application into three layers: the AI platform, the AI application, and AI usage.
• On the AI side you stay responsible for what data the AI can reach, who can use it, safe configuration, mitigating prompt injection, and acceptable use policies.
• Moving to the cloud changes who does the work, but it never moves accountability for your data off your desk.

Exam tip: If a question asks who is responsible for something in a SaaS service like Microsoft 365, the answer is almost always Microsoft, unless the thing named is data, identity, devices, or a setting you chose.

Microsoft Learn resource: Describe the shared responsibility model (opens in a new tab)

Defense in depth is the idea that you never rely on one control. You stack layers so that when one fails, the next one is still standing between an attacker and your data. The exam asks you to name the layers and to place a given control in the right one, and it pairs this skill with the CIA triad.

What you need to know

• The layers, from the outside in: physical security, identity and access, perimeter, network, compute, application, and data.
• Data sits at the centre, because every other layer exists to protect it.
• Perimeter is where DDoS protection lives, network is where segmentation and network security groups live, and identity is where MFA, RBAC and Conditional Access live.
• The CIA triad names the three goals: confidentiality (only the right people can read it), integrity (nobody changed it), and availability (it is there when you need it).
• Attacks map onto the triad: stealing data targets confidentiality, tampering with records targets integrity, and a DDoS attack targets availability.

Exam tip: Hashing and digital signatures protect integrity, encryption protects confidentiality, and backups and redundancy protect availability. Questions often test exactly that mapping.

Microsoft Learn resource: Describe defense in depth (opens in a new tab)

Zero Trust replaces the old castle-and-moat assumption that anything inside the network is safe. Every request is authenticated and authorized on its own merits, wherever it comes from. Microsoft names three guiding principles and seven pillars, and the exam expects you to know both by name.

The three guiding principles:

1. Verify explicitly: Authenticate and authorize on all available signals, identity, location, device health, the service being asked for, the data classification, and any anomalies, rather than on a password alone.
2. Use least privileged access: Give only what is needed, for only as long as it is needed, using just-in-time (JIT) and just-enough-access (JEA), backed by risk-based adaptive policies.
3. Assume breach: Design as though an attacker is already inside. Segment access, encrypt end to end, and monitor so you detect quickly and limit the damage.

What you need to know

• The seven pillars are identities, devices, applications, data, infrastructure, networks, and visibility, automation and orchestration.
• The seventh pillar is the integrating layer: it collects signals from the other six, correlates them, and drives automated response, which is where SIEM and SOAR technologies sit.
• Identity is described as the primary control plane, because nearly every successful attack ends up abusing an identity.
• Zero Trust is a strategy and an architecture, not a product you can buy.

Microsoft Learn resource: Describe the Zero Trust model (opens in a new tab)

Encryption makes data unreadable without a key and can be reversed by whoever holds that key. Hashing is one way: it produces a fixed-length fingerprint that cannot be turned back into the original. The exam loves the difference between the two, and the symmetric versus asymmetric split inside encryption.

What you need to know

• Data encrypted with the public key can only be decrypted with the matching private key, which is what solves the key distribution problem.
• Digital signatures use the private key to sign and the public key to verify, proving authenticity and integrity.
• The three data states are at rest (stored), in transit (moving, protected by TLS), and in use (being processed, protected by confidential computing and secure enclaves).
• A salt is a unique random value added to each password before hashing, which is what makes precomputed rainbow tables useless.
• Key management best practice: store keys separately from the data, use hardware security modules, rotate keys, and tightly control who can reach them.

Exam tip: If the question says the original value can never be recovered, the answer is hashing. If it says the recipient needs to read it again, the answer is encryption.

Microsoft Learn resource: Describe encryption and hashing (opens in a new tab)

GRC is the language the compliance domain uses later, so learning it here pays twice. Governance is the rules and who is accountable for them, risk management is identifying and responding to what could go wrong, and compliance is meeting the laws and standards that apply to you. The three data terms in this skill, residency, sovereignty and privacy, come up regularly.

What you need to know

• Governance: the rules, practices and processes that direct and control the organization, including data classification policy, access standards, and who owns which control.
• Risk management follows four steps: identify, assess, respond, monitor. Responses are to accept, mitigate, transfer, or avoid the risk.
• Compliance is adherence to laws, regulations, standards and policies. Familiar examples are HIPAA, ISO 27001 and SOC 2.
• Data residency is about where data is physically stored and the rules on moving it across borders.
• Data sovereignty is about whose laws apply to data, based on the country or region where it is collected, held or processed.
• Data privacy is the appropriate handling of personal data, including transparency, consent, and giving people rights over their own information.

Exam tip: Compliance is the minimum the law requires, security is broader. An organization can be fully compliant and still be insecure, and the exam has been known to make that point.

Microsoft Learn resource: Describe governance, risk, and compliance (GRC) concepts (opens in a new tab)

Cloud apps, remote work, personal devices and partner access have all eroded the network boundary, so the question at access time is no longer "is this inside our network" but "who or what is asking". That is what people mean when they say identity is the new security perimeter. Microsoft frames the management of identity around four pillars.

The four pillars of an identity infrastructure:

1. Administration: creating, updating and removing identities, including provisioning when someone joins and deprovisioning when they leave.
2. Authentication: proving the identity is who it claims to be.
3. Authorization: deciding what that identity is allowed to do.
4. Auditing: tracking who did what, when and from where, through sign-in logs, reports and alerts.

What you need to know

• An identity is the set of attributes that define a person, device, or software component.
• Four types of identity are called out: human, device, workload and agent identities, and all four need authenticating and authorizing.
• Agent identities cover AI agents that act for a user or on their own, and they need governance and lifecycle management like any other identity.
• A compromised application or agent credential gives an attacker the same foothold as a compromised user account.

Microsoft Learn resource: Define identity as the primary security perimeter (opens in a new tab)

Authentication answers the question "who are you". The system challenges the identity for credentials and checks them before anything else happens. The exam tests the three factor categories and the fact that authentication always comes first.

What you need to know

• The three authentication factors are something you know (password, PIN), something you have (phone, security key, smart card), and something you are (fingerprint, face).
• Using one factor is single-factor authentication, and a stolen password is then all an attacker needs.
• Multifactor authentication requires two or more factors from different categories, which is why a password plus a security question is not MFA.
• Authentication only confirms identity. It says nothing about what you are then allowed to do.
• Credentials are evidence, and a username on its own is not a credential because anyone can know it.

Microsoft Learn resource: Define authentication and authorization (opens in a new tab)

Authorization answers the question "what are you allowed to do", and it happens only after authentication has succeeded. It evaluates roles, permissions and attributes against the resource being requested. Microsoft's hotel analogy is worth remembering: showing your ID at the desk is authentication, the keycard that opens your room and the gym but nothing else is authorization.

What you need to know

• Authorization decisions are based on roles (employee, manager, administrator), permissions (read, write, delete), and attributes such as department or location.
• The principle of least privilege says give the minimum access needed to do the job, and nothing more.
• Least privilege limits the blast radius when an account is compromised and reduces accidental data loss.
• Authorization cannot happen before authentication, because you cannot decide what someone may do until you know who they are.
• Checking identity without checking permissions leaves resources exposed, so both processes are needed.

Exam tip: Watch the wording. "Verifying who the user is" is authentication, "determining what the user can access" is authorization. Questions often hinge on nothing more than that.

Microsoft Learn resource: Define authentication and authorization (opens in a new tab)

An identity provider is a central service that creates and manages identities and issues security tokens to applications that trust it. Rather than every application keeping its own usernames and passwords, the application hands the job to the provider. This is what makes single sign-on possible, and Microsoft Entra ID is the example the exam uses.

What you need to know

• After verifying credentials, the identity provider issues a security token carrying claims, individual facts about the identity such as its unique ID, name, roles and expiry.
• An ID token proves the user signed in (authentication), while an access token grants permission to reach a specific resource (authorization).
• The three standard protocols are OpenID Connect for authentication, OAuth 2.0 for authorization, and SAML, which is common in enterprise and federation scenarios.
• Single sign-on (SSO) means one sign-in to the provider gives access to every application that trusts it, which also means disabling the account removes access everywhere at once.
• Centralizing authentication lets you apply one set of policies, including MFA, and monitor sign-ins across the whole estate.

Microsoft Learn resource: Describe the role of the identity provider (opens in a new tab)

A directory is a structured store of objects such as users, devices, groups and applications, and a directory service is the software that makes it available. Active Directory Domain Services was built for on-premises, domain-joined networks, and Microsoft Entra ID is the cloud evolution of that idea. Knowing where AD DS stops is what this skill is really testing.

What you need to know

• AD DS stores users, devices and groups, verifies credentials at sign-in, and defines access rights. A server running it is a domain controller.
• AD DS gives you Group Policy, organizational units, and authentication with Kerberos and NTLM.
• AD DS does not natively authenticate to SaaS applications, does not natively manage iOS or Android devices, and does not natively support OAuth 2.0 or OpenID Connect.
• Users away from the corporate network cannot authenticate to AD DS without a VPN.
• Microsoft Entra ID is Identity as a Service (IDaaS): Microsoft runs the infrastructure, and it is built for cloud apps, any device platform, and modern protocols.

Exam tip: Microsoft Entra ID is not "Active Directory in the cloud". It has no organizational units, no Group Policy and no domain controllers, and that distinction is fair game.

Microsoft Learn resource: Describe the concept of directory services and Active Directory (opens in a new tab)

Federation lets someone authenticate with their own identity provider and still get access to resources in another organization, because the two providers have a trust relationship. Nobody has to create a second account. The passport analogy fits well: your home country issues it, other countries choose to accept it.

What you need to know

• Federation works through a trust relationship between two identity providers, and the resource organization accepts the authentication the other one already performed.
• Trust is not automatically two-way. If A trusts B, B does not automatically trust A, and a two-way trust has to be configured deliberately.
• Common scenarios are business-to-business collaboration, signing in to consumer apps with a Google or Microsoft account, and extending on-premises identity to cloud services.
• Active Directory Federation Services (AD FS) is the Microsoft server role that issues tokens so on-premises Active Directory users can reach cloud applications.
• Federation works across vendors because everyone exchanges tokens using the same standard protocols.

Microsoft Learn resource: Describe the concept of federation (opens in a new tab)

Microsoft Entra ID is Microsoft's cloud-based identity and access management service, and it is what signs in employees, guests, workloads and AI agents to both Microsoft and third-party applications. You get it automatically with any Microsoft Online business subscription such as Microsoft 365 or Azure. It can stand alone or be synchronized with an existing on-premises directory.

What you need to know

• A tenant is one instance of Microsoft Entra ID for one organization, with its own tenant ID and domain such as contoso.onmicrosoft.com, and it is a security and administrative boundary.
• A tenant contains exactly one directory, which is why the two words often get used interchangeably.
• A multitenant organization has more than one tenant, which happens through mergers, independent business units, or data residency requirements.
• Identity Secure Score is a percentage showing how closely your tenant matches Microsoft's recommended identity practices, and it is available in every edition.
• Admins use Microsoft Entra ID to control access to apps and resources, and developers use it to add standards-based single sign-on to their own applications.

Microsoft Learn resource: Describe Microsoft Entra ID (opens in a new tab)

Microsoft Entra ID assigns identities to people, to devices, and to software, and since agents joined the picture there is now a purpose-built identity type for them too. Knowing which bucket a given object belongs in is the whole of this skill. Groups are covered here as well, because they are how access gets assigned at scale.

What you need to know

• User identities represent people, and they are characterized by how they authenticate (internal or external) and by their UserType (member or guest). That gives four combinations: internal member, external guest, external member, and internal guest.
• Workload identities are applications, service principals and managed identities. A service principal is the identity of an application in a tenant.
• Managed identities are a type of service principal that Microsoft Entra ID manages for you, so developers never handle credentials. System-assigned managed identities are tied to the lifecycle of one Azure resource, user-assigned ones exist as standalone resources and survive the resources that use them.
• Agent identities come from Microsoft Entra Agent ID. They are created from an agent identity blueprint, each has a human sponsor accountable for it, and they support attended (on behalf of a user) and unattended (autonomous) scenarios.
• Device identities come in three flavours: Microsoft Entra registered (typically BYOD), Microsoft Entra joined (organization-owned, cloud only), and Microsoft Entra hybrid joined (joined to both on-premises Active Directory and Microsoft Entra ID).
• Security groups can contain users, devices, other groups, service principals and agent identities, while Microsoft 365 groups can contain only users, including external ones. Membership can be assigned or dynamic.

Exam tip: Agent identities do not carry their own credentials. The blueprint acquires tokens on their behalf, and Microsoft Entra ID blocks agents from being granted many high-privilege roles.

Microsoft Learn resource: Describe types of identities (opens in a new tab)

Hybrid identity gives a person one identity that works against both on-premises and cloud resources. It is achieved through provisioning an identity from one directory into another and then keeping the two in step. The tool Microsoft now recommends for that job has changed, so check your notes if you studied this a while ago.

What you need to know

• Inter-directory provisioning creates the identity in the second directory, most often taking a user who already exists in Active Directory and provisioning them into Microsoft Entra ID.
• Synchronization then keeps the on-premises user and group information matching the cloud.
• Microsoft Entra Cloud Sync is the recommended tool. It uses a lightweight provisioning agent, keeps its configuration in Microsoft Entra ID, supports multiple agents for high availability, and handles disconnected multi-forest environments.
• Microsoft Entra Connect Sync is the earlier on-premises tool that Cloud Sync is replacing, and new features are being built on Cloud Sync.
• The Cloud Sync agent uses the SCIM specification to provision and deprovision users and groups.

Microsoft Learn resource: Describe hybrid identity (opens in a new tab)

Microsoft Entra ID supports a long list of authentication methods, and the exam cares about two things: which ones can be used as a primary method versus only as a second factor, and which ones are phishing resistant. Microsoft's direction of travel is away from passwords and away from SMS, so read any "which method should you recommend" question with that in mind.

What you need to know

• Passwordless methods are Windows Hello for Business, passkeys (FIDO2), passkeys in Microsoft Authenticator, Platform Credential for macOS, and certificate-based authentication.
• Phishing-resistant methods use public key cryptography bound to the site's domain: Windows Hello for Business, Platform Credential for macOS, synced passkeys, FIDO2 security keys, passkeys in Microsoft Authenticator, and certificate-based authentication.
• Passkeys come in two forms: device-bound, where the private key never leaves one physical device, and synced, where it is synced through a cloud passkey provider.
• SMS and voice call are the weakest options. Voice call is never a primary method, and Microsoft recommends moving away from both toward Microsoft Authenticator or passkeys.
• A Temporary Access Pass (TAP) is a time-limited passcode an admin issues so a user can sign in and register other methods, which makes it the onboarding and recovery answer.
• OATH tokens, software or hardware, generate time-based one-time codes and are second factors only.

Exam tip: Email one-time passcode is only ever used for self-service password reset and guest sign-in, never as a primary workplace authentication method.

Microsoft Learn resource: Describe authentication methods (opens in a new tab)

Multifactor authentication asks for a second, different kind of proof at sign-in, which is why a stolen password on its own stops being enough. Microsoft Entra ID handles the prompt as part of the sign-in event, so applications need no changes. The security defaults versus Conditional Access comparison is a favourite exam question.

What you need to know

• MFA requires two or more of: something you know, something you have, something you are. The factors must come from different categories.
• Security defaults are a free baseline: every user registers for MFA, admins must perform MFA, users perform MFA when needed, legacy authentication protocols are blocked, and privileged activities such as the Azure portal are protected.
• Security defaults are enabled by default on new tenants and are aimed at organizations on the free tier of Microsoft Entra ID.
• Number matching is what stops MFA fatigue attacks: the user types the number shown on the sign-in screen into the Microsoft Authenticator app.
• Conditional Access gives granular control instead, requiring MFA based on location, device state, risk or the application being accessed, and it needs Microsoft Entra ID P1 or P2.
• Microsoft's own figure is that MFA and blocking legacy authentication stop more than 99.9% of common identity attacks.

Exam tip: Security defaults and Conditional Access policies are mutually exclusive. If an organization needs conditional policies, security defaults have to be turned off first.

Microsoft Learn resource: Describe multifactor authentication (opens in a new tab)

Microsoft Entra password protection blocks weak and compromised passwords when users set or reset them, using a global list Microsoft maintains and an optional custom list you supply. It can also be extended to on-premises Active Directory. Self-service password reset belongs in this conversation too, because it is the feature that cuts the help desk calls.

What you need to know

• The global banned password list is built from Microsoft's own security telemetry on real password spray attacks. It applies to every tenant automatically and cannot be disabled or configured.
• The custom banned password list holds your organization's own terms such as brand names, product names and locations, up to a maximum of 1,000 terms, and it is combined with the global list.
• Evaluation runs in four steps: normalization (lowercase and common character substitutions), fuzzy matching, substring matching against the user's name and the tenant name, and a score calculation that needs at least five points to accept the password.
• Adding a few base terms works better than long lists, because the algorithm blocks variants and combinations automatically.
• To extend protection on-premises you install two components: a proxy service on a domain-joined machine and a DC agent on domain controllers. No schema changes are needed and domain controllers never talk to the internet directly.
• Self-service password reset (SSPR) lets users reset their own password using registered methods, and it can write the change back to on-premises Active Directory.

Microsoft Learn resource: Describe password protection and management capabilities (opens in a new tab)

Conditional Access is Microsoft's Zero Trust policy engine. It evaluates signals about the sign-in and then decides whether to allow it, block it, or demand something more, and it runs after first-factor authentication has already completed. Policies are if-then statements built from two halves.

What you need to know

• A policy has two components: assignments (the who, what, where and when) and access controls (what happens as a result). Assignments are logically ANDed, so all of them must be satisfied.
• Assignments cover users and workload identities, target resources, network or location, and conditions such as sign-in risk, user risk, insider risk, device platform, client apps, and device filters.
• Access controls are block access, grant access with requirements such as MFA, an authentication strength, a compliant device, a hybrid joined device, an approved client app, a password change or terms of use, and session controls such as sign-in frequency.
• Authentication strengths come in three built-in flavours: multifactor authentication, passwordless MFA, and phishing-resistant MFA. You can also create custom strengths.
• Conditional Access can protect generative AI services such as Microsoft 365 Copilot, for example requiring phishing-resistant MFA or blocking access when insider risk is elevated.
• Conditional Access requires Microsoft Entra ID P1 or P2.

Exam tip: Conditional Access is not a front line against denial-of-service attacks, because it only runs after first-factor authentication. It can use signals from those events, but it is not the defence.

Microsoft Learn resource: Describe Conditional Access (opens in a new tab)

Role-based access control means granting permissions through roles rather than one by one. Microsoft Entra roles control Microsoft Entra resources, Azure roles control Azure resources, and the exam checks that you keep the two straight. Built-in roles are fixed, custom roles let you pick from the same permission list.

What you need to know

• Built-in roles have a fixed set of permissions that cannot be modified. Common ones are Global Administrator, User Administrator and Billing Administrator.
• Custom roles are a two-step job: create the role definition from a preset list of permissions, then create a role assignment. They require Microsoft Entra ID P1 or P2.
• A scope limits which resources a role assignment applies to, either organization-wide or to a single object such as one application.
• Built-in roles fall into three categories: Microsoft Entra specific roles, service-specific roles such as Exchange Administrator or SharePoint Administrator, and cross-service roles such as Security Administrator and Compliance Administrator.
• Least privilege applies: assign User Administrator rather than Global Administrator when the job is managing users.

Microsoft Learn resource: Describe Microsoft Entra roles and role-based access control (RBAC) (opens in a new tab)

Microsoft Entra ID Governance makes sure the right people keep the right access over time, and that you can prove it to an auditor. It covers three lifecycles: identity, access, and privileged access. Think of it as the answer to "who should have access, what are they doing with it, who checks, and can we show our working".

What you need to know

• The identity lifecycle is modelled as join, move, leave, and it is often driven by a signal from an HR system such as Workday or SuccessFactors.
• Identity lifecycle automation includes inbound provisioning from HR sources, lifecycle workflows triggered at key events, automatic assignment policies in entitlement management, and user provisioning out to other applications.
• Entitlement management packages up group memberships, application roles and SharePoint roles into access packages that users can request, with separation of duties checks.
• Dynamic groups use attribute-based rules, so membership updates itself when a user's attributes change.
• Privileged Identity Management covers the privileged access lifecycle.
• Governance now extends to agent identities: every agent identity has a human sponsor, and if that sponsor leaves, sponsorship transfers automatically to their manager.

Microsoft Learn resource: Describe Microsoft Entra ID Governance (opens in a new tab)

Access reviews are how an organization periodically reconfirms that people still need the access they have. They are the answer to permission creep, the slow accumulation of rights as people move between teams and guests linger in groups long after a project ended. Reviewers can be admins, group owners, or the users themselves.

What you need to know

• Reviews can target group memberships, access to enterprise applications, and role assignments, including Microsoft Entra roles and Azure resource roles through Privileged Identity Management.
• Reviews can be one-off or recurring on a weekly, monthly, quarterly or annual schedule.
• No access changes until the review finishes. Results can then be applied automatically or manually.
• Auto-apply does not work for dynamic groups or groups that originate on-premises, where the change has to be made at the source.
• Multi-stage access reviews support up to three stages, so different types of reviewer can attest in sequence.
• AI-powered recommendations analyse sign-in activity and user-to-group affiliation to suggest approve or deny, and flag peer outliers for closer scrutiny.

Exam tip: Typical scenarios the exam reaches for are too many users in privileged roles, guests who still have access to sensitive content, and maintaining a documented exception list for auditors.

Microsoft Learn resource: Describe access reviews (opens in a new tab)

Privileged Identity Management, usually just called PIM, replaces permanent admin rights with access that is granted when it is needed and taken away afterwards. Instead of being a Global Administrator all day every day, a user is made eligible and activates the role for a specific task. That one change removes a standing target for attackers.

What you need to know

• PIM is just in time, time-bound, approval-based, visible through notifications, and auditable with a downloadable history.
• The two assignment types are eligible, where the user must activate the role before using it, and active, where the permissions apply immediately.
• Activation can require multifactor authentication, a justification, and approval from a designated approver.
• The general workflow is assign, activate, approve or deny, extend or renew.
• PIM works with Microsoft Entra roles, Azure roles, and PIM for Groups, which gives just-in-time group membership and ownership.
• The PIM audit history shows role assignments and activations for the past 30 days.

Exam tip: Eligible versus active is the distinction that gets tested. Eligible means "can activate when needed", active means "has it right now".

Microsoft Learn resource: Describe the capabilities of Privileged Identity Management (opens in a new tab)

Microsoft Entra ID Protection detects identity-based risk, reports it, and can feed it into Conditional Access so that a risky sign-in is challenged automatically. It works on user identities and workload identities, and its detections come from Microsoft's analysis of signals across Microsoft Entra ID, Microsoft Accounts and Xbox. The two risk types are the thing to lock in.

What you need to know

• Sign-in risk is the probability that a particular authentication request was not made by the identity owner. Examples are anonymous IP address, atypical travel, and unfamiliar sign-in properties.
• User risk is the probability that the account itself is compromised. Examples are leaked credentials, user-reported suspicious activity, and suspicious sending patterns.
• The three reports are risk detections, risky sign-ins and risky users.
• Risk detections are only generated when the correct credentials are used, because a wrong password is not evidence of compromise.
• Remediation can be automatic through risk-based Conditional Access, for example requiring MFA or a secure password change, or manual, where an admin dismisses, confirms safe, or confirms compromise.
• Risk data can be exported to a SIEM, a Log Analytics workspace, a storage account or Event Hubs.

Microsoft Learn resource: Describe Microsoft Entra ID Protection (opens in a new tab)

A distributed denial-of-service attack tries to exhaust your resources so that genuine users cannot get through. Azure DDoS Protection watches traffic all the time, spots the patterns, and drops attack traffic before it reaches your application. Every Azure service already gets basic platform-level protection, so the exam usually asks what you gain by adding the paid service.

What you need to know

• The three attack types are volumetric (flood the bandwidth), protocol (exhaust server resources at layers 3 and 4), and resource or application layer (target the application itself).
• Azure DDoS Protection works at layer 3 and layer 4. Layer 7 protection for web applications needs a Web Application Firewall.
• The two tiers are DDoS Network Protection, which protects all the resources in a virtual network, and DDoS IP Protection, a pay-per-protected-IP model with the same core engine but without the value-added services.
• Only Network Protection includes DDoS rapid response support, cost protection, and WAF discounts.
• Key features are always-on traffic monitoring, adaptive real-time tuning that learns your traffic profile, and telemetry through Azure Monitor with alerting.
• Default platform protection has a higher threshold than most applications can survive and gives you no telemetry or alerting, which is the reason to onboard.

Microsoft Learn resource: Describe Azure DDoS protection (opens in a new tab)

Azure Firewall is a managed, cloud-based network firewall that protects the resources in your virtual networks. The usual design is one firewall in a central virtual network with everything else routed through it, so you control traffic for every network from one place. It is stateful, highly available, and available in three tiers.

What you need to know

• Azure Firewall is stateful, so it tracks the state of active connections rather than judging each packet alone.
• It supports network-level rules based on IP address, port and protocol, and application-level rules that control access to fully qualified domain names.
• It supports SNAT for outbound traffic and DNAT for inbound traffic to private resources.
• Threat intelligence-based filtering alerts on and denies traffic to and from known malicious IP addresses and domains.
• Azure Firewall Manager centrally manages firewall policies across multiple subscriptions and Virtual WAN secure hubs.

Exam tip: Network security groups filter traffic within virtual networks, Azure Firewall is a centralized service that protects across virtual networks and subscriptions. They complement each other, and questions often hand you the words "centralized" or "across subscriptions" as the giveaway.

Microsoft Learn resource: Describe Azure Firewall (opens in a new tab)

A Web Application Firewall protects web applications from the common exploits that attackers reuse everywhere. Because it is centralized, you patch a newly discovered vulnerability in one place rather than in every application. WAF operates at layer 7, which is exactly where Azure DDoS Protection stops.

What you need to know

• WAF defends against the threats in the OWASP core rule set, including SQL injection, cross-site scripting (XSS), remote file inclusion, and HTTP floods.
• HTTP floods are application-layer DDoS attacks, which Azure DDoS Protection alone does not cover.
• WAF can be deployed with Azure Application Gateway for regional protection, Application Gateway for Containers, Azure Front Door for global protection closer to the attacker, and Azure Content Delivery Network.
• Application Gateway gives deep HTTP packet inspection and complex routing for applications in a single region, while Front Door protects globally distributed applications.
• Centralized protection simplifies management, improves response time, and shrinks the window of exposure when a new vulnerability appears.

Microsoft Learn resource: Describe Web Application Firewall (opens in a new tab)

Segmentation divides a network into smaller pieces so that a compromise in one place does not open the door to everything else. In Azure the building block is the virtual network, divided further into subnets. This is the assume-breach principle of Zero Trust expressed in network design.

What you need to know

• An Azure Virtual Network (VNet) is your private network in Azure. You can create multiple VNets per region per subscription, and multiple subnets inside each one.
• VNets provide network-level containment: no traffic is allowed across VNets or inbound by default, so communication has to be provisioned explicitly.
• Subnets let you separate workloads with different security requirements, for example web servers in one subnet and database servers in another.
• VNets connect to on-premises networks through site-to-site VPN, point-to-site VPN, or Azure ExpressRoute.
• VNet peering connects two virtual networks so resources communicate as if they were in one network, and global virtual network peering does the same across Azure regions.
• Peered traffic travels over the Azure backbone, not the public internet.

Microsoft Learn resource: Describe network segmentation in Azure (opens in a new tab)

A network security group is a list of rules that filters traffic to and from Azure resources inside a virtual network. It is the distributed, per-subnet and per-network-interface counterpart to the centralized Azure Firewall. Rule processing order is the detail the exam likes.

What you need to know

• You can associate one NSG per subnet and one per network interface, but the same NSG can be reused on as many subnets and interfaces as you like.
• Rules are evaluated by priority, lowest number first, and processing stops at the first match.
• Each rule specifies name, priority, source or destination, protocol (TCP, UDP, ICMP or Any), direction, port range, and action.
• Azure creates three default inbound and three default outbound rules. They cannot be deleted, but they can be overridden by rules with a lower priority number.
• The default inbound rules are AllowVNetInBound, AllowAzureLoadBalancerInBound and DenyAllInBound, so anything not from the virtual network or the load balancer is denied.
• Application security groups (ASGs) let you group virtual machines by role, such as WebServers or DbServers, and write NSG rules against the group instead of tracking IP addresses.

Microsoft Learn resource: Describe Azure Network Security Groups (opens in a new tab)

Azure Bastion lets administrators reach virtual machines over RDP and SSH straight from the Azure portal, without exposing management ports to the internet. The virtual machine needs no public IP address, no agent and no special client software. That removes a favourite entry point for attackers who scan for open RDP.

What you need to know

• Bastion is a fully platform-managed PaaS service that you provision per virtual network, and it then serves every virtual machine in that network and in peered networks.
• Connections run over TLS on port 443, so they traverse corporate firewalls that already allow HTTPS.
• Virtual machines need no public IP address, which protects them from port scanning.
• The four tiers are Developer (shared, free, one connection at a time, not for production), Basic (dedicated, fixed capacity), Standard (adds host scaling, shareable links, native client support, custom ports and file transfer), and Premium (adds session recording and private-only deployment).
• Connection methods are browser-based for all tiers, and native client connections and shareable links for Standard and Premium.
• You do not need to apply NSGs to the Azure Bastion subnet, because Microsoft hardens the service.

Exam tip: If the scenario says "connect to a VM without a public IP address" or "without opening RDP to the internet", the answer is Azure Bastion.

Microsoft Learn resource: Describe Azure Bastion (opens in a new tab)

Azure Key Vault is the central, controlled home for secrets: API keys, passwords, certificates and cryptographic keys. Applications fetch what they need at runtime, so secrets stop living in source code and configuration files. Access is authenticated by Microsoft Entra ID and authorized by Azure RBAC or Key Vault access policies.

What you need to know

• Key Vault solves three problems: secrets management, key management, and certificate management including provisioning and automatic renewal of TLS/SSL certificates.
• Authentication is via Microsoft Entra ID, and authorization is via Azure RBAC or Key Vault access policies.
• The two service tiers are Standard, with software-protected keys, and Premium, with HSM-protected keys for stricter compliance requirements.
• Key Vault supports logging so you can monitor how and when secrets and keys are accessed.
• Contents are replicated within a region and to a secondary region for high availability, with no admin action needed to fail over.
• Creating a vault per application keeps secrets segregated, so an application can reach only the vault it is allowed to use.

Microsoft Learn resource: Describe Azure Key Vault (opens in a new tab)

Microsoft Defender for Cloud is a cloud-native application protection platform, or CNAPP, that covers Azure, AWS, GCP and on-premises resources. It brings posture management and workload protection together in one service, and it is now integrated into the Microsoft Defender portal. Microsoft organizes its capabilities into three pillars, and those pillar names are worth memorizing.

The three pillars:

1. DevSecOps: unifies security management at the code level across multiple pipelines such as GitHub and Azure DevOps, moving security checks earlier in development, an approach often called shift-left security.
2. Cloud security posture management (CSPM): continuously assesses your environment for misconfigurations, aggregates findings into a secure score, and gives hardening recommendations.
3. Cloud workload protection platform (CWPP): protects specific workloads such as servers, storage, databases and containers through Microsoft Defender plans, with alerts when a threat appears.

What you need to know

• AI security capabilities sit alongside the three pillars: AI security posture management (AI SPM) maintains an AI Bill of Materials and assesses AI workloads, and AI threat protection detects prompt injection, data leakage, data poisoning and credential theft in real time.
• Defender for Cloud is integrated into the Microsoft Defender portal, so posture and threat protection live in one place.
• Alerts from AI threat protection flow into Microsoft Defender XDR for correlation with the rest of the environment.
• Misconfiguration is one of the leading causes of cloud security incidents, which is the problem CSPM exists to solve.

Microsoft Learn resource: Describe Microsoft Defender for Cloud (opens in a new tab)

CSPM is the pillar that answers "how secure are we right now, and what should we fix first". Its headline feature is the secure score, and its advanced features come with the paid Defender CSPM plan. Knowing which capability is free and which is paid is exactly the kind of detail SC-900 tests.

What you need to know

• Secure score aggregates all findings into a single number, and the higher the score the lower the identified risk.
• Recommendations are grouped into security controls, and your score only improves when you remediate all the recommendations for a resource within a control.
• Foundational CSPM is free and automatically enabled: asset discovery, continuous assessment, security recommendations, compliance with the Microsoft cloud security benchmark, and secure score.
• The paid Defender CSPM plan adds attack path analysis, cloud security explorer, governance (assigning recommendations to owners with due dates), data security posture management (DSPM) and AI security posture management (AI SPM).
• Attack path analysis models how an attacker could chain issues together to reach a high-value resource, so you fix the combination rather than each finding in isolation.
• Cloud security explorer is a graph-based query tool for proactively asking security questions about your environment.

Microsoft Learn resource: Describe Cloud security posture management (opens in a new tab)

Defender for Cloud assesses your resources against policies, and anything that fails turns into a recommendation you can act on. The policies come from Azure Policy, they are grouped into initiatives, and the default initiative is the Microsoft cloud security benchmark. This chain, policy to initiative to standard to recommendation, is what the skill is asking you to describe.

What you need to know

• An Azure Policy definition is a rule about one security condition, a security initiative is a collection of definitions grouped toward a goal, and you assign either one to a scope such as a management group, subscription or resource group.
• The default, built-in standard assigned when you enable Defender for Cloud is the Microsoft cloud security benchmark (MCSB).
• The MCSB builds on CIS and NIST controls, maps to industry frameworks including CIS, NIST and PCI DSS, and gives implementation guidance for Azure, AWS and GCP.
• Recommendations name the issue, the remediation steps, the affected resources, the severity (high, medium or low) and, where available, attack path context.
• You can add regulatory standards such as ISO 27001, SOC 2, NIST SP 800-53 and PCI DSS, and track them in the regulatory compliance dashboard.
• One fix can improve compliance against several standards at once, because their controls overlap.

Microsoft Learn resource: Describe how security policies, standards, and recommendations improve cloud security posture (opens in a new tab)

Cloud workload protection is delivered through Microsoft Defender plans that you enable per resource type. Where CSPM tells you what to harden, CWPP detects and responds to threats against the workload itself. The plans are named after what they protect, which makes them easy marks if you have read the list once.

What you need to know

• Plans include Defender for Servers, Defender for App Service, Defender for Storage, Defender for Databases, Defender for Containers, Defender for Key Vault, Defender for Resource Manager, Defender for APIs and Defender for AI Services.
• Plans are enabled separately and run at the same time to cover compute, data and service layers.
• Defender for Servers includes Microsoft Defender for Endpoint, giving full endpoint detection and response on your virtual machines.
• Enhanced features include vulnerability scanning for virtual machines, container registries and SQL resources, multicloud support for AWS and GCP, hybrid coverage, threat protection alerts, and just-in-time access to virtual machine management ports.
• Defender for AI Services works with Microsoft Threat Intelligence and Azure AI Content Safety Prompt Shields to detect prompt injection, data leakage, data poisoning and credential theft.

Exam tip: Free Defender for Cloud gives you continuous assessment and secure score. Anything that detects an active threat, rather than a misconfiguration, belongs to a paid Defender plan.

Microsoft Learn resource: Describe the enhanced security of Microsoft Defender for Cloud (opens in a new tab)

SIEM and SOAR are the two halves of a modern security operations centre. SIEM gives visibility by collecting and correlating data from everywhere, and SOAR gives speed by automating the response. You need to be able to say which one does what before the exam asks you about Microsoft Sentinel.

What you need to know

• A SIEM collects log data and security events from across the whole estate, on-premises and cloud, and correlates them to find patterns a single event would not reveal.
• A SOAR takes alerts from the SIEM and other tools and triggers action-driven automated workflows.
• Orchestration connects different tools so they work together, and automation handles the repetitive steps.
• A playbook is a predefined sequence of automated actions triggered by an alert or incident, for example disable the account, notify the team, open a ticket, gather context.
• Alert fatigue is the operational problem both technologies address, through incident grouping, severity scoring and automatic enrichment.
• AI and machine learning add anomaly detection, alert correlation and prioritization, false positive reduction, and multi-stage attack detection.

Microsoft Learn resource: Define the concepts of SIEM and SOAR (opens in a new tab)

Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR, and it has grown into a security platform with its own data lake and graph. It collects from across multicloud and multiplatform environments, detects with rules and machine learning, and responds with automation. It is accessed through the Microsoft Defender portal.

What you need to know

• Sentinel supports four stages end to end, collect, detect, investigate and respond, and it collects through over 350 built-in data connectors covering Microsoft services, non-Microsoft platforms including AWS and GCP, and custom sources.
• Analytics rules query the data and raise alerts, and related alerts are grouped into incidents your team can assign and investigate.
• Detection spans three approaches: rule-based detection from Content hub templates, AI and machine learning including the Fusion correlation engine for multistage attacks, and threat intelligence matching.
• Detection coverage maps to the MITRE ATT&CK framework, so you can see which techniques you cover and where the gaps are.
• Response uses automation rules to manage how incidents are handled and playbooks built on Azure Logic Apps to carry out the remediation steps.
• The platform stores data in two tiers: the analytics tier (a Log Analytics workspace, where rules run) and the data lake tier, a cost-effective long-term store holding data for up to 12 years.

Exam tip: The Azure portal experience for Microsoft Sentinel retires on 31 March 2027, after which Sentinel is only in the Microsoft Defender portal. Expect questions to name the Defender portal as the place you go.

Microsoft Learn resource: Describe threat detection and mitigation capabilities in Microsoft Sentinel (opens in a new tab)

Microsoft Defender XDR is a suite, not a single product. It coordinates detection, prevention, investigation and response across endpoints, identities, email and applications, so an attack that starts with a phishing email and moves to a laptop is seen as one story rather than six unrelated alerts. Learning which service protects which surface is the highest-value study you can do in this domain.

What you need to know

• The combined incidents queue groups related alerts, suspicious events and impacted assets into one incident across every product in the suite.
• Automatic response to threats means a detection in one product is acted on by the others, for example a malicious file found on a device is removed from email across the organization.
• Self-healing returns compromised devices, identities and mailboxes to a secure state automatically.
• Automatic attack disruption contains an attack in progress by isolating devices, disabling accounts or containing malicious IP addresses without waiting for a human.
• Cross-product threat hunting gives query-based access to 30 days of raw signals across the suite.

Microsoft Learn resource: Describe Microsoft Defender XDR services (opens in a new tab)

Microsoft Defender for Office 365 protects against threats that arrive by email and through collaboration tools such as SharePoint, Teams and Outlook. It covers the whole cycle, preventing and detecting threats, investigating them, and responding. It comes in two plans, and the features cluster neatly into those three groups.

What you need to know

• The two plans are Plan 1 and Plan 2, and Plan 2 carries the heavier investigation and response features.
• Prevent and detect: anti-malware, anti-spam, anti-phishing and spoofing protection, connection filtering, quarantine policies, Safe Attachments (opens files in a virtual environment, a process called detonation) and Safe Links (checks URLs at click time).
• Attack simulation training runs realistic simulated attacks so you can find and train vulnerable users before a real one lands.
• Investigate: message trace, Threat Explorer and real-time detections, threat trackers, URL trace, and the campaigns view that groups a coordinated attack into one picture.
• Respond: zero-hour auto purge (ZAP) retroactively removes malicious messages that were already delivered, and automated investigation and response (AIR) runs the investigation playbooks for known threats.
• Everything is reached from the Email & collaboration node of the Microsoft Defender portal.

Exam tip: Safe Attachments detonates files in a sandbox, Safe Links rewrites and checks URLs, and ZAP cleans up messages after delivery. Those three names carry a lot of questions between them.

Microsoft Learn resource: Describe Microsoft Defender for Office 365 (opens in a new tab)

Microsoft Defender for Endpoint protects devices: laptops, phones, tablets, servers and network devices. It combines sensors built into the operating system, cloud security analytics and threat intelligence to prevent, detect, investigate and respond to advanced threats. It is also what Defender for Servers gives you inside Defender for Cloud.

What you need to know

• Its capabilities include core Defender Vulnerability Management, attack surface reduction, next generation protection (which includes Microsoft Defender Antivirus), endpoint detection and response (EDR), and automated investigation and remediation (AIR).
• Microsoft Secure Score for Devices measures the security configuration posture of your devices and recommends improvements.
• Microsoft Defender Experts for Hunting is a managed threat hunting service that adds proactive hunting and context for your security operations team.
• It is built on three technologies: endpoint behavioral sensors in the operating system, cloud security analytics, and threat intelligence.
• It comes in Plan 1 and Plan 2, and it integrates with Microsoft Intune and Microsoft Defender for Cloud.

Microsoft Learn resource: Describe Microsoft Defender for Endpoint (opens in a new tab)

Microsoft Defender for Cloud Apps protects the SaaS applications your organization uses, including the ones nobody told IT about. It is a cloud access security broker, or CASB, which acts as a gatekeeper between your users and the cloud services they reach. Shadow IT discovery is the capability most likely to appear in a question.

What you need to know

• A CASB brokers real-time access between users and cloud resources, giving discovery of cloud app usage and shadow IT, threat protection, information protection and compliance.
• Cloud Discovery identifies apps in use from network traffic and an app catalog, assesses them against more than 90 risk indicators, and lets you set policies to monitor them.
• SaaS Security Posture Management (SSPM) surfaces misconfigurations in connected apps and recommends fixes, and feeds into Microsoft Secure Score.
• Information protection scans connected apps for sensitive files, and can apply a sensitivity label, block downloads to unmanaged devices, or remove external collaborators.
• App governance protects app-to-app access by watching OAuth apps and their permissions, unused apps and expiring credentials.
• AI agent protection detects custom agents built in Microsoft Copilot Studio, monitors their activity, and can block suspicious agent actions in real time.

Microsoft Learn resource: Describe Microsoft Defender for Cloud Apps (opens in a new tab)

Microsoft Defender for Identity is the identity threat detection and response, or ITDR, part of the suite. It installs sensors on your on-premises identity servers, learns what normal looks like for each user, and flags the behaviour that means an attacker is moving through your directory. It also monitors identity signals from Microsoft Entra ID, which makes it a hybrid solution.

What you need to know

• Sensors are installed on domain controllers and servers running Active Directory Federation Services and Active Directory Certificate Services.
• The sensor parses event logs and network traffic locally and sends only the parsed information to the cloud service.
• It detects threats across the attack kill chain: reconnaissance, compromised credentials, lateral movement, and domain dominance.
• It builds a behavioral baseline for each user from activities, permissions and group membership, then flags anomalies against it.
• Remediation actions can be taken directly on on-premises identities, for example disable user in Active Directory or reset user password.
• Everything surfaces in the Identities node of the Microsoft Defender portal, and its security assessments feed Microsoft Secure Score.

Exam tip: Defender for Identity watches on-premises Active Directory, Microsoft Entra ID Protection watches cloud identities. When a question mentions domain controllers or lateral movement, it means Defender for Identity.

Microsoft Learn resource: Describe Microsoft Defender for Identity (opens in a new tab)

Microsoft Defender Vulnerability Management finds the weaknesses across your assets, ranks them by the risk they actually present, and helps you get them fixed. It covers Windows, macOS, Linux, Android, iOS and network devices. It sits under Exposure management in the Microsoft Defender portal.

What you need to know

• It reduces risk through three core capabilities: continuous asset discovery and monitoring, risk-based intelligent prioritization, and remediation and tracking.
• Assessment tools include security baselines assessment against benchmarks such as CIS and STIG, software and vulnerability inventory, network share assessment, authenticated scan for Windows, browser extensions assessment, digital certificates assessment, and hardware and firmware assessment.
• Prioritization uses Microsoft threat intelligence, breach likelihood predictions, business context and device assessments, so emerging threats and active breaches rise to the top.
• Remediation requests are sent to IT as tasks in Microsoft Intune, and you can block vulnerable applications for specific device groups.
• The exposure score reflects how exposed your devices are, and a lower score is better, while Microsoft Secure Score for Devices reflects configuration posture.
• Findings are listed as CVEs with severity and CVSS ratings.

Microsoft Learn resource: Describe Microsoft Defender Vulnerability Management (opens in a new tab)

Microsoft's threat intelligence aggregates and enriches threat information so analysts stop spending their day gathering raw data from DNS records, WHOIS lookups and malware databases. It supports triage, incident response, threat hunting, vulnerability management and threat infrastructure analysis. Its capabilities are reached from the Threat intelligence node of the Microsoft Defender portal, and Microsoft Learn still documents them under the Microsoft Defender Threat Intelligence (Defender TI) name.

What you need to know

• Threat analytics reports analyse a tracked threat and tell you whether it is active in your environment and whether your protections cover it. The dashboard groups them into latest threats, high-impact threats and highest exposure.
• Intel profiles are Microsoft's curated knowledge on threat actors, malicious tools and vulnerabilities, maintained by Microsoft Threat Intelligence experts.
• Intel explorer lets analysts search by keyword, indicator or CVE ID, and returns articles and vulnerability articles with mitigation guidance and a priority score.
• Projects organize indicators of interest and indicators of compromise (IOCs) from an investigation, with a history of names, descriptions and collaborators.
• The standalone Defender TI product was set for retirement on 1 August 2026, and its capabilities are converging into Microsoft Defender XDR and Microsoft Sentinel, where they are reached from the Microsoft Defender portal.

Microsoft Learn resource: Describe Microsoft Defender Threat Intelligence (opens in a new tab)

The Microsoft Defender portal is the single place security teams work. It brings SIEM, XDR, posture management and threat intelligence together, so incidents from Microsoft Sentinel, the Defender XDR suite and Microsoft Defender for Cloud all land in one queue. Knowing which node holds which product is genuinely useful, because several questions describe a task and ask where you would go.

What you need to know

• Access requires a role such as Global Reader or Administrator, Security Reader or Administrator, or Security Operator, and the cards you see depend on your role because the portal uses role-based access control.
• The left navigation maps to products: Identities to Defender for Identity, Endpoints to Defender for Endpoint, Email & collaboration to Defender for Office 365, Cloud apps to Defender for Cloud Apps, and Cloud security to Defender for Cloud.
• An incident is a collection of related alerts, assets, investigations and evidence, and it serves as the case file for the whole attack.
• Advanced hunting is query-based and reaches 30 days of raw data from Defender XDR and Microsoft Sentinel, using KQL, a query builder, or natural language through Security Copilot.
• Exposure management holds Security Exposure Management, vulnerability management, attack surface and secure score, and Assets holds devices, identities, applications, cloud resources and AI agents.
• The unified Action center brings remediation actions from Defender for Endpoint and Defender for Office 365 into one list.

Microsoft Learn resource: Describe the Microsoft Defender portal (opens in a new tab)

The Service Trust Portal is Microsoft's public site for the audit reports, whitepapers and compliance material that show how Microsoft cloud services protect your data. It is where you go when an auditor asks for evidence about your cloud provider rather than about your own tenant. Some content is public and some requires you to sign in.

What you need to know

• To reach some resources you must sign in as an authenticated user with a Microsoft Entra organization account.
• Content is organized into four categories: Certifications, Regulations, and Standards, Reports, Whitepapers, and Artifacts, Industry and Regional Resources, and Resources for your Organization.
• Reports and whitepapers cover business continuity and disaster recovery, penetration test and security assessment attestations, privacy and data protection, and FAQs.
• Resources for your Organization is restricted by tenant and depends on your subscription and permissions.
• My Library lets you save documents in one place, and notifications email you when Microsoft updates a document you saved.

Exam tip: The Service Trust Portal is about Microsoft's compliance posture. Compliance Manager, later in this domain, is about your compliance posture. Questions often place the two side by side.

Microsoft Learn resource: Describe the offerings of the Service Trust portal (opens in a new tab)

Microsoft states its data privacy commitments in four areas, backed by contractual guarantees rather than goodwill. They shape how Microsoft designs its products, and the exam expects you to recognize them by name. They are published in the Microsoft Trust Center.

The four privacy commitments:

1. You control your data: your data belongs to you, you can access, modify or delete it, Microsoft uses it only to provide the services you chose, and it is never mined for advertising or marketing research.
2. Know where your data is located: Microsoft offers data residency options around the world so you can choose where data is stored, backed by contractual commitments.
3. Your data is secured at rest and in transit: encryption up to AES-256 at rest, industry-standard TLS and IPsec in transit, and secured encryption keys with services such as Azure Key Vault.
4. Microsoft defends your data: government requests are directed to you rather than answered by Microsoft, every demand is scrutinized for legal validity, and Microsoft will challenge requests in court where it lawfully can.

What you need to know

• Microsoft's control commitments are reinforced by compliance with ISO/IEC 27018, the first international code of practice for cloud privacy.
• Subcontractors and subprocessors can perform only the functions they were engaged for, are bound by the same privacy commitments, and are audited in advance.
• Microsoft does not give any government direct or unfettered access to customer data.
• Where legally permitted, Microsoft notifies you of a request and gives you a copy of it.

Microsoft Learn resource: Describe Microsoft's privacy principles (opens in a new tab)

The Microsoft Purview portal is the single place all Purview solutions live, and its solutions are grouped into four areas. Learning those four groupings makes the rest of this domain much easier, because you can predict where any given solution sits. It is also where the answer lives when a question asks "where do you configure this".

What you need to know

• Core holds the foundational capabilities: Audit, Data Map, Settings and Workflows.
• Risk & Compliance holds Communication Compliance, Compliance Manager, eDiscovery, Information Barriers and Records Management.
• Data Governance holds Data Catalog, Data Lifecycle Management and Data Policy.
• Data Security holds Data Loss Prevention, Information Protection and Insider Risk Management.
• Access to each solution is controlled by permissions, so an admin only sees the solutions their roles allow.

Microsoft Learn resource: Describe Compliance Manager (opens in a new tab)

Microsoft Purview Compliance Manager helps you assess and manage compliance across a multicloud environment, not just Microsoft 365. It translates regulations into concrete improvement actions, tracks who is doing what, and gives you something to show an auditor. Four building blocks hold the whole solution together.

What you need to know

• Controls are individual requirements of a regulation, standard or policy. They come in three types: Microsoft-managed, your controls (customer-managed), and shared controls.
• Assessments group the controls from a specific regulation or standard, and templates let you create them quickly.
• Regulations are the library of frameworks Compliance Manager provides templates for, over 360 of them, now including templates for AI regulations and standards.
• Improvement actions carry recommended guidance, can be assigned to people for implementation and testing, and hold documentation, notes and status.
• Compliance Manager continuously scans your Microsoft 365 environment and updates the technical action status automatically.
• The first score you see is based on the Microsoft 365 data protection baseline.

Microsoft Learn resource: Describe Compliance Manager (opens in a new tab)

Compliance score is the number Compliance Manager puts on your compliance posture, and it works by awarding points for improvement actions you complete. Points are weighted by the risk involved, so the actions that matter most move the score most. The split between your points and Microsoft's is the detail worth remembering.

What you need to know

• The score is made of two kinds of points: your points, from actions your organization completes, and Microsoft-managed points, from actions Microsoft has already completed as the cloud provider.
• Each improvement action has a different point value depending on the potential risk it addresses.
• A higher score means more improvement actions are completed, which is the quickest way to read the dashboard.
• The score lets you prioritize work by focusing on the actions with the highest impact, track progress over time, and report to leadership and auditors.
• Compliance score measures progress against improvement actions. It is not a guarantee of compliance with any particular regulation.

Microsoft Learn resource: Describe Compliance Manager (opens in a new tab)

Before you can protect data you have to know what it is, and classification is how Microsoft Purview works that out. It uses pattern matching for structured data such as card numbers, and machine learning for content that only makes sense in your organization. These classifiers are then reused by nearly every other Purview solution.

What you need to know

• Sensitive information types (SITs) are pattern-based classifiers. Each is defined by a primary element, supporting elements, a confidence level (low, medium or high) and proximity.
• There are four categories of SIT: built-in, named entity (person names, addresses, medical terms, in unbundled and bundled forms), custom, and exact data match (EDM), which matches against values from a database of your own sensitive information.
• Trainable classifiers use AI and machine learning to classify content by what it is rather than by a pattern, which suits contracts, invoices and resumes.
• Trainable classifiers come as pre-trained classifiers that are ready to use, and custom classifiers you create by seeding with positive and negative samples and then verifying results until the accuracy stabilizes.
• Classifiers only work on items that are not encrypted.
• The same classifiers detect sensitive data in AI prompts and responses, for example when a user pastes card numbers into a Microsoft 365 Copilot prompt.

Microsoft Learn resource: Describe the data classification capabilities of Microsoft Purview Information Protection (opens in a new tab)

Content explorer and Activity explorer are the two reporting tools that turn classification into something you can act on. One shows you what you have and where it is, the other shows you what people are doing with it. The difference between them is a reliable exam question.

What you need to know

• Content explorer gives a current snapshot, and users with the right permissions can drill in and read the scanned source content in Exchange, SharePoint and OneDrive.
• Access to Content explorer is deliberately restricted because it lets someone read the contents of scanned files.
• Activity explorer receives signals from endpoint data loss prevention, which is how you see printing and USB copying on Windows and macOS devices.
• Both sit under the Explorers section of Information Protection in the Microsoft Purview portal.
• Admins use Activity explorer to judge whether existing controls are working and where more protection is needed.

Microsoft Learn resource: Describe the data classification capabilities of Microsoft Purview Information Protection (opens in a new tab)

A sensitivity label is a stamp that stays with a document or email wherever it travels, carrying its protection settings with it. The label is what classifies and protects, and a sensitivity label policy is what publishes labels to people so they can use them. Keep those two jobs separate in your head.

What you need to know

• Labels are customizable (Personal, Public, Confidential, Highly Confidential), stored in clear text in the content's metadata so other apps can read them, and persistent, so they travel with the content.
• An item can only have one sensitivity label at a time.
• Labels can encrypt content, apply content markings such as watermarks, headers and footers, apply automatically or recommend a label, protect containers such as Teams, Microsoft 365 Groups, SharePoint sites and Loop workspaces, set the default sharing link type, and classify without applying any protection at all.
• Watermarks cannot be applied to email or meeting invites, only to documents and Loop content, while headers and footers work on both.
• Label scopes decide where a label applies: Files & other data assets, Emails, Meetings, and Groups & sites. A label applied at the Groups & sites scope protects the container, it does not label the items inside.
• Sensitivity label policies publish labels to users and groups, and can apply a default label, require justification for downgrading a label, make labeling mandatory, and link to a custom help page.

Exam tip: Microsoft 365 Copilot honours sensitivity labels. When a response draws on several items, it inherits the most restrictive label, and it checks the user's permissions before referencing encrypted content.

Microsoft Learn resource: Describe sensitivity labels and policies in Microsoft Purview Information Protection (opens in a new tab)

Data loss prevention identifies sensitive items, monitors what people do with them, and steps in when something is about to be shared inappropriately. You implement it by writing DLP policies, and those policies can reach a long list of locations. It is the protection frame at its clearest: the policy lets normal work continue and acts only when the content is genuinely sensitive.

What you need to know

• DLP covers Microsoft 365 services such as Teams, Exchange, SharePoint and OneDrive, Office applications, Windows 10, Windows 11 and macOS endpoints, non-Microsoft cloud apps, on-premises file shares and SharePoint, Microsoft Fabric and Power BI, and Microsoft Edge for Business.
• Protective actions are a policy tip that warns the user, block with override where the user supplies a justification, block without override, locking and quarantining data at rest, and hiding the sensitive information in a Teams chat.
• DLP uses deep content analysis rather than a simple text scan: keyword matches, regular expressions, internal function validation, proximity matching and machine learning.
• Every policy needs the same five decisions: what data to monitor, administrative scoping, the locations, the conditions, and the protective action.
• All monitored activities are recorded to the audit log and routed to Activity explorer, and alerts appear in the DLP alert management dashboard and in the Microsoft Defender portal as incidents.
• Endpoint DLP audits activities on devices such as copying to removable media, printing, copying to network shares, and opening items in unallowed apps, and it can warn or block users pasting sensitive data into third-party generative AI sites.

Microsoft Learn resource: Describe data loss prevention in Microsoft Purview (opens in a new tab)

Microsoft Purview Records Management adds the extra controls that high-value items need: legal, regulatory and business-critical content that has to be locked down, tracked and provably disposed of. It builds on the retention capabilities of data lifecycle management rather than replacing them. The difference between a record and a regulatory record is the detail to remember.

What you need to know

• Content is declared a record by applying a retention label that is configured to mark items as records.
• When something is labeled a record, activities are restricted, activities are logged, and proof of disposition is kept at the end of the retention period.
• A regulatory record goes further: the label cannot be removed by anyone, not even a global administrator, and the retention period cannot be shortened. Because it is irreversible, the option is off by default and must be enabled with PowerShell.
• Event-based retention starts the retention clock when a business event happens rather than on a fixed date, for example seven years after an employee leaves.
• A disposition review sends items to designated reviewers before permanent deletion, so they can approve the deletion or extend retention.
• A file plan is where you view and manage all retention labels together, import an existing retention schedule, and add descriptive information such as regulatory authority and business function.

Microsoft Learn resource: Describe Microsoft Purview Records Management (opens in a new tab)

Microsoft Purview Data Lifecycle Management keeps what you need and deletes what you do not. Retention policies work at the container level and retention labels work at the item level, and the two can be combined. Understanding which one travels with the content is what most questions are really testing.

What you need to know

• The three retention settings are retain-only, delete-only, and retain and then delete.
• Content stays in its original location. If a user edits or deletes retained content, a copy is kept in a secure location most people never see.
• Retention settings work across SharePoint, OneDrive, Microsoft Teams, Viva Engage and Exchange.
• Retention label policies publish labels and specify which locations and which users can use them, which is how you roll labels out in a controlled way.
• Only retention labels support disposition review.
• Prompts and responses from AI apps including Microsoft 365 Copilot are stored in the user's Exchange mailbox, so retention policies apply to them like any other content.

Exam tip: The scenario of "everything in this site for five years, but these specific documents for ten" is the classic one: use a retention policy for the site and a retention label for the individual items.

Microsoft Learn resource: Describe Data Lifecycle Management (opens in a new tab)

Microsoft Purview Insider Risk Management looks at risks that come from inside the organization: data theft by departing employees, accidental leaks, security policy violations, and now risky use of AI. It is built around a five-stage workflow and a set of policy templates, and it is deliberately privacy-conscious in how it presents user activity. Analytics let you see potential risk before you configure a single policy.

What you need to know

• The four principles behind it are transparency (privacy by design), configurable, integrated across Purview solutions, and actionable.
• The workflow has five stages: policies, alerts, triage, investigate, and action.
• Insider risk analytics evaluates potential risk in your organization before you set up any policy, which helps you choose the right templates.
• Investigation tools include a user activity chart, content explorer for the files and messages linked to an alert, case notes, and the data risk graph powered by Microsoft Sentinel integration.
• Actions at the end are to notify the user, or to escalate a serious case to eDiscovery for legal investigation.
• Policy templates cover data theft by departing users, data leaks, security policy violations, risky AI usage, risky agents, priority users, healthcare patient data misuse, and risky user behaviour driven by HR connector signals.

Microsoft Learn resource: Describe insider risk management in Microsoft Purview (opens in a new tab)

eDiscovery is the process of finding and delivering electronic information that can be used as evidence in a legal case. Microsoft Purview now presents a single unified eDiscovery experience, with premium features unlocked by licensing rather than by a separate product. Learning the workflow and which features are premium is the fastest way through this skill.

What you need to know

• The Microsoft Purview portal presents a unified eDiscovery experience, with premium features available depending on licensing and subscription.
• Supported services are Exchange Online, Microsoft Teams, Microsoft 365 Groups, OneDrive, SharePoint and Viva Engage.
• The workflow runs: escalate from a trigger event, create and manage a case, search and refine, then export, create review sets or place holds, and finally review and act.
• A hold preserves content that might be relevant so it cannot be deleted during the investigation.
• A review set is a secure Azure Storage location where collected items are copied, giving a static set you can search, filter, tag and analyze. Review sets are a premium feature.
• Other premium features are optical character recognition (OCR), conversation threading for Teams and Viva Engage chats, and decryption of content protected by Microsoft Purview Message Encryption and sensitivity labels.

Microsoft Learn resource: Describe eDiscovery (opens in a new tab)

Auditing records what users and admins did across Microsoft 365, and keeps those records in the unified audit log where investigators can search them. It is the evidence layer for security incidents, internal investigations and compliance obligations. There are two solutions, and the retention numbers are what get tested.

What you need to know

• The unified audit log captures activity across Exchange Online, SharePoint and OneDrive, Microsoft Teams, Microsoft Entra ID and other services.
• Four ways to search and retrieve audit data: the audit log search tool in the Microsoft Purview portal, the Audit Search Graph API, the Search-UnifiedAuditLog PowerShell cmdlet, and the Office 365 Management Activity API.
• Intelligent insights, a premium feature, show events such as mail items being accessed, replied to or forwarded, and what users searched for in Exchange Online and SharePoint Online.
• Microsoft 365 Copilot interactions are logged automatically as CopilotInteraction events across apps such as Teams, Outlook and Word, with no configuration needed.
• Microsoft Security Copilot is different: a Copilot owner has to opt in before Microsoft Purview captures those interactions.

Microsoft Learn resource: Describe audit in Microsoft Purview (opens in a new tab)