SC-900: Microsoft Security,Compliance&Identity Fundamentals

Explore security concepts and methodologies, including zero trust, shared responsibility, and defense in depth, to protect data access across on-premises and cloud environments, alongside encryption, hashing, and signing.

Explore zero trust: assume an open network, verify every access with multifactor authentication, enforce least privilege, assume breach, and use encryption, analytics, and data classification for visibility and protection.

Explore the six foundational pillars of zero trust—identities, devices, applications, data, infrastructure, and networks—and how strong authentication, least privilege, data labeling and encryption, and network segmentation secure end-to-end environments.

Explore shared responsibility model across on-premises, infrastructure as a service, platform as a service, and software service, clarifying which security tasks and data—plus identities—belong to you versus the cloud provider.

Explore defense in depth through a layered security approach that slows attackers and protects data, from physical security to encryption, upholding confidentiality, integrity, and availability.

Understand the CIA triad—confidentiality, integrity, and availability—and how encryption, access controls, and architecture safeguard sensitive data and ensure reliable access.

Identify common threats, including data breaches, phishing and spear phishing, malware and ransomware, Trojan and rootkit attacks, brute-force and dictionary attacks, DoS, and exploits that target data and devices.

Describe encryption basics, including symmetric and asymmetric methods, keys, and how encryption protects data at rest and in transit, with TLS and HTTP as examples.

Explain encryption, hashing, and signing: hashing yields a fixed hash for data, used to verify passwords, while signing with a private key creates a signature verifiable by a public key.

Summarizes zero trust concepts, including verify, least privilege, and assume breach. Covers six foundational elements of identity, the shared responsibility model, and defense in depth with confidentiality, integrity, and availability.

Explore Microsoft security and compliance principles, learn about privacy principles and the service trust portal, and locate compliance documentation for your geographic location and industry.

Learn Microsoft's six privacy principles—control, transparency, security, strong legal protections, no content based targeting, and benefits to you—and how they shape data collection across products and services.

Access the service trust portal to explore Microsoft security, privacy, and compliance practices, view regional and industry compliance information, create a library of documents, and receive update notifications.

Discover how to use the Azure compliance documentation to meet legal, regulatory, and standards requirements across Azure services, with audit templates, audits, reports, certificates, and region and industry specific guidance.

Discover how Microsoft applies six privacy principles to guide security strategies, and locate the service trust portal and Azure compliance and regulator documentation.

Learn how identities for people and devices control access to resources, and how authentication and authorization underpin identity and access management, including common identity attacks.

Explore common identity attacks such as password-based attacks, phishing, and spear phishing, and how Azure Active Directory identity protection detects user risk and assigning risk to safeguard credentials.

Make identity the new security perimeter in cloud and saas access. Monitor logs and threat hunting as attackers seek credentials via apis to access resources across remote workers and devices.

Explore the four pillars of identity—administration, authentication, authorization, and auditing—and how centralized lifecycle management, policies, and access controls secure users and devices across environments.

Explore modern authentication and the central identity provider that issues security tokens for access. Learn how federated services enable single sign-on across clients, servers, and cloud applications.

Learn how single sign-on lets users log in once to access multiple applications, and how federation uses trust between identity providers to extend access across domains.

Explore directory services and how Active Directory provides a central repository for identities, authentication, and access rights, from on-premises AD DS to Azure Active Directory as a cloud identity provider.

Recognize identity as the new security perimeter and explore a cloud-based identity provider with single sign-on for users. Learn about Azure Active Directory editions and how it supports external users.

Describe how Azure Active Directory provides cloud-based identity and access management, enabling sign-in to internal, cloud, and external resources, with on-premises synchronization and single sign-on for developers.

Explore the four editions of Azure Active Directory, from free to premium P2. See how self-service password reset, device write-back, dynamic groups, and single sign-on secure access across Office 365.

Explore Azure Active Directory identity types, including users and groups, service principals, managed identities (system and user assigned), and device identities (registered, joined, hybrid), plus Intune for device management.

Explain system assigned vs. user assigned managed identities: system assigned ties to its resource and is deleted with it, while user assigned is independent and shareable across resources.

Explore how Azure Active Directory external identities enable external users to access your resources through b2b collaboration and b2c customer identity management, with support for multiple identity providers.

Describe how hybrid identities synchronize between on-premises Active Directory and Azure Active Directory, enabling access to both cloud and on-prem resources using password hash synchronization, pass-through authentication, or federated authentication.

Explain the authentication capabilities of Azure Active Directory and explore password protection, password management, and multifactor authentication to improve security and reduce password risks.

Describe how multifactor authentication combines something you know, something you have, and something you are, with verification methods like authenticator app, sms, or hardware token.

Explore security defaults in Azure Active Directory, require MFA for all users and admins, disable legacy authentication, and defend against password attacks with a minimal, cost-free security baseline.

Explore multifactor authentication in Azure AD, covering password plus verification with authenticator apps, push approvals, TOTP codes, software and hardware tokens, and passwordless methods such as biometrics and Windows Hello.

Explore passwordless authentication in Azure AD using one-time codes, biometrics, Microsoft Authenticator, and FIDO2 security keys, with scenarios for shared PCs and public kiosks.

Discover Windows Hello, a device-bound authentication built into Windows 10 that replaces passwords with biometric or pin-based two-factor security for Microsoft accounts, Active Directory, and Azure Active Directory, stored locally.

Discover how Windows Hello uses a device-bound pin secured by a trusted platform module to keep credentials local, while Azure Active Directory enables features like self-service password reset.

Self-service password reset in Azure AD lets users reset passwords and unlock accounts without help desk involvement, with on-prem write-back and admin notifications.

Azure AD password protection reduces weak passwords by blocking known weak passwords and variants, using a global banned list and organization-specific custom lists, with optional MFA and premium editions.

Examine how password spray evades account lockouts by testing a password across accounts, and how Azure Active Directory passive protection blocks weak passwords with telemetry to build a ban list.

Explore hybrid security by integrating Azure Active Directory password protection with on premise Active Directory to enforce global ban password list, custom policies during password changes, and emphasize multi-factor authentication.

Discover how Azure Active Directory manages access to organizational assets by using intelligent access, conditional access, and Azure Active Directory roles to control access to resources.

Apply zero trust principles with Azure Active Directory's conditional access. Policies analyze signals such as location, device, apps, and user risk to decide on multifactor authentication and access.

Learn how conditional access in Azure AD uses signals like location, device, group membership, and risk to control who can access which cloud apps, with MFA and risk-based policies.

Understand how conditional access in Azure Active Directory blocks, grants, or requires verification based on device state and app protection, with apps and Microsoft Cloud App Security signals protecting data.

Explore Azure AD roles, including global administrator, user administrator, and billing administrator, plus built-in and custom roles, with two-step creation and group-based assignments under license requirements and least privilege.

Explain how conditional access uses if-then statements and signals to grant or block access, and highlight built-in and custom Azure Active Directory rules and the least privileged access principle.

Learn how Azure Active Directory balances identity security with user productivity through identity governance, featuring privileged identity management, identity protection, and terms of use statements.

Discover how Azure Active Directory identity governance manages identity, access, and privileged access lifecycles across on premises and cloud apps, with auditing to verify controls.

Plan the identity lifecycle from join to departure, updating access as roles and departments change. Automate provisioning and HR systems synchronization via Azure AD premium p1/p2.

Manage the access lifecycle from join to departure by using dynamic groups and attribute-based rules to automatically adjust permissions as user attributes change.

Learn how privileged identity management provides governance controls to secure resources across Azure Active Directory and other Microsoft online services, with just-in-time access, approvals, multifactor authentication, justification, and audit history.

Explore entitlement management, terms of use, and access reviews in Azure Active Directory Premium, and learn how automated access packages, approvals, and expirations streamline external user access.

Learn how Azure Active Directory access reviews manage group memberships, application access, and role assignments, ensuring only the right people have resources, with reviewer progress tracking.

Explore how Azure Active Directory terms of use enforce legal and compliance requirements by presenting terms before accessing data, supporting multiple languages and role-based conditions via conditional access.

Explore the capabilities of privileged identity management in Azure Active Directory to manage, control, and monitor access across Azure resources and Microsoft 365, with just-in-time, time-bound, and approval-based access.

Explore azure security capabilities to protect networks, virtual machines, and data through encryption, using tools like network security groups, azure firewall, and azure dDoS protection in cloud and hybrid environments.

Configure Azure network security groups to allow or deny traffic for resources in an Azure virtual network, attached to subnets or network interfaces, using prioritized rules.

Explore how network security groups control traffic with inbound and outbound rules, priorities, ports, and protocols, and learn how defaults and overrides shape access to Azure resources.

Learn how distributed denial of service attacks overwhelm public endpoints, with volumetric, protocol, and resource or application layer variants, and how Azure provides protection by default.

Protect your Azure resources with ddos protection that analyzes traffic, blocks attacks, and keeps legitimate traffic flowing, with basic and standard tiers and straightforward pricing.

Centralize azure firewall in a hub-and-spoke design within a centralized virtual network to control traffic across subscriptions, virtual networks, and on-premises, using NAT and threat intelligence filtering.

Secure seamless rdp and ssh access to Azure virtual machines via the Azure Bastion host, without public ip or agents, protecting against port scans and zero-day exploits.

Explore how a web application firewall delivers centralized protection for web servers and applications against cross site scripting and Ezekial injection, enabling faster threat response across Azure services.

Explore Azure encryption options to protect data at rest and in transit, including disk encryption for Windows and Linux VMs and transparent data encryption for databases and backups.

Azure Key Vault centralizes storage of secrets, keys, and certificates, enabling secure management of API keys, passwords, and hardware security module backed secrets with controlled access.

Explore Azure security tools that protect data and control access, including network security groups, Azure firewalls, encryption in transit and at rest, and Azure Bastion for connections to virtual machines.

Master cloud security posture management by identifying and remediating misconfigurations with automated compliance monitoring and threat and vulnerability management, under a shared responsibility model.

Azure Security Center provides advanced threat protection for cloud and hybrid workloads, protects on-premises infrastructure, and helps harden network security to strengthen your security posture.

Azure Security Center strengthens your security posture by identifying resources, hardening machines, data services, and apps, and continuously assesses compliance to deliver prioritized security controls and recommendations.

Assess the Azure Security Center security score to monitor your security posture, shown as a percentage, and improve it by following recommendations and applying quick fixes.

Protect workloads across cloud and on-premises with Azure Defender, XDR, and hybrid protection. Use built-in and custom policies, dashboards, alerts, and compliance with standards like NIST and Azure security benchmark.

Explore the CIA benchmarks and Azure security benchmark to learn best practices for securing operating systems, servers, cloud services, networks, and mobile devices.

Understand azure security center pricing tiers and options to turn defender on or off, cloud security posture management provides unified threat protection for hybrid workloads via dashboard or APIs.

Explore the Agile Security Center, Azure Defender features, and cloud security posture management to understand your security position on Azure and its security baselines aligned with six benchmarks.

Azure Sentinel provides a single cloud threat detection, visibility, proactive hunting, and threat response solution with integrated threat protection and a high-level view of costs.

Understand how SIEM, SOAR, and XDR collect, analyze, and correlate data to detect and respond to threats, providing an integrated brain across identities, endpoints, applications, and cloud.

Azure Sentinel delivers SIEM and SOAR capabilities, collecting data across cloud and on-prem sources, detecting threats with analytics, investigating with AI, and automating responses.

Ingest data with diverse connectors into Azure Sentinel, monitor with Azure Monitor workbooks, and hunt proactively using a framework to surface detections and automate responses with playbooks.

Explain how Azure Sentinel stores ingested data in the Azure Monitor Log Analytics workspace and compare capacity reservations with pay as you go pricing billed per gigabyte.

Conclude the chapter by presenting Azure Sentinel as a one-stop solution for alert detection, threat visibility, proactive hunting, and threat response, integrated with existing security systems.

Defender for Identity protects on-premises identities by monitoring user behavior and profiling activities. It detects advanced threats and insider actions across the cyber attack chain while reducing the attack surface.

Learn how Microsoft 365 Defender integrates threat signals across apps, identities, and endpoints to protect your organization, including Office 365 endpoints, cloud apps, and Microsoft Cloud App Security.

Microsoft 365 Defender coordinates detection, prevention, investigation, and response across emails, identities, applications, and endpoints, using Defender for Identity, Defender for Endpoint, Cloud App Security, and Defender for Office 365.

Discover Microsoft Defender for Office 365, including threat protection policies, real-time reports, and automated investigation and response to shield email, links, and collaboration tools.

Explore microsoft defender for endpoint, renamed from defender advanced protection, which uses endpoint sensors and cloud analytics to detect, investigate, and remediate threats through automated investigations and threat intelligence.

Discover how cloud access security brokers (CASB) provide visibility into cloud services, guard data with API controls, and bridge on-premises and cloud environments to combat shadow IT.

Explore the cloud app security framework and its capabilities to discover and control cloud app usage, assess risk and compliance, and automatically remediate threats while protecting sensitive information across apps.

Microsoft cloud app security maps your cloud environment using traffic logs, detects risky user behaviors, and provides real-time visibility and control with app connectors, conditional access, and fine-tuned policies.

Explore Office 365 cloud app security and Azure AD cloud app discovery to gain visibility into user activity, shadow IT, and permissions, and to detect threats across cloud services.

Discover how to secure with Microsoft 365 Defender services—identity, Office 365, endpoints—and Cloud App Security, balancing protection and user access.

Explore the security management capabilities of Microsoft 365, including the security center, security score, reports and dashboards, and incident management within the extended detection and response framework.

Explore the Microsoft 365 Security Center as a one-stop snapshot of your organization's security health across identities, data, devices, and apps. View incidents and alerts, and customize navigation.

Learn how to use Microsoft Secure Score to measure and improve your security posture, track actions, and apply licensed recommendations across Microsoft 365, Azure AD, Defender, and cloud security.

Contrast Azure secure score with Microsoft 365 secure score, showing Azure score measures security. Microsoft 365 score covers identities, applications, and devices, with improvement actions and security recommendations guiding admins.

Explore how to manage incidents in Microsoft 365 Defender, grouping alerts into incidents to reveal attack scope, severity, affected users, devices, and mailboxes, and reassign or move alerts as needed.

Explore the features of Microsoft 365 Security Center, review the Microsoft security score and report dashboards, and understand incident management and security across identities, data, devices, and applications.

Explore what Microsoft Intune is and how it supports endpoint security by managing devices with Microsoft Endpoint Manager and the tools available in Intune.

Explore how Microsoft Intune enables cloud-based mobile device and application management across iOS, iPadOS, Android, and Windows to protect corporate data, isolate personal data, and support BYOD.

Explore Intune-based mdm for organization-owned devices, enforcing security and policy-driven settings with certificates for wifi or vpn, plus mobile application management (mam) to protect corporate data on byod apps.

Explore how to manage device security in Intune with security baselines, endpoint policies, device compliance rules, and conditional access, plus integration with Microsoft Defender for Endpoint and role-based access control.

Explore how Microsoft Intune enables endpoint security with device and app management, baselines, and policies, and how it integrates with Endpoint Manager for best-in-class security across Azure and Microsoft 365.

Explore the compliance, legal, and regulatory standards angle in Microsoft 365, introducing Microsoft 365 Compliance Center and Compliance Manager to help organizations manage and simplify compliance.

Explore how organizations manage data under regulations, ensuring access, correction, and deletion rights, retention periods, and cross-border protections through contracts and safeguards.

Explore how HIPAA, FERPA, ISO 27001, and ISO 27701 govern health and education data, including PII protection, and how Microsoft Compliance Center and Compliance Manager support governance and regulatory responses.

Navigate the Microsoft 365 compliance center to view compliance posture, active alerts, and score breakdown, with the solution catalog covering information protection and governance, insider risk, and discovery and response.

Explore the Microsoft 365 Compliance Center's Compliance Manager to inventory data, manage controls, use pre-built or custom assessments, report to auditors, and monitor progress with a compliance score.

Explain what controls are in regulation, standard, or policy terms and outline Microsoft managed, customer managed, and shared controls, including responsibilities for assessment, management, and preparation of systems and processes.

Group controls by regulation and complete assessments to meet standards like ISO 27001, detailing in scope services, Microsoft manage controls, your controls, shared controls, and the assessment score.

Understand how the compliance score from the compliance manager reflects your current posture and guides remediation by breaking down mandatory, discretionary, preventive, detective, and corrective actions to reduce risk.

Explore Microsoft compliance center and compliance manager to manage organizational compliance, avoiding risk of unmet legal and regulatory standards, and preview information protection and governance within Microsoft 365.

Explore the information protection and governance capabilities of Microsoft 365, including data classification, records management, and data loss prevention, to protect financial and personal data and meet compliance standards.

Discover how Microsoft Information Protection and Microsoft Information Governance help you know, protect, and govern data across premises, cloud environments with classification, encryption, data loss prevention, and retention policies.

Explore data classification in the Microsoft 365 compliance center, including sensitive information types, content explorers, and both pre-built and custom trainable classifiers, with examples like credit card and passport numbers.

Administrators gain visibility into sensitive content with content explorer and activity explorer, drilling from overview to details. Monitor label changes and data loss prevention policy effectiveness using filters.

Explore sensitivity labels in the Microsoft 365 Compliance Center, including encrypting emails and documents, marking content, applying labels automatically, protecting containers, extending to third party apps, and roaming with content.

Publish sensitivity labels through label policies to specific users or groups, enforce default and mandatory labeling for emails and documents, require change justifications, and apply encryption-based protections.

Learn how data loss prevention in Microsoft 365 Compliance Center detects and protects sensitive information across Exchange, SharePoint, OneDrive, and Teams, with conditions, actions, and locations, reports, and policy tips.

Explore data loss prevention on windows 10 endpoints and microsoft teams, including activity explorer insights and policy tips that block sharing of sensitive information in chats, channels, and files.

Retention policies apply settings at site or mailbox level; retention labels attach to items and travel with content, enabling disposition review and secure copies to meet regulations and litigation needs.

Manage regulatory, legal and business critical records with Microsoft 365 records management; label content as records, apply retention plans, dispositions, and audit logs, while safeguarding irreversible regulatory records.

Explore Microsoft 365 capabilities such as data classification, records management, and data loss prevention enabling information protection and governance across an organization, reducing noncompliance risk with legal and regulatory standards.

Identify insider risks and act using Microsoft 365 features such as risk management, information barriers, privileged access management, and customer lockbox to investigate and remediate threats.

Learn insider risk management in the Microsoft 365 compliance center to detect, identify, investigate, and act on risky activities while balancing privacy by design and transparency.

Learn how the insider risk management workflow in Microsoft 365 identifies, investigates, and addresses internal risks using predefined templates and a policy-driven cycle of alerts, triage, investigation, and action.

Detect and remediate risky communications with Microsoft 365 communication compliance. Scan internal and external messages using predefined and custom policies, then configure, investigate, remediate, and monitor with dashboards and audits.

Information barriers in Microsoft Teams restrict communication and activities to support compliance. Policies can block searching for users, adding members, chats, meetings, screen sharing, calls, and sharing files or links.

Discover how privileged access management in microsoft 365 enforces zero standing access with just-in-time, just enough access, via an approval workflow and security and compliance center logs, preventing breaches.

Customer lockbox enforces an approval workflow for Microsoft engineers to access data in Exchange Online, OneDrive for Business, and SharePoint Online, with 12-hour time-limited access and audit logs.

Explore how Microsoft 365 helps protect organizations from insider risks by identifying, investigating, and remediating malicious and inadvertent activities, and understand e-discovery capabilities discussed in the next lesson.

Explore the e-discovery capabilities of Microsoft 365, including content search, core and advanced e-discovery workflows, to identify, collect, and manage information efficiently for legal needs.

Identify and search electronic records across Exchange Online mailboxes, Teams, SharePoint Online, and OneDrive using content search and core and advanced e-discovery to hold and export content in Microsoft 365.

Explore how to use the content search tool for e-discovery across Microsoft 365, including where to search, building queries, applying permissions, preserving recipients, and exporting results.

Explore e-discovery workflow in Microsoft 365, including creating cases and placing holds to preserve content. Run searches with keywords, boolean operators, and date ranges, then export results and manifests.

Explore the advanced end-to-end e-discovery workflow built on the core module to preserve, collect, review, analyze, and export data for internal and external investigations, including custodians and search queries.

Explore the purpose and capabilities of e-discovery, including content search, and the core and advanced e-discovery workflows, as the lesson leads into audit capabilities in Microsoft 365.

Explore the audit capabilities of Microsoft 365, including audit logs that track who viewed, altered, or deleted files, and understand the purpose and value of advanced auditing.

Explore the core audit capabilities of Microsoft 365, featuring a unified audit log across services like Dynamics, Power Apps, and Power Automate, with search, export, role-based access, and 90-day retention.

Discover advanced auditing in Office 365 for forensics and compliance investigations, with extended audit log retention and access to management activity APIs.

Microsoft shifts auditing data bandwidth from publisher-level throttling to tenant-level, allocating dedicated bandwidth per organization. Bandwidth scales with organization size and license type, with E5 licenses receiving more bandwidth.

Explore how Microsoft 365 audit logs support regulatory compliance by retaining records, enabling standard and advanced auditing, and guiding internal or external investigations to meet legal and government requirements.

Explore Azure resource governance capabilities to secure and govern resources such as virtual machines, storage accounts, databases, and backups, aligned with organizational compliance, the cloud adoption framework, and resource locks.

Apply resource locks in Azure to prevent accidental deletion or modification, at subscription, resource group, or resource level, using delete or read-only locks to restrict actions.

Define repeatable Azure environments with blueprints to rapidly provision resources across subscriptions and regions, using declarative artifacts like role and policy assignments, ARM templates, resource groups, ensuring compliance.

Enforce standards and assess compliance with Azure Policy via a centralized dashboard. Define JSON policy definitions, form initiatives, and enable bulk or automatic remediation across management groups, subscriptions, and resources.

Differentiate Azure policy and RBAC: policy enforces resource compliance regardless of who changes it, while RBAC controls who can act. When actions violate policy, governance remains intact.

The cloud adoption framework for Azure provides guidance, best practices, and tools. It guides the lifecycle from strategy and plan through prepare, adopt, govern, and manage.

Explore authentication, authorization, and the protocols that enable single sign-on, including OAuth 2.0, OpenID Connect, SAML, and WS-Federation, with token-based access in Azure AD.

Explore authentication and authorization concepts using Azure Active Directory products such as multifactor authentication, Azure AD Connect, single sign-on, and managed service identity, with focus on features and scenarios.

Explore cloud-only vs federated authentication in Azure AD, covering password hash sync, Azure AD Connect options, and the impact on cloud native and on-premise identities with SSO and MFA.