SC-500 cheat sheet

Confidentiality, integrity, and availability (the CIA triad) are the three core goals of information security; a control is classified by which goal it protects.

Authentication verifies who a principal is; authorization determines what that principal may do; auditing records what was done.

Zero Trust principles: verify explicitly, use least privilege access, and assume breach; no network location is implicitly trusted.

Defense in depth layers controls across identity, network, compute, application, and data; compromise of one layer should not grant full access.

Shared responsibility model: the cloud provider secures the physical and platform layers, while the customer always retains responsibility for data, identities, and access configuration.

Identity is the new security perimeter: modern attacks target credentials and tokens rather than the network edge, so identity controls gate most resource access.

Compliance means meeting legal, regulatory, and internal policy obligations; governance defines the rules, and compliance demonstrates adherence to them.

Risk = likelihood of a threat exploiting a vulnerability against an asset; risk treatment options are mitigate, transfer, avoid, and accept.

Common control families include preventive, detective, corrective, deterrent, and compensating controls; each addresses a different point in the incident timeline.

Microsoft Entra ID is the cloud identity provider for Microsoft 365 and Azure; it authenticates users and issues tokens for applications, while on-premises AD remains a separate directory.

Entra ID editions: Free (basic SSO and user management), P1 (Conditional Access, group-based licensing, self-service password reset for cloud), P2 (P1 plus Identity Protection and Privileged Identity Management).

Conditional Access evaluates signals (user, group, device, location, application, risk) and enforces grant controls (allow, block, require MFA, require compliant device) or session controls.

Multi-factor authentication requires two or more of: something you know, something you have, something you are; passwordless options include FIDO2 keys, Windows Hello for Business, and Microsoft Authenticator.

Microsoft Entra ID Protection detects risky users and risky sign-ins and can automatically require password change or block access based on risk level.

Privileged Identity Management (PIM) provides just-in-time role activation, approval workflows, time-bound assignments, and access reviews for privileged roles.

Microsoft Entra ID Governance covers entitlement management (access packages), access reviews, lifecycle workflows, and terms of use to govern who has access and why.

Hybrid identity options: password hash synchronization, pass-through authentication, and federation with AD FS; Microsoft Entra Connect synchronizes on-premises objects to the cloud.

External identities (B2B collaboration and B2C) let partners and customers authenticate; B2B uses guest accounts, while B2C provides consumer identity experiences.

Microsoft Defender for Cloud provides cloud security posture management (CSPM) with Secure Score and regulatory compliance dashboards, plus cloud workload protection (CWP) across servers, containers, storage, and databases.

Microsoft Sentinel is a cloud-native SIEM and SOAR: it collects logs into a Log Analytics workspace, correlates them with analytics rules, and automates response with playbooks built on Logic Apps.

Microsoft Defender XDR correlates signals across identities, endpoints, email, and cloud apps into a unified incident view, reducing alert fatigue through automatic attack disruption.

Defender for Endpoint delivers endpoint detection and response, attack surface reduction rules, and threat and vulnerability management.

Defender for Identity monitors on-premises Active Directory domain controller traffic to detect credential theft and lateral movement.

Microsoft Defender for Office 365 protects email with Safe Attachments, Safe Links, anti-phishing, and attack simulation training; P1 covers protection, P2 adds automated investigation and response.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that discovers shadow IT, applies session and app controls, and detects anomalous behavior in SaaS apps.

Microsoft Purview and Defender share signals; security teams use the Microsoft Defender portal, while compliance teams use the Microsoft Purview portal for data and compliance controls.

Secure Score in Defender for Cloud quantifies posture against recommended controls; recommendations are prioritized by potential score increase and resource criticality.

Microsoft Purview data classification uses sensitive information types (regex plus supporting evidence), trainable classifiers, and fingerprinting to identify content, and sensitivity labels to tag and protect it.

Sensitivity labels can apply encryption, content marking, and access restrictions, and are enforced across apps, services, and endpoints via label policies; retention labels manage lifecycle instead.

Data Loss Prevention (DLP) policies detect sensitive information in Exchange, SharePoint, OneDrive, Teams, and endpoints and can block, warn, or override with justification.

Microsoft Purview Insider Risk Management detects risky user activity using policy templates and indicators, with privacy controls such as pseudonymization by default.

eDiscovery (Content Search, Standard, and Premium) supports legal hold, search, and review; Premium adds custodian management, review sets, and machine-learning-assisted review.

Audit (Standard and Premium) records user and admin activity; audit retention policies can extend retention up to ten years for specific record types.

Compliance Manager maps controls to regulations such as GDPR, ISO 27001, and NIST, and computes an improvement-action score reflecting your compliance posture.

Microsoft Purview Communication Compliance and eDiscovery address code-of-conduct and legal workflows; retention policies and retention labels differ in that policies apply broadly while labels apply at the item level.

The Microsoft Priva and Purview portals support subject rights requests and privacy risk management for personal data obligations.