SC-500 key terms

A security model that assumes no user or device is trusted by default, even inside the network. Every access request is verified explicitly, granted least privilege, and assumes breach.

A layered security strategy where multiple independent controls protect assets, so that failure of one layer does not expose the whole system. Layers include physical, identity, network, compute, application, and data.

The principle of granting users, services, and processes only the permissions needed to perform their tasks, and only for as long as needed. It limits the blast radius of a compromised account.

A cloud framework dividing security duties between provider and customer. The provider secures the cloud infrastructure; the customer secures data, identities, and configurations they control, with the split varying by service type.

The process of verifying that a user, device, or service is who or what it claims to be, typically through credentials such as passwords, certificates, or biometric factors.

The process of deciding what an authenticated identity is allowed to do, based on assigned roles, permissions, or policies. It happens after authentication succeeds.

An authentication method requiring two or more independent verification factors, such as a password plus a phone approval or fingerprint, making credential theft alone insufficient to gain access.

Sign-in methods that remove the password entirely, using alternatives such as passkeys, authenticator apps, or hardware keys. This reduces risk from phishing, reuse, and weak passwords.

A digital representation of a user, device, application, or service that a system can authenticate and authorize. Identities are the primary security perimeter in cloud environments.

Microsoft's cloud-based identity and access management service that authenticates users and services and controls access to Microsoft cloud apps and thousands of integrated third-party applications.

A policy engine in Microsoft Entra that evaluates signals such as user, device, location, and risk, then enforces controls like multi-factor authentication or block before granting access to a resource.

An authorization approach where permissions are bundled into roles and assigned to identities, simplifying administration and supporting least privilege compared with direct per-user permissions.

A Microsoft Entra service providing just-in-time, time-bound, approval-based activation of privileged roles, plus access reviews and audit history, to reduce standing administrative access.

A scheduled process where reviewers confirm whether users still need access to a group, application, or role. Unneeded access is removed automatically or after a decision.

A suite of capabilities for managing identity lifecycle, including access reviews, entitlement management, lifecycle workflows, and terms of use, helping ensure the right people have the right access.

A Microsoft Entra ID Governance feature using access packages and catalogs to let users request and receive bundles of resources with approval, expiration, and periodic revalidation.

A service that detects identity risk signals such as leaked credentials, anonymous IP use, and atypical sign-ins, then feeds risk levels into Conditional Access policies and reports.

A Microsoft Entra ID Protection score estimating the likelihood that a specific authentication request is not from the legitimate identity owner, based on detected anomalies and threat intelligence.

A synchronization tool that replicates on-premises directory users and identities to Microsoft Entra ID, enabling hybrid identity scenarios such as password hash sync and seamless single sign-on.

A configuration where an identity exists in both an on-premises directory and a cloud directory, with synchronization or federation keeping the two representations consistent for users and devices.

A cloud security posture management and workload protection service that assesses configurations, computes secure scores, and detects threats across Azure, multicloud, and hybrid resources.

A numerical measure in Microsoft Defender for Cloud reflecting how well resources follow recommended security controls. Higher values indicate fewer outstanding recommendations and stronger posture.

A cloud-native security information and event management platform that ingests logs, correlates events, detects threats with analytics rules, and supports investigation and automated response.

Two related security operations capabilities: security information and event management collects and correlates log data, while security orchestration, automation, and response executes playbooks to handle incidents.

A read-only query language used in Microsoft Sentinel, Azure Monitor, and Defender to filter, summarize, and join log data, forming the basis for analytics rules and hunting queries.

A proactive security practice of searching logs and telemetry for hidden or undetected adversary activity, rather than waiting for automated alerts to fire.

An extended detection and response platform that correlates signals across identities, endpoints, email, and cloud apps into unified incidents, enabling coordinated investigation and automated response.

An endpoint security service providing antivirus, attack surface reduction, endpoint detection and response, and automated investigation for Windows, macOS, Linux, and mobile devices.

A set of controls that block common risky behaviors and techniques attackers use, such as malicious macros or script execution, reducing the ways a device can be compromised.

A family of compliance and data governance solutions covering data classification, data loss prevention, insider risk, eDiscovery, audit, and compliance posture across Microsoft and multicloud estates.

A Microsoft Purview classification tag applied to files, emails, and containers that can enforce encryption and access restrictions and travel with the content wherever it goes.

The practice of identifying and labeling content by sensitivity and type, such as personal, financial, or public data, so that protection policies can be applied consistently.

A Microsoft Purview capability that detects sensitive information in motion, at rest, and in use, then blocks or warns on risky sharing actions across email, endpoints, and cloud apps.

A Microsoft Purview solution that correlates signals such as file downloads, exfiltration, and unusual access to detect and investigate risky user behavior while supporting privacy safeguards.

A Microsoft Purview process for identifying, preserving, collecting, and reviewing electronically stored information for legal cases, investigations, or regulatory requests.

A Microsoft Purview measurement showing how well an organization meets recommended controls for regulations and standards, with improvement actions that raise the score when completed.

A Microsoft Purview rule that keeps content for a defined period and then deletes it, or deletes it at a set time, applied across locations such as Exchange, SharePoint, and Teams.

A Microsoft Purview capability that records user and administrator activity across Microsoft services, retaining searchable logs that support investigations, forensics, and regulatory obligations.