Microsoft Security Solution Capabilities
The security portfolio
Microsoft's security stack spans identity, endpoints, cloud, and data. Microsoft Defender for Cloud provides cloud security posture management (CSPM) and cloud workload protection (CWP). Microsoft Sentinel is the cloud-native SIEM and SOAR platform. Microsoft Defender XDR correlates signals across endpoints, identities, email, and SaaS apps. Microsoft Purview handles data security and compliance (covered in domain 4). Microsoft Defender for Identity monitors on-prem AD; Defender for Endpoint protects devices; Defender for Office 365 protects email and collaboration.
Key mechanics
Secure Score in Defender for Cloud quantifies posture. Recommendations are hardening actions; alerts indicate active threats. Sentinel ingests logs via data connectors, runs analytics rules to create incidents, and automates response with playbooks (Logic Apps). Defender XDR unifies incidents across workloads. Attack surface reduction and endpoint detection and response (EDR) are core endpoint capabilities.
Traps to watch
- CSPM = posture (find misconfigurations); CWP = runtime threat protection. Do not confuse them.
- Sentinel is SIEM/SOAR; Defender for Cloud is posture + workload protection.
- Playbooks are Logic Apps; analytics rules generate incidents.
- Defender for Identity targets on-prem AD, not Entra ID.
- Secure Score measures configuration hygiene, not active compromise.
Rule of thumb
If the scenario asks "detect and respond to threats across the estate with automation," choose Sentinel (SIEM/SOAR). If it asks "identify misconfigurations and harden cloud resources," choose Defender for Cloud CSPM.
Worked example
A SOC wants to auto-isolate a compromised VM when a high-severity alert fires. Answer: Sentinel analytics rule triggers an incident, and a playbook automates the response.