Microsoft SC-900 cheat sheet

The shared responsibility model divides duties by service type: the customer always owns data, accounts, and identities; the cloud provider always owns the physical datacenter, hosts, and network fabric.

Defense in depth layers controls in order: physical, identity and access, perimeter, network, compute, application, and data; no single layer is trusted to stop all attacks.

The CIA triad defines security goals: confidentiality (only authorized read access), integrity (data is accurate and unaltered), and availability (systems are reachable when needed).

Zero Trust principles: verify explicitly, use least privilege access, and assume breach; no implicit trust is granted from network location alone.

Authentication proves identity, authorization decides permissions, and identity is the directory object (user, device, workload) that both act upon.

Identity types include human users, devices, and workloads such as service principals and managed identities; each can hold credentials and be governed.

Encryption protects confidentiality at rest (stored data) and in transit (data moving over networks); hashing is one-way and used for integrity and password storage.

Compliance means meeting legal, regulatory, and organizational requirements; governance is the policy and process framework that keeps those requirements met.

Microsoft Entra ID is a cloud identity provider that delivers authentication, single sign-on, and access policy for cloud and on-premises apps.

Entra ID editions: Free covers basic SSO and user management; P1 adds Conditional Access and group-based licensing; P2 adds Privileged Identity Management and Identity Protection.

Conditional Access evaluates signals (user, group, device state, location, app, risk) and applies grant or session controls; it is a policy engine, not a firewall.

Multifactor authentication requires two or more factors from categories: something you know, something you have, something you are; password plus SMS code qualifies.

Microsoft Entra ID Protection detects risky users and risky sign-ins and can feed risk level into Conditional Access decisions.

Privileged Identity Management provides just-in-time role activation, approval workflows, access reviews, and time-bound assignments for privileged roles.

Microsoft Entra Connect synchronizes on-premises Active Directory objects to Entra ID; cloud-only identities exist only in the directory.

External identities (B2B collaboration) let partner guests authenticate with their own credentials and receive governed access to resources.

Entra Verified ID issues verifiable, cryptographically signed credentials that a holder presents without revealing underlying data.

Microsoft Defender for Cloud provides cloud security posture management (CSPM) and cloud workload protection (CWP) across Azure, other clouds, and on-premises.

Secure score in Defender for Cloud quantifies posture against recommended controls; higher score means more recommendations are remediated.

Microsoft Defender XDR correlates signals across identity, email, endpoints, and cloud apps into a single incident view with automated investigation and response.

Microsoft Defender for Endpoint covers endpoint detection and response, attack surface reduction, and threat and vulnerability management.

Microsoft Defender for Identity monitors on-premises Active Directory signals to detect identity-based attacks such as credential theft and lateral movement.

Microsoft Defender for Office 365 protects email and collaboration with safe links, safe attachments, and anti-phishing policies.

Microsoft Sentinel is a cloud-native SIEM and SOAR platform: it collects logs, detects threats with analytics rules, and runs playbooks for response.

Microsoft Defender for Cloud Apps is a CASB that discovers shadow IT, governs SaaS use, and detects anomalous app behavior.

Microsoft Purview is the compliance and data governance family; security operations telemetry flows into Defender XDR and Sentinel instead.

Microsoft Purview Data Loss Prevention detects and blocks sensitive data moving through Exchange, SharePoint, OneDrive, Teams, and endpoints.

Sensitivity labels classify and protect content; labels can apply encryption and persist with the file when it leaves the organization.

Retention policies and retention labels keep or delete content for a defined period; retention labels can also trigger a disposition review.

Microsoft Purview eDiscovery (Standard and Premium) identifies, holds, and collects content for legal cases; Premium adds custodian management and review sets.

Microsoft Purview Insider Risk Management detects risky user behavior using policy templates and anonymized signals.

Compliance Manager maps controls to regulations and tracks improvement actions with a compliance score.

The Microsoft Purview compliance portal hosts audit, DLP, retention, eDiscovery, insider risk, and communication compliance solutions.

Microsoft Priva addresses privacy risk management and subject rights requests for personal data.

Service Trust Portal publishes audit reports, compliance certifications, and the Microsoft Data Protection Addendum.