Microsoft SC-900 key terms

A security model that assumes no user or device is trusted by default, even inside the corporate network, and verifies every request explicitly using identity, device health, and context signals.

A layered security strategy in which multiple independent controls, such as physical, identity, network, and data protections, are stacked so that failure of one layer does not expose the whole system.

A framework describing how security and compliance duties are divided between a cloud provider and its customer, shifting some obligations to the provider while the customer always retains data, identity, and access responsibility.

Three core goals of information security: keeping data secret from unauthorized parties, keeping it accurate and unaltered, and keeping it accessible to authorized users when needed.

The process of proving that a user, device, or service is who or what it claims to be, typically by presenting a password, certificate, or cryptographic key.

The process of deciding what an authenticated identity is permitted to do, such as which files it may read or which administrative actions it may perform.

A digital representation of a person, application, device, or service that a system uses to recognize it and to associate permissions, attributes, and audit activity with it.

Any identity that can be granted access rights and can request resources, including user accounts, service principals, managed identities, and security groups.

A trusted service that creates, stores, and validates identities and issues tokens asserting who a user is, allowing many applications to rely on it instead of holding their own credentials.

A trust arrangement in which separate organizations or systems accept each other's authentication assertions, letting users sign in with credentials from one identity provider to access another party's resources.

An authentication method requiring two or more different proof types, such as a password plus a phone approval or hardware key, so a stolen password alone cannot grant access.

Sign-in methods that remove the password entirely, relying instead on something like a registered device, a fingerprint or face scan, or a hardware security key bound to the user.

A feature that lets users reset or unlock their own accounts after verifying identity through chosen methods, reducing helpdesk load and improving the speed of account recovery.

A policy engine that evaluates signals such as user, group, location, device state, and application, then grants access, blocks it, or demands extra controls like MFA or a compliant device.

Microsoft's cloud identity and access management service that stores users and groups, authenticates sign-ins, issues tokens, and enforces access policy for cloud and connected on-premises resources.

A set of capabilities for managing identity lifecycle, including access reviews, entitlement management, lifecycle workflows, and privileged access so that rights stay appropriate over time.

A service providing just-in-time, time-bound activation of elevated roles, with approval, justification, and auditing, so standing administrator rights are avoided.

The capability for letting customers, partners, and other external users sign in to applications with their own credentials or social accounts, while keeping them separate from workforce identities.

A capability that invites external partners into a tenant as guest identities, letting them use their home credentials while the host organization controls what they can access.

A synchronization tool that replicates on-premises directory users and password hashes, or enables pass-through or federated sign-in, so identities work consistently in the cloud.

An arrangement where an identity exists both in an on-premises directory and in a cloud identity service, with synchronization keeping the two representations aligned for consistent access.

A managed service offering domain join, group policy, and legacy authentication protocols in the cloud, letting older applications run without deploying and patching domain controllers.

A service for issuing and verifying decentralized, cryptographically signed digital credentials so users can prove attributes such as employment or certification without exposing underlying documents.

A cloud infrastructure entitlement management tool that discovers, right-sizes, and monitors permissions across multicloud environments to reduce excessive or unused access.

An authorization approach that grants permissions by assigning users or groups to predefined roles, so access follows job function rather than being attached to individuals one by one.

A configuration in which one successful authentication grants access to many applications, reducing repeated password prompts and shrinking the number of credentials users must manage.

A cloud security posture and workload protection service that assesses configurations, assigns secure scores, recommends fixes, and detects threats across Azure, multicloud, and hybrid resources.

Continuous assessment of cloud configurations against security benchmarks, surfacing misconfigurations and drift so teams can remediate risk before an attacker exploits it.

A numeric measure of how well an environment follows recommended security controls, with improvement actions ranked by potential gain, used to track posture over time.

A cloud-native security information and event management platform that collects logs, correlates signals, applies analytics rules, and supports investigation and automated response across the enterprise.

A system that centralizes log collection from many sources, correlates and analyzes events, raises alerts, and supports investigation of security incidents.

Tooling that runs predefined playbooks to enrich alerts, notify staff, and take containment actions automatically, shortening response time and reducing repetitive manual work.

An extended detection and response suite that correlates signals from identity, email, endpoint, and cloud applications into unified incidents, enabling coordinated investigation and automated disruption of attacks.

A platform for protecting devices through behavioral detection, attack surface reduction, automated investigation, and remediation of malicious activity on endpoints.

A sensor-based service that monitors on-premises directory traffic to detect reconnaissance, credential theft, and lateral movement targeting domain controllers and privileged accounts.

Protection for email and collaboration tools that blocks phishing, malicious attachments and links, and unsafe sharing, with investigation and attack simulation capabilities.

The practice of shrinking the set of ways an attacker can enter or move within an environment, for example by disabling risky features, restricting macros, and reducing exposed services.

Techniques an attacker uses to move from one compromised host or account to others in the same network, often seeking higher privileges and sensitive data.

A social engineering attack that impersonates a trusted party through email, messages, or fake sites to trick recipients into revealing credentials or running malicious content.

The transformation of readable data into ciphertext using a key, so that only holders of the correct key can restore the original content, protecting data at rest and in transit.

A family of compliance and data governance solutions covering data mapping, sensitivity labeling, loss prevention, insider risk, audit, and retention across an organization's estate.

The process of categorizing information by sensitivity and business value, which then determines the protections, retention rules, and access restrictions applied to it.

A tag applied to documents, emails, or containers that records their confidentiality level and can enforce encryption, watermarking, and access restrictions consistently wherever the content travels.

Policies that detect sensitive information in email, files, and chats and then block, warn about, or audit its sharing, helping stop accidental or intentional leakage.

A capability that uses behavioral signals and policy templates to detect risky activity such as data exfiltration, leaks, or harassment by people inside the organization, supporting investigation and remediation.

Rules that determine how long content must be kept and what happens afterward, such as deletion or conversion to a record; labels apply to individual items while policies target locations.

The process of identifying, preserving, collecting, and reviewing electronically stored information for legal cases or investigations, with tools that support holds, search, and export.

A measurement in Microsoft Purview Compliance Manager showing how well an organization meets a chosen regulation or standard, with recommended improvement actions and their point values.

A chronological record of user and administrator activity, such as sign-ins, file access, and configuration changes, retained for investigation, forensics, and regulatory evidence.

A Microsoft site publishing audit reports, compliance certificates, and security documentation that customers use as evidence when assessing the provider's controls.

An identity created for an application or automation so it can authenticate and be granted access scoped to specific resources, independent of any human user's credentials.

A scheduled or ad hoc process in which reviewers confirm or remove existing access assignments, helping organizations prevent entitlement creep and satisfy audit requirements.

A passwordless sign-in method that binds a user's biometric or PIN gesture to a device-protected cryptographic key pair, so credentials cannot be replayed from another machine.