MCS cheat sheet

The CIA triad defines security goals: confidentiality (only authorized readers), integrity (data unaltered), availability (systems reachable when needed).

Defense in depth layers physical, identity, perimeter, network, compute, application, and data controls so one failed layer does not expose the asset.

Zero Trust principles: verify explicitly, use least privilege access, and assume breach; no network location is implicitly trusted.

Shared responsibility model: the cloud provider secures the physical and host layers, while the customer always retains data, identity, and access responsibility.

Encryption protects data at rest (stored media) and in transit (network traffic); hashing is one-way and used for integrity and password storage, not reversible encryption.

Authentication proves identity; authorization decides what an authenticated principal may do; accounting/auditing records what was done.

Compliance is meeting laws, regulations, and standards; governance defines the policies and controls that keep the organization aligned to them.

Identity is the new security perimeter: a primary identity provider (such as Microsoft Entra ID) authenticates users and issues tokens to resources.

Microsoft Entra ID is a cloud identity provider for authentication and authorization; it is not a domain controller and does not use traditional Group Policy.

Entra ID roles differ from Azure RBAC roles: Entra roles govern directory objects (users, groups, apps); Azure RBAC governs Azure resource actions at scopes such as subscription or resource group.

Conditional Access evaluates signals (user, device, location, app, risk) and enforces controls (MFA, compliant device, block) at sign-in; it requires Entra ID P1 or higher.

Multi-factor authentication combines factors from categories: something you know, something you have, something you are; two items from the same category do not satisfy MFA.

Password protection blocks weak and banned passwords; self-service password reset lets users reset or unlock accounts under policy-defined verification methods.

Privileged Identity Management provides just-in-time role activation, approval, and access reviews for privileged roles; it is not permanent standing access.

Identity Protection detects and scores risk (user risk, sign-in risk) and can feed Conditional Access risk-based policies.

Hybrid identity connects on-premises Active Directory to Entra ID using Microsoft Entra Connect (sync) or federation; synchronized accounts share one credential.

External identities (B2B collaboration and B2C/External ID) let partners and customers authenticate into resources without creating internal accounts.

Microsoft Defender for Cloud provides cloud security posture management (CSPM) with Secure Score and cloud workload protection (CWP) for servers, storage, containers, and databases.

Microsoft Sentinel is a cloud SIEM/SOAR: it collects logs, correlates detections with analytics rules, and automates response with playbooks built on Logic Apps.

Microsoft Defender XDR correlates signals across identities, endpoints, email, and cloud apps into incidents, reducing alert fatigue versus isolated products.

Defender for Endpoint covers device threat detection, attack surface reduction, and automated investigation and response; Defender for Identity monitors on-premises Active Directory signals.

Defender for Office 365 protects email and collaboration with Safe Links, Safe Attachments, anti-phishing, and anti-spam policies.

Defender for Cloud Apps is a CASB that discovers shadow IT, applies session controls, and enforces app governance policies.

Microsoft Purview Insider Risk Management and eDiscovery support investigation; security solutions detect and respond, while compliance solutions govern data.

Secure Score quantifies posture improvement recommendations; higher score reflects more recommended controls implemented, not a guarantee of no breach.

Microsoft Purview is the compliance family covering data classification, data loss prevention, retention, eDiscovery, and insider risk.

Sensitivity labels classify and protect content (encryption, content marking) and can travel with the file; retention labels govern how long content is kept or deleted.

Data Loss Prevention policies detect sensitive information types and block or warn on sharing across Exchange, SharePoint, OneDrive, Teams, and endpoints.

Retention policies and labels can retain, retain-then-delete, or delete content; a retention label can be based on events such as a contract end date.

eDiscovery supports legal hold and content search; Premium adds custodian management, review sets, and analytics beyond standard eDiscovery.

Compliance Manager maps controls to regulations and tracks improvement actions with a compliance score.

Microsoft Priva addresses privacy risk: subject rights requests, privacy risk management, and consent/tracking for personal data.

Audit (Standard and Premium) records user and admin activity; Premium adds longer retention and higher-fidelity events for investigations.