MCS key terms

A model describing the three core goals of security: keeping data secret from unauthorized readers, keeping data accurate and unaltered, and keeping systems usable when needed. Most security controls are justified by one or more of these goals.

A security strategy that assumes no network location is inherently trusted and verifies every request explicitly, grants least privilege, and assumes breach. Identity becomes the primary control plane rather than the corporate firewall perimeter.

Layering multiple independent controls (identity, network, data, endpoint) so that failure of one layer does not expose the whole asset. Attackers must defeat several safeguards rather than a single barrier.

Granting an identity only the permissions required to complete its current task, for only as long as needed. It limits blast radius if credentials are compromised and is enforced through roles, scopes, and access reviews.

A division of security duties between a cloud provider and its customer. The provider secures the physical facility and hypervisor; the customer remains responsible for data, identities, and configuration, with the split shifting by service type (IaaS, PaaS, SaaS).

The process of proving an identity is who or what it claims to be, typically with a password, certificate, or cryptographic key. It precedes authorization and is strengthened by multi-factor methods and passwordless credentials.

Deciding what an already-authenticated identity is permitted to do, such as reading a file or calling an API. It is expressed through roles, scopes, and policy evaluation rather than through proof of identity.

The principle that, with cloud services and remote work, controlling who can reach a resource matters more than controlling which network they sit on. Access decisions move from firewalls to identity providers and policy engines.

Requiring two or more independent evidence types, such as a password plus a phone approval or hardware key, before sign-in succeeds. It blocks most credential-theft attacks because a stolen password alone is insufficient.

Sign-in methods that replace the password entirely with a cryptographic credential, such as FIDO2 security keys, platform passkeys, or the Microsoft Authenticator app. Removing passwords eliminates phishing for a reusable secret.

Assigning permissions through predefined roles rather than to individuals, so access follows job function. In Azure, role assignments combine a role definition, a security principal, and a scope such as subscription or resource group.

Protecting stored data by converting it to ciphertext on disk, so physical theft or unauthorized storage access does not reveal content. Keys are managed by the platform, the customer, or a customer key store.

Protecting data while it moves between systems using protocols such as TLS, so interception on a network does not expose content. It complements at-rest encryption and is required by many compliance frameworks.

The requirement or commitment that data is stored and processed within a specified geography or country. Organizations choose regions to satisfy legal obligations, and some compliance offerings let them keep data in a chosen boundary.

The principle that data is subject to the laws and governance of the jurisdiction where it is collected or stored. It drives region selection, in-country processing requirements, and controls over cross-border transfer.

Demonstrating that systems and processes meet external regulations, industry standards, or internal policies. It requires documented controls, evidence collection, and continuous assessment rather than a one-time audit.

Adherence to legally binding requirements set by governments or regulators, such as privacy laws or financial rules. Failure can carry legal penalties, so organizations map controls to specific obligations and retain evidence.

A structured, evidence-based examination of controls against a standard or regulation, performed by internal or external assessors. Results are recorded as findings and typically require remediation tracking.

Microsoft's cloud identity and access management service, formerly Azure Active Directory. It stores users, groups, and applications, issues tokens, and enforces sign-in policy for Microsoft 365, Azure, and thousands of connected apps.

A dedicated, isolated instance of Microsoft Entra ID that holds an organization's directory objects and identity configuration. Each tenant has a unique domain name and is the security and administrative boundary for its identities.

A suite of identity lifecycle capabilities covering access reviews, entitlement management, lifecycle workflows, and privileged access. It answers who should have access, whether they still need it, and how access is granted and removed automatically.

A policy engine that evaluates signals such as user, device, location, app, and risk at sign-in, then grants, blocks, or requires controls like MFA or a compliant device. Policies are if-then statements evaluated after first-factor authentication.

A service that provides just-in-time, time-bound activation of privileged roles, with approval, justification, and notification. It reduces standing administrative access so dormant accounts cannot be exploited indefinitely.

A scheduled or ad hoc process in which reviewers confirm or revoke users' continued access to groups, apps, or roles. Results feed automatic removal, supporting least privilege and audit evidence.

A capability that packages resources into access packages with request, approval, and expiration rules, so users get the right access without manual group administration. It supports internal and external collaboration scenarios.

A service that detects risky sign-ins and risky users using signals such as leaked credentials, atypical travel, and anonymous IP addresses. Detections can drive automatic remediation or feed Conditional Access risk policies.

An alert generated when identity behavior deviates from expected patterns, such as impossible travel or a password spray. Each detection has a risk level that policies can use to require MFA or block access.

The offering for managing identities outside the workforce, covering business-to-consumer sign-up and sign-in and business-to-business guest collaboration. It provides branded authentication experiences and federation with social or enterprise identity providers.

Inviting partner users to access your resources using their own home credentials, represented as guest accounts in your directory. Governance policies such as access reviews and Conditional Access then apply to those guests.

A configuration where accounts exist both on-premises in Active Directory and in the cloud directory, synchronized or federated so users have one credential. It is common during phased cloud migration.

The synchronization tool that replicates on-premises Active Directory users and groups to Microsoft Entra ID, optionally enabling password hash sync, pass-through authentication, or federation. It keeps the cloud directory aligned with the source of truth.

Authenticating once to gain access to multiple applications without re-entering credentials, typically through a token issued by the identity provider. It improves usability and centralizes policy enforcement.

A cloud security posture management and workload protection platform. It continuously assesses Azure, multicloud, and hybrid resources against security benchmarks, surfaces recommendations, and provides threat protection for servers, storage, databases, and containers.

A numeric measure in Microsoft Defender for Cloud summarizing how well a subscription or environment follows recommended security controls. Improving the score by remediating recommendations reduces attack surface.

Continuous discovery and assessment of cloud resources for misconfiguration, excessive permissions, and drift from benchmarks. Findings become prioritized recommendations, and agentless scanning can reveal risks without deploying agents.

A cloud-native SIEM and SOAR platform that ingests logs from many sources, correlates them with analytics rules, and raises incidents. Playbooks and automation respond to threats, and workbooks visualize activity.

Security information and event management collects and correlates log data to detect threats, while security orchestration, automation, and response executes predefined actions to contain them. Together they centralize detection and accelerate response.

A read-only query language used across Microsoft security and monitoring tools to filter, summarize, and join log data. Analysts write KQL to hunt for threats and build detection rules.

A unified extended detection and response suite correlating signals from identities, email, endpoints, cloud apps, and data into a single incident view. Automated investigation and response contain attacks across domains.

A query-based investigation capability that lets analysts search raw telemetry across Defender workloads using KQL to find threats not caught by existing detections. Custom detections can be built from saved queries.

A correlated group of alerts and evidence that together indicate a potential attack, presented for triage with severity, affected assets, and timeline. Analysts investigate, classify, and remediate incidents rather than isolated alerts.

A family of compliance and data governance solutions spanning data mapping, sensitivity labeling, data loss prevention, insider risk, audit, and eDiscovery. It helps organizations know, protect, and govern data across clouds and on-premises sources.

A classification tag such as Confidential or Public applied to files, emails, and containers that can enforce encryption, watermarking, and access restrictions. Labels travel with the content and can be applied automatically.

Policies that detect sensitive information in motion, at rest, or in use and then block, warn, or audit the action. Rules use sensitive information types and trainable classifiers to identify protected content.

A pattern definition, such as a credit card or national ID format, optionally validated by checksums and keywords, that DLP and auto-labeling rules use to identify protected data. Custom types can match organization-specific formats.

A Microsoft Purview solution that detects potentially risky user activity such as data exfiltration or policy violations using behavioral signals, then routes cases for review with privacy controls and pseudonymization.

The process of identifying, preserving, collecting, and reviewing electronically stored information for legal cases or investigations. Microsoft Purview eDiscovery provides search, holds, and review sets within the compliance boundary.

A solution that records user and admin activity across Microsoft services and retains searchable logs for investigations and regulatory evidence. Retention policies determine how long records remain available.

A Microsoft Purview measurement of how well an organization meets recommended controls mapped to regulations and standards. It shows improvement actions, their point value, and progress toward a stronger compliance posture.

Rules that determine how long content is kept and what happens afterward, such as deleting or retaining it as a record. Labels apply to items, while policies apply at container or location level.

A capability that isolates highly privileged Exchange Online and SharePoint Online administrative accounts behind an approval workflow, so elevated tasks require justification and time-bound access.