Microsoft 365 Security and Compliance Capabilities
Organize by layer
Frame security around identity, data, devices, and threats. Identity: Entra ID supplies authentication, multifactor authentication, Conditional Access, Identity Protection, and Privileged Identity Management. Conditional Access requires at least Entra ID P1. Devices: Intune handles enrollment, compliance policies, and configuration profiles. Threats: Defender for Office 365 protects email with Safe Links, Safe Attachments, and anti-phishing; Defender for Endpoint covers endpoints; Defender for Identity monitors on-premises Active Directory signals; Defender for Cloud Apps is the CASB. Data: Microsoft Purview covers sensitivity labels, data loss prevention (DLP), retention and records, eDiscovery, audit, Insider Risk Management, and Compliance Manager.
Traps
Do not confuse sensitivity labels with retention labels. Sensitivity labels classify content and can encrypt it; retention labels decide how long content is kept or when it is deleted. DLP enforces rules on sensitive content; retention preserves or removes it. Safe Links rewrites and checks URLs at click time; Safe Attachments detonates attachments in a sandbox. Conditional Access is a policy engine, not a standalone license. E3 generally includes Entra ID P1, Defender for Office 365 P1, and Intune; E5 adds P2-level identity, Defender for Endpoint P2, Defender for Identity and Cloud Apps, and advanced Purview. Secure Score measures configuration posture, not legal compliance.
Worked example
To stop credit card numbers leaving by email, create and publish a sensitivity label, then build a DLP policy that blocks or encrypts messages containing that label or the credit card sensitive information type. If the concern is malicious links, use Safe Links instead.
Rule of thumb: identity first, then data, then devices, then threats. Many questions chain these layers together.