Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 1126–1200

Data Lifecycle Management (DLM), specifically through Microsoft 365 retention policies, is designed to automatically manage content throughout its lifecycle. These policies can be configured to retain emails for a specified duration, such as seven years, to meet regulatory compliance requirements. After the retention period expires, DLM policies can then automatically initiate the deletion of that content, ensuring compliance with both retention and disposal obligations without manual intervention. This directly addresses the need for automatic retention and subsequent deletion of customer emails.

Microsoft Purview Records Management is specifically designed for regulatory, legal, and business-critical recordkeeping, ensuring content immutability. It utilizes retention labels to classify items as records, which prevents their modification or deletion for a specified period, such as 10 years for vendor contracts. This capability is crucial for meeting strict retention requirements and supporting automated disposition reviews, ensuring compliance with organizational and legal obligations.

Insider Risk Management applies machine-learning analytics to signals such as mass file downloads, USB copy events and personal-email exfiltration, correlating them with HR data like resignation dates. It generates alerts and investigation cases, matching the compliance team's detection and investigation requirements.

This option is specifically designed for Bring Your Own Device (BYOD) scenarios, allowing personal devices to establish a device identity in Microsoft Entra ID. It enables employees to securely access corporate resources, such as email and applications, through conditional access policies without the organization taking full management control of the device. The device is recognized and trusted, but not fully managed, making it ideal for personal devices.

Requesting a file upload for analysis is the most appropriate immediate next step for an unconfirmed file detection. This action allows security analysts to submit the suspicious file to advanced threat intelligence services, such as Microsoft Defender for Endpoint's cloud-based sandboxing or detonation chambers. These environments perform deep behavioral analysis, static analysis, and reputation checks to definitively determine if the file is malicious, benign, or potentially unwanted, providing crucial context for subsequent response actions.

Microsoft Sentinel offers a robust, out-of-the-box data connector for Azure Active Directory, enabling the ingestion of critical identity-related logs such as sign-in logs, audit logs, and provisioning logs. These logs are fundamental for detecting suspicious authentication attempts, privilege escalation, and other identity-based threats across an organization's cloud identity infrastructure. The connector streams these events directly into a Log Analytics workspace for real-time analysis and correlation with other security data.

SAML-based federation is the industry standard for enabling Single Sign-On (SSO) between an identity provider like Microsoft Entra ID and external enterprise applications. By configuring SAML, users authenticate once with Microsoft Entra ID and gain seamless access to the application. Subsequently, a Conditional Access policy can be applied to this specific application, mandating multi-factor authentication (MFA) to enhance security before access is granted, ensuring compliance with organizational security postures.

Microsoft Defender for Identity (MDI) is specifically designed to protect hybrid identity environments by monitoring on-premises Active Directory domain controllers. It leverages network traffic analysis and security event log inspection to detect sophisticated identity-based attacks, such as pass-the-hash, Golden Ticket, and reconnaissance activities. MDI's behavioral analytics engine establishes baselines for user and entity behavior, enabling it to identify anomalous activities indicative of advanced persistent threats targeting credentials and domain infrastructure. This makes it the ideal solution for a Security Operations Center (SOC) seeking to detect advanced identity-based threats within their on-premises AD.

When a user manually applies a parent sensitivity label, the document inherits all the protection settings directly configured on that specific parent label. This includes the specified encryption (e.g., ViewOnly) and any content markings like a header. Since the parent label itself does not have a watermark configured, and sublabels are not automatically applied, the document will not receive a watermark, even if a sublabel has one.

Microsoft Defender for Cloud Apps provides robust threat detection by continuously monitoring user and entity behavior across connected cloud applications. It leverages advanced analytics and machine learning to identify anomalous activities, such as impossible travel, unusual data downloads, or suspicious administrative actions, which could indicate a compromised account or insider threat. This capability offers real-time alerts and automated remediation to protect against malicious behavior within the cloud app environment.

Microsoft Purview Information Protection is the correct service for creating and managing sensitivity labels, which classify and protect sensitive data. These labels can be configured to apply encryption, visual markings like headers or footers, and granular access restrictions to content, regardless of where it is stored or shared. This comprehensive approach ensures that sensitive information remains protected throughout its lifecycle, aligning with data governance policies.

Conditional Access policies evaluate real-time signals such as user location and network IP address, enabling the security team to enforce MFA specifically when access originates from outside the corporate network. This satisfies the stem’s constraint of restricting MFA to external access only, without affecting internal users. Unlike baseline or per-user MFA, Conditional Access provides granular, context-aware control based on the network location condition.

AIR in Microsoft Defender for Office 365 automatically investigates alerts triggered by suspicious emails, attachments, or links. It can then take remediation actions, such as soft-deleting malicious messages from user mailboxes, blocking malicious senders, and removing malicious attachments. This reduces the burden on security teams and accelerates response to threats.

Zero Trust is a security model fundamentally built on the principle of 'never trust, always verify,' meaning no user, device, or application is implicitly trusted, regardless of its location inside or outside the network perimeter. Every access request is explicitly authenticated, authorized, and continuously validated based on all available data points, including user identity, device health, service, and data classification. This continuous verification ensures that access is granted only when all conditions are met, eliminating implicit trust.

This statement is correct. The DLP policy is configured to apply to `Exchange` (where email resides), and its rule specifies `BlockAccess` as the action when sensitive content is detected. Furthermore, the `UserNotification` setting is enabled, ensuring that the sender receives a policy tip or notification explaining why their email was blocked, providing immediate feedback and promoting compliance.

As part of the Platform as a Service (PaaS) offering, Microsoft is fully responsible for managing and patching the underlying operating system and virtual machine infrastructure that hosts Azure App Service instances. This includes applying security updates, hotfixes, and service packs to the host OS to maintain platform security and stability, abstracting this operational burden from the customer. This responsibility ensures the foundational environment upon which customer applications run remains secure.

Azure DDoS Protection provides always-on traffic monitoring and automatic mitigation capabilities specifically designed to protect Azure resources from volumetric, protocol, and resource-layer DDoS attacks. It leverages Azure's global network scale to absorb and scrub malicious traffic at the network edge before it reaches the target application, ensuring legitimate traffic flow. This service is essential for publicly accessible applications in Azure, offering comprehensive protection against sophisticated denial-of-service threats.

Data Lifecycle Management (DLM) in Microsoft 365 utilizes retention labels and policies to govern the entire lifecycle of data, from creation to deletion. It enables organizations to define specific retention periods, such as 10 years for customer contracts, ensuring compliance with legal or regulatory obligations. After the retention period expires, DLM policies can automatically dispose of the data, streamlining information governance and reducing risk.

Microsoft Entra Connect is the essential Microsoft tool designed to achieve hybrid identity goals by synchronizing users, groups, and contacts from an on-premises Active Directory to Microsoft Entra ID. It facilitates various synchronization features, including password hash synchronization (PHS), pass-through authentication (PTA), and federation with Active Directory Federation Services (AD FS). PHS, enabled by default, securely synchronizes a hash of the user's password hash, allowing users to sign in to cloud services with their on-premises credentials.

Microsoft Defender for Cloud's primary purpose is to provide comprehensive security posture management and threat protection across cloud environments, including Azure, AWS, and GCP. This encompasses securing cloud applications, data, virtual machines, containers, databases, and other services by identifying misconfigurations, recommending security improvements, and detecting and responding to threats. It acts as a Cloud Workload Protection Platform (CWPP) and Cloud Security Posture Management (CSPM) solution, ensuring the overall security of cloud-native assets.

Azure AD Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources in Azure AD, Azure, and other Microsoft services. It enables just-in-time (JIT) access, allowing administrators to activate privileged roles only when needed, for a specific, time-limited duration. This includes features like multi-factor authentication (MFA) enforcement during activation, approval workflows, and comprehensive audit logs, directly fulfilling the requirement for temporary and time-limited administrative access.

This solution correctly implements a layered security approach using two distinct Conditional Access policies. Policy 1 ensures that standard users require Multi-Factor Authentication (MFA) but allows for usability by excluding trusted locations and compliant devices. Policy 2 specifically targets privileged roles, enforcing MFA without any exclusions, thereby guaranteeing that these high-impact accounts always face the strongest authentication challenge, regardless of their location or device compliance status. This design effectively balances security for privileged identities with user experience for general users.

Azure AD Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources within an organization. It enables just-in-time (JIT) access, allowing administrators to activate privileged roles only when needed and for a limited duration. This process often includes an approval workflow, multi-factor authentication, and automatic deactivation of the role after the specified time, directly addressing the requirement for temporary, controlled access.

Configuring a session policy is the correct approach because these policies leverage Microsoft Defender for Cloud Apps' Conditional Access App Control to act as a reverse proxy, intercepting and inspecting user sessions in real-time. This allows administrators to apply granular, context-aware controls over user activities within cloud applications, such as blocking downloads, preventing uploads of sensitive files, or restricting copy-paste actions. Session policies are specifically designed for real-time monitoring and control of ongoing user interactions.

Microsoft Entra External ID (B2B collaboration) is the correct solution as it specifically enables organizations to invite external users, such as partners, to access their applications and resources using their own existing identities. This feature integrates partner users into the inviting organization's Microsoft Entra tenant as guest users, allowing for the application of robust access policies and secure management of their access to partner applications.

Microsoft Entra access reviews are specifically designed to enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments by scheduling periodic reviews. These reviews allow designated reviewers to confirm continued access necessity, and critically, they can be configured to automatically remove access for users who are not approved or whose review is not completed, directly addressing the requirement for periodic validation and automated revocation.

Microsoft Defender for Cloud's Just-in-time (JIT) VM access is a crucial security feature designed to reduce the attack surface of Azure virtual machines. It achieves this by locking down inbound management ports, only opening them for specific, approved source IP addresses for a limited duration. This temporary, on-demand access significantly minimizes exposure to potential threats, aligning with zero-trust principles and enhancing overall VM security posture.

Conditions are the "if" part of a Conditional Access policy, evaluating specific attributes of a sign-in attempt to determine if the policy applies. This includes critical contextual factors such as the user's sign-in risk level, the device platform being used, the client application, and crucially, the network location from which the access request originates. The location condition specifically allows administrators to define trusted or untrusted IP ranges, enabling enforcement based on geographic or network-specific access points.

This option accurately describes the conditions for a match. The custom sensitive information type (SIT) rule is configured with a logical AND operator, requiring both the detection of a pattern matching the Social Security Number (SSN) regular expression and the presence of associated keywords. Specifically, the `minMatches=1` setting for the keyword component means that at least one keyword must be found in proximity to the SSN pattern to trigger a successful detection.

Microsoft Entra Conditional Access evaluates signals including user identity, device compliance, location and sign-in risk, then enforces grant or block decisions per policy. This directly implements the explicit verification and least privilege requirements of the Zero Trust model described.

Microsoft Entra B2B collaboration allows you to invite external users as guest users. With email one-time passcode, the invited users can authenticate using a code sent to their email, without needing a Microsoft account or Azure AD account. This meets the requirement for auditors to use their own email addresses and receive a code. It is the appropriate feature for temporary external access.

Microsoft Purview Information Protection applies sensitivity labels with automatic classification, detecting credit card numbers in emails and documents and enforcing encryption or protection automatically. This satisfies the compliance team's need to classify and protect sensitive data across Microsoft 365 workloads.

Self-Service Password Reset (SSPR) is a crucial Microsoft Entra ID feature that empowers users to reset their forgotten passwords without requiring assistance from IT helpdesk staff. Users must pre-register at least two authentication methods, such as a mobile phone number or an alternate email address, which are then used to verify their identity during the reset process. This capability significantly reduces helpdesk call volumes and improves user productivity by enabling immediate password recovery.

Sensitivity labels are designed to classify and protect data directly at the point of creation or modification. By configuring a sensitivity label with encryption, it applies Azure Rights Management (Azure RMS) protection to the content. This protection can include specific usage rights, such as "Do Not Forward," which prevents recipients from forwarding, printing, or copying the protected email or document, ensuring the data remains within its intended scope. This method directly embeds the protection into the content, making it persistent wherever the data travels.

Microsoft Purview Insider Risk Management is the correct solution as it specifically leverages built-in risk indicators, machine learning, and behavioral analytics to identify and investigate potential insider risks, including data theft. It correlates various user activities across Microsoft 365 services to detect unusual patterns, enabling security teams to proactively identify, analyze, and respond to incidents.

Cloud Discovery, a core capability within Microsoft Defender for Cloud Apps, is precisely designed to identify all cloud applications accessed by users within an organization. It achieves this by analyzing traffic logs from firewalls and proxies, providing comprehensive visibility into both sanctioned and unsanctioned "shadow IT" applications. This process generates detailed risk assessments for each discovered app, enabling security teams to understand potential vulnerabilities, compliance gaps, and usage patterns. Its primary function is comprehensive app discovery and risk assessment.

Authentication is the foundational security process of verifying an entity's identity, confirming they are who they claim to be. In this scenario, requiring a one-time passcode (OTP) alongside another factor, like a password, establishes multi-factor authentication (MFA). This robust method significantly enhances security by requiring multiple proofs of identity before granting access to a system or resource, directly addressing the company's need to confirm employee identity.

Applying a retention policy without a preservation lock allows users to delete items from their primary view within applications like Outlook or SharePoint. However, the retention policy ensures that a copy of the deleted item is moved to a secure, hidden location (e.g., the Recoverable Items folder for Exchange, or the Preservation Hold library for SharePoint/OneDrive) and retained for the policy's duration. This mechanism precisely meets the requirement of allowing user deletion while guaranteeing the item remains discoverable and recoverable by administrators.

Microsoft Entra ID P1 is the correct and minimal license required to enforce Conditional Access policies. This license tier enables organizations to define and apply robust access controls, such as requiring multi-factor authentication (MFA) for specific applications, blocking access from untrusted locations, or enforcing device compliance. It provides the essential framework for implementing a strong, adaptive access management strategy.

Anomaly detection policies in Microsoft Defender for Cloud Apps leverage advanced machine learning algorithms to establish a baseline of normal user and entity behavior within your cloud environment. These policies continuously monitor for significant deviations from this established baseline, such as impossible travel, unusual administrative activities, or mass downloads to an unmanaged device. By identifying these statistical anomalies, they proactively detect potential threats like compromised accounts, insider threats, or data exfiltration attempts that might otherwise go unnoticed.

The Microsoft Purview retention policy is configured with a 'Keep and then delete' action, specifically set for a duration of 365 days. This means that emails covered by this policy will be preserved and immutable for the entire 365-day period from their creation or last modification date. Upon the expiration of this retention period, the policy will automatically trigger the permanent deletion of these emails from their respective locations.

Conditional Access is the precise solution for defining and enforcing granular access policies based on a wide array of conditions. Administrators can configure policies that evaluate user attributes, device state (e.g., compliant vs. non-compliant), location, application being accessed, and sign-in risk. This allows for dynamic access control, enabling actions like requiring multi-factor authentication, blocking access, or allowing access only from managed devices, directly addressing the need for policy enforcement based on specific criteria.

This option accurately describes the combined effect of a typical DLP policy configured for strict enforcement. When sensitive information is detected within the email, the policy's 'Block access' action prevents the email from being delivered to its intended recipients, ensuring data protection. Concurrently, the policy's notification setting ensures that the sender is immediately informed about the policy violation and the reason for the email's blocking, allowing them to understand and rectify the issue.

The ISO 8601 duration string "PT8H" explicitly defines an eight-hour period for role activation. Therefore, interpreting this as 4 hours is an incorrect reading of the specified duration. Azure AD PIM relies on precise time definitions to enforce Just-In-Time access, and any deviation from the configured "PT8H" value would contradict the role's maximum activation setting.

Microsoft Defender for Identity is purpose-built to detect advanced threats targeting on-premises Active Directory environments by analyzing network traffic and Windows events from domain controllers. It deploys lightweight sensors directly on domain controllers or uses port mirroring to gain deep visibility into authentication protocols like Kerberos and NTLM. This specialized analysis allows it to identify suspicious user behavior, privilege escalation attempts, and specific attack patterns, such as Golden Ticket, Pass-the-Hash, and DCShadow, providing crucial security alerts for AD compromise. Its focus is precisely on the unique attack surface presented by Active Directory.

This is a fundamental retention action within Microsoft Purview, designed to prevent the permanent deletion of content for a specified duration. It ensures that data, such as emails, documents, or Teams messages, remains discoverable and accessible, even if users attempt to delete it from their applications. This action is crucial for meeting regulatory compliance, legal discovery requirements, or internal organizational policies by placing an immutable hold on the data.

Accountability is the ability to trace actions and events back to a specific entity, whether a user, process, or system. By meticulously recording access, modifications, and system events, logging creates an indispensable audit trail. This trail enables forensic analysis, compliance verification, and the attribution of responsibility, making it a foundational component for holding individuals and systems accountable for their actions within an organization.

eDiscovery (Premium) supports custodian identification, placing holds on Exchange Online mailboxes and SharePoint sites, and collecting preserved content into review sets. Standard eDiscovery lacks custodian management and advanced review, so Premium satisfies both the hold and collection requirements.

Microsoft Entra Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources by providing just-in-time (JIT) and just-enough-access (JEA) capabilities. It allows administrators to grant temporary, time-limited access to privileged roles, which can be activated on demand for a specified duration. This ensures that users only have elevated permissions when absolutely necessary, significantly reducing the attack surface.

Integrity ensures that data remains unaltered and complete during transmission or storage. When a user verifies that the content of an encrypted email from their bank has not been changed, they are confirming its integrity. This is typically achieved through cryptographic mechanisms like hashing or digital signatures, which detect any unauthorized modification, ensuring the message received is exactly what was sent.

When a user enters credentials to access a financial application, the system performs authentication. This crucial initial step verifies the user's claimed identity by comparing the provided username and password against stored records. Successful authentication confirms 'who' the user is, granting them entry to the system.

Microsoft Defender for Cloud is the correct choice because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities. It continuously assesses the security posture of Azure, on-premises, and multi-cloud environments by identifying misconfigurations, vulnerabilities, and compliance deviations. This service offers actionable security recommendations and a secure score to proactively enhance an organization's overall security.

Cloud Discovery, a core feature of Microsoft Defender for Cloud Apps, analyzes traffic logs from firewalls and proxy servers to identify all cloud applications accessed by users within an organization. It provides crucial visibility into 'shadow IT' by assessing the risk of discovered apps and can integrate with network security appliances to block access to unsanctioned or high-risk applications. This capability is fundamental for enforcing cloud app governance and reducing organizational risk.

Microsoft Entra ID Access Reviews are specifically designed to manage the lifecycle of access to resources, groups, and applications by enabling regular, scheduled reviews. Administrators can configure these reviews to recur periodically, assign reviewers, and set up automatic actions, such as revoking access for users who are not approved or whose review is not completed within a specified timeframe. This functionality directly addresses the requirement for recurring access validation and automated revocation.

With the DefaultAction set to Deny and both the IpRules and VirtualNetworkRules arrays being empty, there are no explicit rules configured to override the default denial. This combination ensures that all incoming network traffic, regardless of its origin (public internet or Azure virtual networks), is blocked. Therefore, the storage account is effectively inaccessible from any network.

This Conditional Access policy effectively combines multiple critical signals to provide robust, risk-adaptive access control. By including conditions for location, device compliance, and sign-in risk (from Microsoft Entra ID Protection), it allows the system to evaluate the user's context comprehensively. This enables granular decisions, such as blocking access or requiring stronger authentication, specifically when a sign-in attempt is identified as risky based on these combined factors, directly addressing the company's security requirements.

This option accurately describes the criteria for the custom analytics rule. The rule targets sign-in attempts that Azure AD Identity Protection has classified with either a medium or high sign-in risk level. Additionally, it specifically filters these risky sign-ins to only include those originating from locations outside the United States, indicating a focus on external or geographically unusual threats.

Cloud Discovery, a core feature of Microsoft Defender for Cloud Apps, analyzes traffic logs from firewalls and proxy servers to identify all cloud applications accessed by users within an organization. It provides comprehensive visibility into both sanctioned and unsanctioned cloud services, often referred to as "shadow IT." This process helps security teams assess the risk associated with each discovered application and gain a complete understanding of cloud usage patterns.

Microsoft Sentinel's SIEM capabilities involve collecting security data at scale from diverse sources across an organization's entire digital estate. It then uses built-in analytics, machine learning, and threat intelligence to detect, investigate, and prioritize security threats. This centralized log management and threat detection are fundamental to its role as a modern cloud-native SIEM.

Microsoft Entra ID Protection directly integrates with Conditional Access policies to enable risk-based access decisions. When ID Protection detects a sign-in or user risk, such as an unfamiliar sign-in property or leaked credentials, it can feed this risk information into Conditional Access. These policies can then automatically enforce actions like requiring multi-factor authentication, password changes, or blocking access entirely, thereby protecting resources dynamically.

The Microsoft 365 Defender portal is the unified security operations center for Microsoft 365 services. It consolidates alerts, incidents, and automated investigation and response capabilities from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. This centralized experience provides a comprehensive view of threats across the entire Microsoft 365 ecosystem, enabling security teams to efficiently investigate and remediate multi-stage attacks.

Cloud Security Posture Management (CSPM) is the core capability within Microsoft Defender for Cloud that continuously assesses cloud resources against security benchmarks and regulatory standards. It provides a secure score, identifies misconfigurations, and offers actionable recommendations to improve an organization's security posture across multi-cloud environments like Azure, AWS, and GCP. This proactive approach is essential for a security operations team focused on maintaining compliance and reducing attack surface.

Improvement actions with assigned owners are a core feature within Microsoft Purview Compliance Manager, representing specific tasks recommended to enhance an organization's compliance posture against various regulations and standards. These actions can be assigned to individual users or teams, ensuring clear accountability and enabling systematic tracking of progress as an organization works towards implementing necessary controls and demonstrating adherence to compliance requirements.

Cloud Discovery is the precise capability within Microsoft Defender for Cloud Apps designed to identify and analyze all cloud applications accessed by users across an organization's network. It functions by ingesting and analyzing traffic logs from various sources, including firewalls, proxies, and endpoint agents, to detect accessed URLs, IP addresses, and user agents. This process effectively uncovers shadow IT, assesses the inherent risk of discovered applications, and provides comprehensive insights into their usage patterns.

eDiscovery (Premium) is the appropriate solution for a compliance officer who needs to search for specific email content across an organization's data. This service in Microsoft Purview enables robust content searches, legal holds, and the collection of electronically stored information (ESI) from various sources like Exchange mailboxes, SharePoint sites, and OneDrive accounts. It is specifically designed for investigative purposes, allowing for advanced querying, review, and export of relevant content.

In Microsoft Sentinel, changing an incident's severity to "Critical" directly impacts its prioritization within the security operations center (SOC) workflow. This action signals to analysts that the incident requires immediate attention and resources, often triggering specific escalation procedures or service level agreements (SLAs) to ensure rapid investigation and remediation. It effectively moves the incident to the top of the queue, ensuring it receives the necessary focus.

Microsoft Defender for Cloud's regulatory compliance dashboard is specifically designed to provide a centralized view of an organization's compliance posture against various industry standards and regulatory benchmarks, including the CIS Benchmarks. It continuously assesses Azure resources, identifies security misconfigurations, and maps these findings to specific controls within selected standards. This feature directly enables organizations to track, manage, and improve their compliance with frameworks like CIS by offering actionable recommendations.

Authorization is the process of granting or denying access to resources based on the authenticated user's permissions. The role check determines if the user is authorized to access the user management page, making this the correct answer.

Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) is a foundational capability that continuously assesses the security posture of your cloud resources across Azure, AWS, and GCP. It provides visibility into misconfigurations, offers actionable security recommendations, and helps ensure compliance with industry benchmarks and regulatory standards. This core functionality is essential for identifying and remediating potential vulnerabilities in your cloud environment.

Microsoft Defender for Identity is purpose-built to monitor on-premises Active Directory (AD) and hybrid environments for advanced threats. It deploys sensors directly on domain controllers and AD FS servers to analyze network traffic and Windows events, detecting suspicious user and entity behavior, reconnaissance activities, lateral movement paths, and privilege escalation techniques like Pass-the-Hash or Golden Ticket attacks. This specialized focus on identity-based threats within the AD infrastructure makes it the ideal solution for protecting against attacks targeting an organization's core directory services.

Identity Protection detects risky users and sign-ins through Microsoft's threat intelligence and feeds those detections into risk-based Conditional Access, enabling automatic remediation such as requiring MFA or blocking access. This satisfies the requirement for detecting and remediating identity risks.

Microsoft Purview Data Loss Prevention (DLP) policies are designed to identify, monitor, and automatically protect sensitive information across various locations, including Microsoft 365 services, endpoints, and non-Microsoft cloud apps. DLP utilizes sensitive information types, keywords, and content matching to detect sensitive data, such as credit card numbers or national ID numbers, both at rest and in transit. Upon detection, DLP can block sharing, notify users, or encrypt the content, effectively identifying and protecting the data.

Microsoft Defender for Servers includes a built-in vulnerability assessment solution powered by Qualys. By enabling the Defender for Servers plan and deploying the integrated solution, you can automatically scan your Azure and on-premises servers for vulnerabilities. This provides continuous assessment and actionable recommendations in Defender for Cloud.

Configuring single sign-on (SSO) using federation establishes a trust relationship where Microsoft Entra ID acts as the identity provider. When users access an application, they are redirected to Entra ID for authentication. Upon successful verification, Entra ID issues a security token to the application, granting access without the application ever storing or directly handling the user's password, thereby centralizing authentication and eliminating application-specific credential storage.

Microsoft Entra ID Protection continuously monitors user and sign-in behavior to detect various types of risks, such as impossible travel or anomalous IP addresses. It then feeds these real-time risk detections into Microsoft Entra Conditional Access policies. These policies can be configured to automatically enforce specific access controls, like blocking access, requiring multifactor authentication (MFA), or forcing a password change, based on the calculated user or sign-in risk level. This capability is central to adaptive access control.