Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 451–525

Microsoft Entra Privileged Identity Management (PIM) is the correct solution for managing, controlling, and monitoring access to important resources within Microsoft Entra ID and other Microsoft online services. PIM specifically enables just-in-time (JIT) access to roles, time-bound assignments, and approval workflows for role activation. It allows organizations to delegate the management of role assignments, including the ability for designated users to assign eligible roles to others, thereby significantly reducing the standing access of highly privileged accounts.

Organizations frequently have unique internal policies or industry-specific regulations not covered by the extensive library of built-in templates. Microsoft Purview Compliance Manager provides the capability to create entirely new custom assessments from scratch. This allows administrators to define specific controls, assign implementation actions, track progress, and manage risks tailored precisely to their unique organizational compliance requirements, ensuring comprehensive coverage.

Microsoft Entra ID Password Protection directly addresses the challenge of weak and commonly used passwords by integrating a global banned password list and enabling administrators to create custom banned lists specific to their organization. This service actively checks passwords during creation, reset, or change operations against these lists, preventing users from setting easily guessable or compromised credentials. It ensures stronger password hygiene by proactively blocking known weak patterns, directly fulfilling the requirement to prevent common passwords.

Data Loss Prevention (DLP) is a core component of Microsoft Purview compliance solutions, designed to identify, monitor, and automatically protect sensitive information. DLP policies are applied across Microsoft 365 services, endpoints, and on-premises repositories to prevent the unauthorized sharing, transfer, or use of sensitive data. This capability is crucial for maintaining regulatory compliance and safeguarding organizational data.

This option is correct because a sensitivity label configured with 'UserDefined' protection empowers the user applying the label to specify who can access the document and precisely what permissions they possess. Instead of a fixed set of rights, the user can dynamically assign granular access controls, such as view-only, edit, or co-author, to specific individuals or groups at the point of content creation or modification. This provides flexible and context-aware data protection.

This combination provides a robust solution for automatic license assignment based on user attributes. Dynamic groups in Microsoft Entra ID automatically update their membership based on predefined rules that query user attributes (e.g., department, job title, location). When group-based licensing is then applied to such a dynamic group, all current and future members automatically receive the assigned licenses, and licenses are automatically revoked if a user's attributes change, causing them to no longer meet the group's membership criteria.

Conditional Access policies evaluate user, device and location signals at sign-in and can require MFA for all users accessing cloud applications, satisfying the stem's enforcement goal. Microsoft Entra ID applies these policies per cloud app, unlike per-user MFA settings that lack application-scoped control.

Microsoft Entra Access Reviews provide a systematic way for organizations to manage access lifecycle by regularly reviewing who has access to various resources. This feature allows administrators to create recurring reviews for group memberships, application assignments, and Microsoft Entra role assignments. Reviewers, such as group owners or managers, can then approve or deny access, with the system automatically removing unresponsive or denied users based on configured settings, ensuring least privilege.

Microsoft Defender for Endpoint is a comprehensive endpoint detection and response (EDR) solution that provides advanced threat protection, post-breach detection, automated investigation, and response capabilities for devices. It continuously monitors endpoint behavior, identifies malicious activities, and offers powerful remediation actions such as isolating compromised devices from the network and rolling back malicious file changes. These features are essential for containing and recovering from sophisticated endpoint attacks like ransomware.

Microsoft Entra B2B collaboration is the correct solution for enabling external partners to access resources within a company's Microsoft Entra ID tenant using their existing corporate identities. This feature allows inviting guest users from other Microsoft Entra organizations, social identity providers, or email-verified accounts, integrating them into the tenant for seamless access to applications and resources. It provides robust lifecycle management, allowing administrators to manage guest user access and permissions effectively.

eDiscovery (Premium) is the correct solution as it provides a comprehensive, end-to-end workflow specifically designed for legal discovery requirements within Microsoft 365. It enables legal teams to identify, preserve, collect, process, review, and export data from various sources like Exchange mailboxes, SharePoint sites, and Teams, all while maintaining the integrity of the original data and managing legal holds efficiently for specific custodians.

Conditional Access policies in Microsoft Entra ID are fundamental for implementing Zero Trust principles by evaluating specific conditions before granting access. These policies can enforce requirements such as multifactor authentication, specific location, or crucially, that a device must be marked as compliant by Microsoft Intune. This ensures that only trusted devices meeting organizational security standards can access internal applications, directly addressing the need for secure access from compliant endpoints.

Entra ID Privileged Identity Management (PIM) is the correct solution because it directly addresses the need for secure, time-bound access to administrative roles. PIM enables just-in-time (JIT) role activation, meaning users only get elevated permissions when needed and for a limited duration. It integrates approval workflows, requiring an authorized approver to grant temporary access, and provides detailed audit logs for accountability, aligning perfectly with managing role permissions with approval.

Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility and control over cloud applications used across an organization. It automatically discovers all cloud apps, both sanctioned and unsanctioned (shadow IT), assesses their risk based on over 25,000 applications in its catalog, and enables granular policy enforcement for access, data protection, and threat prevention within these applications. This capability directly addresses the need to gain visibility into what cloud applications employees are utilizing.

This option is correct because the retention policy specifies a 365-day period starting from the content creation date. If a document is created on January 1, 2025, counting 365 full days forward means the retention period concludes at the end of December 31, 2025. This ensures the item is preserved for the entire calendar year from its creation, making December 31, 2025, the precise end date for its active retention.

Deploying Microsoft Authenticator with phone sign-in provides a highly scalable and user-friendly passwordless solution by leveraging users' existing smartphones. This method supports cross-platform compatibility across Windows, iOS, and Android devices, enabling a consistent authentication experience without requiring passwords. Users simply approve a notification on their mobile device, making it an efficient and broadly applicable choice for an entire organization.

Microsoft Entra password protection actively safeguards user accounts by preventing the use of weak, easily guessable, or commonly compromised passwords. It enforces strong password policies by blocking known bad passwords globally and allows organizations to define custom banned password lists. This feature directly mitigates password spray and brute-force attacks by ensuring that even if an attacker attempts a common password, it will be rejected.

The Communication Compliance analyst is the frontline role specifically designated for the daily review and investigation of policy matches and alerts generated by Microsoft Purview. They are responsible for assessing potential policy violations, collaborating with subject matter experts, and taking appropriate actions such as escalating, resolving, or marking items as benign. This role is central to the operational enforcement of communication compliance policies.

Granting each employee only the permissions their job requires, such as Sales viewing but not approving or modifying financial data, is the definition of least privilege: minimising rights to exactly what each role needs, thereby reducing the blast radius of compromised or misused accounts.

Advanced hunting is a powerful, proactive threat hunting tool integrated directly within the Microsoft 365 Defender portal. It allows security analysts to leverage Kusto Query Language (KQL) to explore raw event data from various Microsoft 365 security products, including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. This capability enables the creation of sophisticated custom detection rules and the identification of unique threats across endpoints, email, identities, and cloud applications from a single interface.

Configuring improvement actions with owners in Microsoft Purview Compliance Manager is the direct mechanism for operationalizing compliance requirements. These actions represent specific tasks derived from controls and regulations, such as implementing a data encryption policy or updating a privacy notice. Assigning an owner ensures accountability, facilitates the delegation of remediation efforts, and enables tracking of progress and evidence submission, directly addressing the need to comply with regulations like GDPR.

Microsoft Entra Conditional Access policies are powerful 'if-then' statements that evaluate various signals, such as user, device, location, and application, to make real-time access decisions. By configuring a Conditional Access policy, an organization can specify conditions (e.g., users signing in from untrusted networks) and then enforce specific controls, such as requiring Multi-Factor Authentication, before granting access to resources. This capability directly addresses the need to enforce MFA during sign-in based on location.

Cloud Discovery is a fundamental feature of Microsoft Defender for Cloud Apps that identifies all cloud applications being used across an organization's network. By analyzing traffic logs from firewalls and proxies, it uncovers "shadow IT" – unsanctioned cloud apps – and provides risk assessments for each discovered application. This capability helps organizations gain visibility into their cloud app landscape and manage associated risks.

Microsoft Entra Privileged Identity Management (PIM) is the dedicated solution for managing, controlling, and monitoring access to critical resources across Microsoft Entra ID, Azure, and other Microsoft Online Services. It enables just-in-time (JIT) access, allowing users to activate eligible administrative roles for a limited, time-bound period. PIM also supports multi-stage approval workflows for role activation, ensuring that elevated privileges are granted only when necessary and with proper authorization, directly addressing the requirement for time-bound, approved elevation.

Zero Trust is an architectural model that mandates explicit verification for every access request, regardless of whether the user or device is inside or outside the traditional network perimeter. The policy of blocking access if a device is non-compliant directly embodies the 'never trust, always verify' principle by continuously validating device health and posture before granting access to organizational resources. This approach ensures that access decisions are dynamic and based on real-time context, rather than static network location.

Passwordless authentication directly addresses the goal of eliminating passwords by replacing them with stronger, more convenient alternatives. In Microsoft Entra ID, this includes methods like Windows Hello for Business, Microsoft Authenticator app, and FIDO2 security keys. These methods leverage biometrics, device-bound credentials, or cryptographic keys to verify user identity, significantly enhancing security and streamlining the sign-in experience without ever requiring a traditional password.

Access is granted because the fundamental conditions defined within the Conditional Access policy's "Assignments" section were not entirely satisfied. When a policy's conditions are not met, the policy is not triggered, and its configured controls—whether to grant, block, or require specific actions—are not enforced. In such cases, access typically defaults to being granted, assuming no other active policies or security defaults intervene to restrict it.

A legal hold, also known as an eDiscovery hold, establishes an absolute preservation requirement that takes precedence over any conflicting retention policies. Its primary function is to ensure that all relevant data, such as emails, remains immutable and discoverable for legal or investigative purposes. This means emails will be preserved and not deleted, even if a retention policy would otherwise dictate their removal, until the hold is explicitly released.

A core benefit of Microsoft Purview Compliance Manager is its ability to provide a quantifiable compliance score, which serves as a real-time indicator of an organization's overall compliance posture against various regulations and standards. This score is dynamically calculated based on the implementation status of recommended actions and controls, allowing organizations to quickly assess their progress and identify areas needing improvement. It provides a clear, measurable metric for tracking compliance efforts over time.

Password Hash Synchronization (PHS) is a cloud authentication method that securely synchronizes a cryptographic hash of a user's password from an on-premises Active Directory to Azure AD. This allows users to sign in to cloud services using the same credentials they use on-premises, without exposing their actual passwords in the cloud. It provides a simple, robust solution for hybrid identity, enabling a seamless transition for users during migration while maintaining a cloud-managed authentication experience.

Impersonation protection in Microsoft Defender for Office 365 is specifically designed to identify and block emails where the sender's display name or email address closely resembles a protected user or domain within the organization. This feature actively analyzes the sender's identity to detect sophisticated phishing attacks where attackers attempt to trick recipients into believing the email originates from a trusted internal source, thereby directly addressing user-targeted phishing and business email compromise (BEC) scenarios.

eDiscovery (Premium) provides end-to-end workflow for legal investigations, including identifying and holding relevant data, searching for specific content using keywords and conditions, reviewing results with advanced analytics, and exporting data for external review. It is the appropriate solution for litigation holds and search.

Applying sensitivity labels to documents and emails is a fundamental capability of Microsoft Purview Information Protection. These labels allow organizations to classify data based on its sensitivity level, such as 'Confidential' or 'Public,' and then automatically enforce corresponding protection actions. This includes visual markings, encryption, and access restrictions, ensuring consistent data governance and protection across various platforms and applications.

Microsoft Entra Identity Protection actively detects potential vulnerabilities affecting user identities, such as leaked credentials or risky sign-in behaviors, and can automate remediation actions including forcing a password change for high-risk users. Microsoft Entra Password Protection specifically prevents users from creating weak, commonly used, or custom-banned passwords, directly addressing the prevention of easily guessable or compromised passwords within the organization.

Automated investigation and remediation in Microsoft Defender for Business triggers response actions such as isolating infected devices and initiating full antivirus scans without manual intervention, directly satisfying the requirement for automatic malware remediation across the 300 Intune-enrolled devices.

Microsoft Sentinel's primary function as a Security Information and Event Management (SIEM) solution relies on ingesting security data from diverse sources. Data connectors are the specific mechanisms that facilitate this ingestion, establishing a secure link between various data sources (like Azure Activity Logs, Microsoft 365 Defender, firewalls, or custom applications) and the Log Analytics workspace underpinning Sentinel. They normalize and stream logs, making them available for analysis, threat detection, and investigation within the platform. For sources without direct API integration, generic connectors like Syslog or Common Event Format (CEF) are utilized to centralize data.

User and Entity Behavior Analytics (UEBA) relies critically on establishing comprehensive historical behavior baselines for users and entities within an environment. Machine learning algorithms continuously process vast datasets of activity, learning what constitutes "normal" behavior over time for each individual or system. By comparing current activities against these dynamically learned baselines, UEBA can effectively identify deviations and anomalous patterns that indicate potential security threats, such as insider threats or compromised accounts, without requiring explicit rules.

Communication Compliance is the correct solution, specifically designed to help organizations detect, investigate, and act on inappropriate messages within Microsoft Teams, Exchange Online, Yammer, and other communication platforms. It leverages intelligent classifiers and customizable policies to identify potential regulatory compliance issues, code-of-conduct violations, or instances of harassment. This service provides a robust framework for reviewing flagged communications, taking remediation actions such as notifying users, and fostering a compliant and respectful workplace environment.

Confidentiality is the principle that sensitive information, such as patient records, is protected from unauthorized disclosure and accessible only to authorized entities. Implementing encryption, both for data at rest (e.g., Transparent Data Encryption for Azure SQL Database) and data in transit (e.g., TLS/SSL), directly ensures that even if data is intercepted or accessed by an unauthorized party, it remains unreadable and unintelligible, thereby upholding its confidentiality.

Communication Compliance evaluates messages across Teams, Exchange, and Viva Engage against defined policies, letting reviewers detect and act on regulatory or code-of-conduct breaches. This directly satisfies the requirement to enforce company policies on communication channels rather than merely classify data at rest.

A custom anti-phishing policy lets you tighten thresholds beyond the default policy's fixed settings, such as enabling impersonation protection for specific users and domains, adjusting mailbox intelligence sensitivity, and configuring spoof intelligence. This directly addresses the reported bypasses by applying stricter, organisation-specific detection rules to inbound mail.

This Conditional Access policy configuration effectively enforces Multi-Factor Authentication (MFA) for all users attempting to access resources from any network location, while simultaneously creating a specific exception for trusted network environments. By including "all locations" and then explicitly excluding "trusted locations," the policy ensures MFA is mandated for external or untrusted access attempts, but users on the secure corporate network are not prompted for an additional factor, balancing robust security with user experience.

Microsoft Purview Data Lifecycle Management is the correct service for managing data retention and deletion across an organization, offering retention labels that can be manually applied or, crucially, automatically applied via auto-labeling policies. These policies leverage conditions like sensitive information types, keywords, or trainable classifiers to ensure content-specific retention actions are taken without manual intervention. This directly addresses the need for content-based automatic retention.

Safe Attachments is a core capability of Microsoft Defender for Office 365, providing advanced zero-day protection against unknown malware and viruses in email attachments. It detonates attachments in a secure, virtual environment before they reach the user's inbox, analyzing their behavior for malicious indicators. This proactive sandboxing prevents sophisticated threats, including ransomware and targeted attacks, from ever compromising an organization's endpoints.

Multi-factor authentication (MFA) is a security process that requires users to provide two or more distinct verification factors from independent categories to prove their identity. By combining something the user knows (e.g., a password), something the user has (e.g., a phone, smart card), or something the user is (e.g., a fingerprint), MFA significantly enhances security by making it much harder for unauthorized users to gain access, directly fulfilling the requirement for a second form of verification.

Azure Active Directory Conditional Access is the policy engine that evaluates specific conditions before granting access to resources. It enables organizations to enforce strong authentication requirements, such as Multi-Factor Authentication (MFA), and control access based on factors like user location, device compliance, or application sensitivity. This capability is fundamental for implementing Single Sign-On (SSO) securely by defining the prerequisites for a user's initial authentication and subsequent access to integrated applications.

A built-in sensitive information type detects predefined patterns such as credit card numbers using validated checksums and keywords, so the DLP rule can block email sharing without custom regex authoring. It directly satisfies the requirement to prevent credit card numbers leaving via email.

Microsoft Entra ID Protection actively monitors and evaluates various sign-in attempts for suspicious patterns, classifying them as "sign-in risk." This includes detecting anomalies like impossible travel from geographically disparate locations, sign-ins from anonymous IP addresses or malware-linked IPs, and unfamiliar sign-in properties such as new devices or locations. These real-time detections are crucial for preventing unauthorized access by compromised accounts.

This option is correct as it precisely addresses the common requirement to protect sensitive data from leaving the organization while enabling necessary internal collaboration. The 'Block external sharing' action directly prevents data exfiltration to unauthorized external parties, while explicitly allowing internal sharing supports legitimate business operations. Furthermore, enabling user notifications with policy tips is a best practice for educating users about compliance policies and fostering a security-aware culture.

Microsoft Entra Connect Sync is the primary and recommended tool for establishing hybrid identity by synchronizing users, groups, and devices from a single on-premises Active Directory Domain Services (AD DS) forest to Microsoft Entra ID. It supports various authentication methods like Password Hash Synchronization (PHS), Pass-through Authentication (PTA), and federation with AD FS. Its robust feature set includes attribute filtering, writeback capabilities, and a crucial staging mode for testing configurations before full deployment, making it ideal for most enterprise scenarios.

Granting the `User.Read.All` application permission provides the necessary access for an application to read all user profiles in Microsoft Entra ID without granting excessive write or administrative capabilities, adhering to the principle of least privilege. Configuring an access review for these application permissions ensures that the granted access is periodically re-evaluated by designated reviewers, promoting ongoing security hygiene and preventing the accumulation of stale or unnecessary permissions over time.

eDiscovery (Premium) supports custodian-based search across Exchange Online, SharePoint Online and OneDrive for Business, with review sets and export for DSAR responses. It satisfies the cross-workload search requirement that core eDiscovery handles less comprehensively for GDPR requests.

For an auto-labeling policy or rule to effectively identify and apply a sensitivity label to content, it must incorporate specific conditions that define what constitutes sensitive data. These conditions typically involve detecting specific sensitive information types (SITs), keywords, or patterns within documents or emails. Without any defined conditions, the rule lacks the necessary criteria to evaluate content, rendering it incapable of matching or labeling any data, regardless of other policy settings.

This Conditional Access control directly addresses the requirement by ensuring that only devices evaluated and reported as 'compliant' by Microsoft Intune (or a third-party MDM integrated with Azure AD) are granted access. Device compliance policies define security baselines, such as minimum OS versions, encryption status, or antivirus presence. By enforcing this control, the organization guarantees that devices accessing resources adhere to established security standards and are actively managed.

When a compliance officer applies a record label to a document in Microsoft Purview, the item becomes an immutable record. This action prevents any user, including the creator or an administrator, from deleting or modifying the document during its retention period. Consequently, any attempt to delete the document will result in an "access denied" error, ensuring the integrity and immutability required for regulatory compliance and legal obligations.

Microsoft Entra B2B collaboration is the correct and most efficient solution for integrating users from another Microsoft Entra ID tenant following a merger. It allows Fabrikam to invite the acquired company's users as guest accounts, enabling them to authenticate using their existing credentials from their home tenant. Furthermore, Fabrikam can apply its own Conditional Access policies to these guest users, ensuring consistent security and compliance standards are enforced for all access to its resources.

Microsoft Defender for Cloud Apps functions as a comprehensive Cloud Access Security Broker (CASB), providing deep visibility, robust control, and advanced threat protection for data across an organization's entire cloud application landscape, including both Microsoft and numerous third-party SaaS applications. It excels at discovering shadow IT, enforcing granular data loss prevention policies, and detecting anomalous user behavior or threats within these diverse cloud environments. Its capabilities are specifically tailored to monitor and secure interactions with external SaaS applications, making it the correct choice for this scenario.

Sensitivity labels allow organizations to classify data based on its sensitivity level and apply corresponding protective actions, such as encryption, watermarking, or access restrictions. While auto-labeling can be configured to automatically apply these labels based on content, the labels themselves primarily define how data should be protected and who can access it. They do not inherently provide the active, policy-driven enforcement mechanism to prevent data loss or inappropriate sharing across organizational boundaries, which is the domain of DLP.

This configuration provides a robust and comprehensive security posture by combining all three essential conditions. Device state ensures that only healthy, managed, and compliant devices can access resources, mitigating endpoint-related risks. Locations restricts access to authorized network perimeters, such as corporate offices or VPNs, preventing unauthorized external access. Sign-in risk dynamically assesses the likelihood of a compromised sign-in and can block or challenge suspicious attempts, providing a multi-faceted defense against evolving threats.

Identity Protection applies Microsoft Entra ID's risk detections to sign-ins and users, automatically calculating risk levels and triggering conditional access actions such as password reset. This matches the requirement for automatic detection of suspicious IPs and leaked credentials with automated remediation.

Conditional Access policies evaluate various signals in real-time, including user, device, application, and network location. Administrators can configure these policies to mandate specific controls, such as multi-factor authentication (MFA), when certain conditions are met, like a user attempting to access resources from an untrusted network or outside the corporate IP range. This directly addresses the requirement to enforce MFA for users accessing resources under specific conditions.

This policy correctly targets "All locations" while specifically excluding "trusted locations" from its scope. Consequently, it applies only to untrusted network locations. For access attempts originating from these untrusted environments, the policy mandates that the device must be compliant with organizational security standards. Access from trusted locations is not governed by this specific policy, effectively allowing access from those locations without requiring device compliance, which aligns with typical security requirements.

Regular data backups and a disaster recovery plan are fundamental controls to ensure Availability. Availability guarantees that authorized users can access information and systems when needed, without undue interruption. By creating redundant copies of data and establishing procedures to restore operations after disruptive events, these measures directly support the continuous accessibility and usability of critical business resources.

Auto-labeling policies can automatically apply sensitivity labels to content that matches conditions, such as containing sensitive information types for PII. They work across Exchange, SharePoint, and OneDrive, and the label can include encryption. This meets the requirement for automatic classification and protection without user intervention.

Data Loss Prevention inspects email content for sensitive information types such as credit card numbers, blocks external sends, shows policy tips, permits business-justification overrides, and logs incidents for reporting. This satisfies all four requirements within Microsoft Purview without additional configuration.

Microsoft Entra External Identities, particularly its B2B collaboration feature, is the correct solution for enabling external users to securely access an organization's applications and resources. This service allows guest users to sign in using their own corporate credentials, social identities, or other identity providers, seamlessly integrating them into the host organization's Microsoft Entra ID tenant for collaborative purposes.

eDiscovery (Standard) preserves Exchange Online, SharePoint Online and Teams content via holds, supports keyword searches across those locations, and exports results for external review. It satisfies both the litigation-hold and cross-workload search requirements without the premium capabilities of eDiscovery (Premium).

Azure AD Identity Protection actively monitors user sign-ins and user behavior for suspicious activities, including password spray attacks, impossible travel, anomalous IP addresses, and leaked credentials. When it detects these risks, it generates risk detections that can trigger automated responses or alert administrators. This capability directly addresses the need to identify the cause of frequent password reset requests by pinpointing the underlying attack patterns.

Microsoft Purview offers advanced eDiscovery capabilities, enabling organizations to efficiently identify, preserve, collect, process, review, and export electronically stored information (ESI). This functionality is crucial for legal investigations, regulatory requests, and internal inquiries, allowing compliance officers to search across various data sources like Exchange mailboxes, SharePoint sites, and Microsoft Teams for relevant content.

Authorization determines the level of access an authenticated identity has to resources. After authentication proves identity, authorization evaluates permissions, group memberships, and policies to allow or deny actions. In this scenario, explaining that authorization controls what a user can do accurately distinguishes it from authentication, which only confirms identity. This definition aligns with Microsoft security fundamentals terminology.

Defender for Cloud Apps uses Cloud Discovery to analyse traffic logs against its app catalogue, surfacing unsanctioned Shadow IT usage. Its risk scoring and anomaly detection policies then alert on high-risk apps, directly meeting the discovery, scoring and alerting requirements for Salesforce, Box and similar SaaS services.

Microsoft Defender for Cloud continuously assesses Azure resources against security controls, surfacing misconfigurations through Secure Score and prioritised recommendations in a central dashboard. This directly satisfies the administrator's need to identify and remediate breach-prone misconfigurations, unlike Entra ID, which governs identities rather than resource configuration posture.

Intune compliance policies define the specific security and health requirements that a device must meet to be considered compliant, such as requiring a minimum OS version, disk encryption, or antivirus software. Conditional Access policies then integrate with Azure AD to evaluate this compliance status in real-time. This powerful combination ensures that only devices meeting the defined compliance standards are granted access to sensitive organizational applications and data, providing robust, continuous enforcement.

Identity has emerged as the new security perimeter in modern architectures, particularly with the adoption of Zero Trust principles. It serves as the control plane for all access decisions, authenticating every user and device, and authorizing their access requests to resources regardless of their network location or the device they are using. This approach ensures that access is granted only after verifying the identity and context, making it the most critical security boundary.