Microsoft Cybersecurity Architect — knowledge map
The 68 core concepts of Microsoft Cybersecurity Architect and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (68)
Conditional Access
Grants or challenges access based on conditions like location, device, or risk (a Zero Trust implementation).
Microsoft Entra ID
Cloud identity/access management (formerly Azure AD) providing MFA/SSO/Conditional Access; distinct from on-prem AD DS.
Prerequisites: Conditional Access、Access management (RBAC / least privilege / JIT)
Microsoft Defender XDR
Unifies protection across endpoints/email/identity/SaaS, correlating signals across domains (Endpoint/Office 365/Identity/Cloud Apps).
Microsoft Defender for Cloud
Scores security posture (Secure Score) and detects misconfigurations/threats to recommend fixes.
Prerequisites: Microsoft Defender XDR
Authentication methods (MFA / passwordless)
Means of verifying identity. Methods stronger than passwords alone, such as multifactor authentication (MFA) and passwordless (FIDO2 security keys, Authenticator, Windows Hello).
Prerequisites: Multi-factor authentication (MFA)
Threat protection and threat intelligence
Capabilities for detecting, analyzing, and responding to attacks. Microsoft Defender XDR unifies signals across domains to deliver extended detection and response (XDR).
Prerequisites: Microsoft Defender XDR
Microsoft Entra authentication for Azure SQL
The recommended Azure SQL authentication. Centralized in Entra ID with MFA, Conditional Access, and passwordless connections via managed identity. Enabled by configuring an Entra ID admin.
Prerequisites: Authentication methods (MFA / passwordless)、Conditional Access、Microsoft Entra ID
Microsoft Purview
Microsoft's unified governance and compliance solutions: information protection, data lifecycle, risk management, eDiscovery, and auditing, plus cross-estate data governance via the data map/catalog (integrating the former Azure Purview).
Related: Purview Information Protection
Data classification (SITs / trainable classifiers)
Data classification identifies content using sensitive information types (patterns like credit cards or national IDs) and trainable classifiers. It informs where to apply sensitivity labels and DLP.
Prerequisites: Sensitivity labels
Related: SQL data classification
Purview Information Protection
Microsoft Purview Information Protection discovers and classifies sensitive information and applies protection (encryption, access restriction, watermarks) via sensitivity labels. It is foundational to limiting exposure in Copilot responses.
Prerequisites: Sensitivity labels
Related: Microsoft Purview
SharePoint oversharing controls
Because Copilot inherits existing permissions, oversharing can surface sensitive data via Copilot. Use the data access governance report to find widely shared / sensitivity-labeled sites and remediate with restricted site access in SharePoint Advanced Management.
Prerequisites: SharePoint
Subscription (Azure)
The billing/usage boundary and a logical container for resources; often split by department or environment.
Hybrid identity (Entra Connect)
Syncs on-prem Active Directory with Entra ID for hybrid identity. Choose authentication among password hash sync, pass-through authentication, and federation (AD FS).
Prerequisites: Authentication methods (MFA / passwordless)、Microsoft Entra ID
Customer-managed keys (CMK) / Platform-managed keys (PMK)
Key-management models for encryption at rest. PMK = managed by Azure by default (no extra setup). CMK = the customer creates/rotates/revokes the key in Key Vault and assigns it as the protector for Storage or SQL TDE (e.g., compliance). The algorithm is identical; the difference is who manages the key. Disks are protected by Azure Disk Encryption (in-guest BitLocker/DM-Crypt) or encryption at host (platform), both supporting CMK.
Prerequisites: Azure Key Vault
Microsoft Cloud Security Benchmark (MCSB)
Microsoft’s set of security best practices that Defender for Cloud assesses by default. It is the basis for Secure Score and maps to industry frameworks.
Prerequisites: Microsoft Defender for Cloud
B2C (Azure AD B2C)
CIAM (customer identity and access management) functionality that customizes sign-up/sign-in for consumer-facing apps, offering branded login experiences via social login and custom policies. Legacy Azure AD B2C can no longer create new tenants as of May 2025 and is being consolidated/migrated into Microsoft Entra External ID.
Prerequisites: Microsoft Entra ID、Access management (RBAC / least privilege / JIT)
Microsoft Entra ID Protection
Computes user/sign-in risk from leaked credentials, impossible travel, etc., integrating with Conditional Access.
Prerequisites: Conditional Access、Microsoft Entra ID
Microsoft 365
A SaaS productivity suite delivering email, documents, and meetings in the cloud, used via per-user subscription.
Prerequisites: Subscription (Azure)
Microsoft Teams
A collaboration hub for chat, meetings, calls, and teamwork; files are stored behind the scenes in SharePoint/OneDrive.
Prerequisites: OneDrive
Related: SharePoint
Microsoft Defender for Cloud Apps
A CASB (cloud access security broker) that discovers and controls cloud-app usage and shadow IT.
Prerequisites: Microsoft Defender for Cloud、Microsoft Defender XDR
Microsoft Secure Score
A measure that quantifies an organization’s security posture with recommended improvement actions and progress, viewed in the Microsoft Defender portal.
Prerequisites: Microsoft Defender XDR、Microsoft Defender portal
Rapid Modernization Plan (RaMP)
Guidance that orders Zero Trust adoption by quick, high-impact outcomes (securing privileged access, user access/passwordless, protecting data/apps). Shows leadership "what to harden first." Distinct from the MCRA reference architecture.
Prerequisites: Authentication methods (MFA / passwordless)、Microsoft Cybersecurity Reference Architectures (MCRA)
Advanced hunting (KQL)
Uses KQL in Defender XDR / Sentinel to proactively hunt threats across telemetry, turning queries into analytics rules for automated detection.
Prerequisites: Microsoft Defender XDR、Microsoft Sentinel
Access management (RBAC / least privilege / JIT)
Role-based access control (RBAC) grants permissions by job function, applies least privilege, and PIM just-in-time (JIT) elevation enables privileges only when needed.
Sensitivity labels
Classify data and apply protection (encryption, usage limits); labels travel with the file, persisting outside the org.
Microsoft Sentinel
A cloud-native SIEM + SOAR that collects logs and detects, investigates, and auto-responds to threats.
Prerequisites: SOAR
Related: SIEM
Management group
The top-level container grouping subscriptions; applies policy/access in bulk, inherited downward.
Prerequisites: Subscription (Azure)
Multi-factor authentication (MFA)
Strengthens identity proof with a second factor beyond a password.
Azure Bastion
A managed jump-host service for browser-based (Azure portal) RDP/SSH to VMs without assigning them public IPs, so management ports need not be exposed to the internet—reducing the attack surface. Often combined with Just-In-Time VM access, which opens management ports only when needed.
Related: Just-In-Time (JIT) VM access
Just-In-Time (JIT) VM access
A Defender for Cloud feature that keeps VM management ports (RDP/SSH) closed by default and, only on request/approval, inserts a temporary allow rule into the NSG/Firewall, auto-closing it after a window. It avoids standing exposure to reduce the attack surface. Unlike Bastion (an always-available jump host), JIT opens access only when needed.
Prerequisites: Microsoft Defender for Cloud
Related: Azure Bastion
Regulatory compliance (standards / custom)
Defender for Cloud’s regulatory compliance dashboard assesses conformance to standards like PCI DSS or ISO, and lets you add custom standards for your own requirements.
Prerequisites: Microsoft Defender for Cloud
Azure Private Link / Private Link Service
A platform that brings connectivity to PaaS or your own service onto a private IP inside the VNet. Private Link connects to PaaS (Storage/SQL) via a private endpoint (a NIC with a private IP) without the public path. The PaaS public FQDN CNAMEs to a privatelink zone, and the private DNS zone’s A record resolves it to the private IP (forgetting to link → resolves to public IP, a common mistake). Each sub-resource (blob/file, etc.) needs its own endpoint and zone. On-prem resolution uses a DNS Private Resolver plus conditional forwarders. Private Link Service offers your own service (behind a Standard Load Balancer) to other tenants/VNets via Private Link. Unlike service endpoints, it assigns a real private IP and is reachable from on-prem.
Prerequisites: Private endpoint
Azure landing zone
A blueprint for a scalable, governed Azure environment spanning management groups, subscriptions, policies, networking, and identity, based on the Cloud Adoption Framework enterprise-scale.
Prerequisites: Management group、Subscription (Azure)
Related: Azure landing zone (CAF)
Azure Backup
A managed service that periodically backs up VMs, file shares, SQL/SAP HANA, etc. into a Recovery Services vault. Its purpose is data restore from any recovery point on demand, with encryption, retention policies, and instant restore support.
Prerequisites: Retention policy
Related: Azure Site Recovery (ASR)
CIEM
Cloud Infrastructure Entitlement Management continuously scans identity permissions across Azure, AWS, and GCP to surface and reduce over-provisioned (unused) entitlements. Distinct from PIM, which handles just-in-time privilege elevation—CIEM is an inventory practice that trims the standing permissions themselves.
Prerequisites: Access management (RBAC / least privilege / JIT)
B2B collaboration (Microsoft Entra External ID)
Invites users from external organizations (e.g., partners) as guests, letting them collaborate using their own existing identity. Now unified under Microsoft Entra External ID, invitations and permissions are governed via Conditional Access and cross-tenant access settings. An invited guest is registered as a guest user object within the inviting organization's own tenant and authenticates with their external organization's credentials—no separate tenant is created for the guest.
Prerequisites: Conditional Access
Related: B2C (Azure AD B2C)
Azure Front Door
A global L7 entry point combining CDN caching, global routing, WAF, and SSL offload to boost availability and performance.
Azure Key Vault
Securely stores and manages keys, secrets, and certificates so they need not be embedded in apps.
Microsoft Intune
A cloud service to manage/secure devices and apps; MDM manages the device itself, MAM manages in-app data; integrates with Conditional Access.
Prerequisites: Conditional Access
OneDrive
Personal cloud file storage and sync—keep your own files and share as needed (SharePoint is for org sharing).
Prerequisites: SharePoint
Private endpoint
A NIC with a private IP in the VNet that connects to PaaS (Storage/SQL) without the public path; each sub-resource needs its own endpoint and DNS zone.
Retention policy
Keeps data for the required period and deletes it when no longer needed, managing its lifecycle.
Microsoft Entra Internet Access
Part of Global Secure Access (SSE). Inspects/controls users’ internet/SaaS-bound traffic as a secure web gateway with cross-tenant protection. Distinguished by destination from Entra Private Access (ZTNA to internal apps).
Prerequisites: Microsoft Entra Private Access
Microsoft Cybersecurity Reference Architectures (MCRA)
A reference architecture mapping which Microsoft products provide which defensive capabilities across identity/SOC/endpoints/hybrid-multicloud/OT. A "map" used as a design starting point to find capability gaps—distinct from MCSB, which measures conformance.
Prerequisites: Microsoft Cloud Security Benchmark (MCSB)
Security Service Edge (SSE) / Global Secure Access
A concept inserting a cloud security layer between users and apps. Under Microsoft’s Global Secure Access, it includes Entra Internet Access (SWG) and Entra Private Access (ZTNA). Becomes Zero Trust when integrated with Conditional Access.
Prerequisites: Conditional Access、Microsoft Entra Private Access
Related: Microsoft Entra Internet Access
Purview DSPM for AI
Microsoft Purview Data Security Posture Management for AI. Visualizes sensitive-data risk and overexposure handled by Copilot and AI apps, driving remediation via labeling, access review, and DLP—a proactive posture capability.
Prerequisites: Microsoft Purview
UEBA and threat intelligence
UEBA (user/entity behavior analytics) detects deviations from baseline, correlated with threat intelligence (IoCs, MITRE ATT&CK) to identify advanced attacks.
Prerequisites: Threat protection and threat intelligence
SOAR
Security Orchestration, Automation and Response: automates and orchestrates the post-detection response (investigation, containment, notification) to alerts from a SIEM via playbooks, cutting analyst repetitive work and response time.
Prerequisites: SIEM
Application Gateway
A regional L7 (HTTP) load balancer supporting URL path-based routing, listeners, HTTP settings, SSL termination, rewrite rules, and WAF.
BCDR design (backup/disaster recovery)
Designs business continuity and disaster recovery: Azure Backup protects data, Azure Site Recovery does cross-Region replication/failover, and zone redundancy/multi-Region meet RPO/RTO requirements.
Prerequisites: Azure Backup、Azure Site Recovery (ASR)
Azure landing zone (CAF)
A standardized foundation blueprint based on the Cloud Adoption Framework enterprise-scale. It pre-configures network (hub-spoke), identity, policy, and management, deploying consistent governance along the management group hierarchy.
Prerequisites: Management group
Related: Azure landing zone
Web Application Firewall (Azure WAF)
Runs on Application Gateway (regional) or Front Door (global edge) to block L7 (application-layer) attacks like SQL injection and XSS. Combines OWASP managed rule sets with custom rules (geo-block, rate limiting). Roll out in Detection mode to check false positives, then switch to Prevention. NSG/Firewall operate at L3/L4; WAF is L7.
Prerequisites: Application Gateway、Azure Front Door
Azure Site Recovery (ASR)
A DR (disaster recovery) service that continuously replicates VMs to another region (or on-prem⇔Azure) and fails over to keep workloads running during a disaster. A test failover validates the procedure without disrupting production, and a Recovery Plan orchestrates startup order across multiple VMs.
Related: Azure Backup
Microsoft Entra Permissions Management
Microsoft's CIEM product. Analyzes permissions across identities and resources spanning multi-cloud (Azure/AWS/GCP), surfaces a Permission Creep Index score, and proposes remediation for unused entitlements. Distinctive for giving one dashboard view of effective permissions across multiple clouds.
Prerequisites: CIEM
Office apps (Word/Excel/PowerPoint/Outlook)
Core apps for documents/spreadsheets/presentations/email; in Microsoft 365 they stay up to date via subscription across web/desktop/mobile with co-authoring.
Prerequisites: Subscription (Azure)、Microsoft 365
Microsoft Defender portal
A portal unifying Defender XDR signals (email, identity, endpoint, apps) to centrally manage incident investigation/response and Secure Score.
Prerequisites: Microsoft Defender XDR
Microsoft Priva
A solution to manage personal-data privacy risks and handle data subject requests (DSRs), detecting and remediating over-retention or oversharing of personal data.
Prerequisites: SharePoint oversharing controls、Retention policy
Protected actions
Protection that blocks the most dangerous admin operations (e.g., deleting Conditional Access policies) unless a strong authentication context (e.g., phishing-resistant MFA) is met. Adds a stricter gate than ordinary role permissions.
Prerequisites: Conditional Access
Defender for Servers
Provides VM vulnerability scanning (Defender Vulnerability Management), EDR (Defender for Endpoint integration), agentless scanning, and JIT VM access. Extends to on-prem and AWS/GCP servers via Azure Arc.
Prerequisites: Azure Arc、Just-In-Time (JIT) VM access
Microsoft Entra Private Access
Replaces VPN by granting identity-based, per-app (Zero Trust) access to internal apps, reaching only the needed apps rather than the whole network.
Records management and data lifecycle
Microsoft Purview records management declares regulated documents as immutable "records" via retention labels and deletes them after a disposition review past the retention period, integrating with data lifecycle management.
Prerequisites: Microsoft Purview、Retention policy
SIEM
Security Information and Event Management: centrally collects logs and events from many sources (servers, network gear, apps) and correlates them to detect threats. Products like Microsoft Sentinel, Google SecOps, and Splunk fill this role.
Related: Microsoft Sentinel
Azure Arc
Manages on-prem/other-cloud servers, Kubernetes, and databases through the Azure management plane (policy/tags/RBAC).
BYOK and infrastructure encryption
BYOK (Bring Your Own Key) brings a customer-managed key to storage encryption, and enabling infrastructure encryption adds a second 256-bit AES layer.
Prerequisites: Customer-managed keys (CMK) / Platform-managed keys (PMK)
SQL data classification
A strategy that labels columns with sensitivity and information types to identify and surface sensitive data, combined with auditing to govern its handling.
Defender for Databases
Provides threat protection across Azure database services, detecting suspected SQL injection, anomalous logins, and unusual sensitive-data access (formerly Advanced Threat Protection). Distinct from SQL auditing, which records.
Prerequisites: Threat protection and threat intelligence
Entra ID Governance
Ensures the right people have the right access to the right resources for the right time. Includes entitlement management (access packages), access reviews, Privileged Identity Management (PIM), and lifecycle workflows.
Prerequisites: Microsoft Entra ID