What's changed: Added per-section figures (cert-figure-retrofit). New AB-900 Chapter 1 (Domain 1 "Core M365 features and objects": core objects = licenses/admin centers (M365/Exchange/SharePoint/Teams)/objects and roles; security principles = three Zero Trust principles/authentication-authorization/threat protection/Defender XDR; core security features = Entra/conditional access/SSO/sign-in troubleshooting/Identity Secure Score/audit logs/PIM/app registrations-enterprise apps)
1.3Core security features of Microsoft 365
Understand Microsoft Entra features, conditional access and SSO, choosing users vs groups, troubleshooting sign-in issues (MFA, conditional access, risky sign-ins), Identity Secure Score, audit logs, Privileged Identity Management (PIM), and app registrations vs enterprise apps.
The identity foundation of Microsoft 365 is Microsoft Entra ID. It centrally manages identities and access for users, groups, apps, and devices, providing sign-in controls and security-posture evaluation.
1.3.1Conditional access and SSO
Conditional access applies controls (require MFA, block, require compliant device) based on sign-in signals (user, location, device, risk). Single sign-on (SSO) lets users access multiple apps after one authentication, improving usability and security (less password reuse, centralized control). Choose users vs groups based on individual settings vs bulk application (group-based assignment is generally preferred).
1.3.2Sign-in issues and Identity Secure Score
Troubleshoot sign-in issues with sign-in logs, identifying whether MFA, conditional access, or risky sign-ins (Entra ID Protection) blocked or prompted. Identity Secure Score rates your Entra ID posture with a number and recommended improvements, prioritizing actions like rolling out MFA and fixing risky settings. Audit logs record user/admin activity for investigation and evidence.
1.3.3PIM and application identities
Privileged Identity Management (PIM) avoids standing assignment of powerful admin roles and elevates them just-in-time for a limited time, with approval, MFA, and audit. Apps have identities too: distinguish an app registration (the app definition = blueprint) from the enterprise application (service principal) instantiated in the tenant. These underpin managing app permissions (consent).
| Goal | Feature | Key point |
|---|---|---|
| Access control by conditions | Conditional access | Require MFA/block/compliant device |
| One sign-in for many apps | SSO | Usability + central control |
| Numeric posture rating | Identity Secure Score | Prioritize improvements |
| Activity record | Audit logs | Investigation/evidence |
| Minimize privilege | PIM | JIT elevation, approval, MFA, audit |
| App identity | App registration / enterprise app | Definition (blueprint) vs instance (SP) |
Watch the mix-ups: (1) conditional access (conditions → controls) vs SSO (one sign-in for many apps). (2) Identity Secure Score (numeric posture) vs audit logs (activity record). (3) PIM (JIT privilege elevation). (4) app registration (blueprint) vs enterprise app = service principal (instance).
Common: requirement → feature. E.g., "require MFA under certain conditions" = conditional access; "one sign-in for many apps" = SSO; "see and improve posture numerically" = Identity Secure Score; "review admin activity later" = audit logs; "no standing admin roles" = PIM; "find why a sign-in was blocked" = sign-in logs (MFA/conditional access/risk).
1.3.4Section summary
- Entra ID = identity foundation; conditional access (conditions → controls) + SSO (one sign-in for many apps)
- Troubleshoot sign-ins via sign-in logs (MFA/conditional access/risk); Identity Secure Score rates posture; audit logs record
- PIM elevates privilege JIT; distinguish app registration (blueprint) from enterprise app (instance)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which lets users access multiple apps after a single authentication, reducing password reuse?
Q2. Which applies MFA requirements or blocks based on sign-in signals (location, device, risk)?
Q3. Which rates Microsoft Entra ID security posture with a number and recommended improvements?
Q4. Which avoids standing admin roles and elevates them just-in-time for a limited time?
Q5. Which records user/admin activity for later review, investigation, and evidence?
Q6. Which correctly describes app registration vs enterprise application?