What's changed: Created SC-100 Chapter 1 (Domain 1 "Design solutions that align with security best practices and priorities": Zero Trust 3 principles/6 pillars/Conditional Access/RaMP; MCRA/MCSB/Defender for Cloud/Secure Score/defenses by attack type; CAF/WAF/Azure landing zones/Azure Policy/DevSecOps/workload identity; resiliency/business-critical assets/BCDR/immutable backups/Azure Backup/Site Recovery/ransomware priorities/security updates).
1.1Zero Trust and RaMP
Understand Zero Trust (verify explicitly, least privilege, assume breach) across its six defense pillars (identity/endpoints/apps/data/infrastructure/network) and the prioritized adoption path of the Rapid Modernization Plan (RaMP), from an architect’s perspective.
A Microsoft Cybersecurity Architect translates business requirements into security capabilities and guides their implementation. The exam tests design decisions—which capability, in what order, with which product—more than step-by-step implementation. The foundation is Zero Trust.
1.1.1Three principles and six pillars
Zero Trust distills to three principles: (1) verify explicitly (authorize on every signal—user, location, device, service), (2) least-privilege access (Just-In-Time/Just-Enough-Access, risk-based policies), and (3) assume breach (minimize blast radius, encrypt, detect via analytics). Apply them consistently across six pillars: identity, endpoints, applications, data, infrastructure, and network. The architect assesses which pillar is weakest and prioritizes investment.
1.1.2Identity as the primary control plane
When the perimeter dissolves in the cloud, identity becomes the control plane. The core is Microsoft Entra ID with Conditional Access, which evaluates signals (user risk, sign-in risk, device compliance, location) to allow/block/step-up to MFA. The architect treats network controls as supplementary and identity controls as primary, recommending that all resource access funnel behind Entra authentication.
1.1.3Prioritized adoption with RaMP
Zero Trust is not completed at once. RaMP (Rapid Modernization Plan) is guidance that orders the highest-impact outcomes—securing privileged access, user access and passwordless, protecting data and apps—by what can be achieved quickly. Architects use RaMP to explain to leadership what to harden first under limited budget and staff. The comprehensive reference architecture is MCRA (next section).
Reason from "requirement → principle/pillar." "Gate access on device compliance" = verify explicitly + endpoints = Conditional Access. "No standing admin rights" = least privilege = PIM. "Limit lateral movement after compromise" = assume breach = segmentation + encryption. If asked about order, RaMP (start with privileged access).
Watch the mix-ups: (1) Zero Trust is "always verify," not "drop the VPN and expose everything." (2) Network segmentation is part of Zero Trust but does not replace identity controls. (3) RaMP (adoption priorities) and MCRA (reference architecture) are different things.
1.1.4Section summary
- Zero Trust = verify explicitly / least privilege / assume breach, applied across six pillars (identity, endpoints, apps, data, infrastructure, network)
- In the cloud, identity is the control plane: Entra ID + Conditional Access primary, network supplementary
- Adoption priority via RaMP (start with privileged access); comprehensive reference is MCRA
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which design most directly embodies the Zero Trust principle "assume breach"?
Q2. In cloud-centric design, which should be the primary control plane for access?
Q3. Which guidance presents Zero Trust adoption priorities—what to harden first—under a limited budget?
Q4. To allow/step-up-MFA/block based on device compliance and sign-in risk, which is best?
Q5. Which is NOT one of the six Zero Trust defense pillars?