Microsoft 365 (M365) Security

• There are thousands of operations constantly occurring against Microsoft 365 (M365).
• Enhanced capabilities allow better management.

Shared Responsibilities

• As you move to the cloud, you have less responsibility, but you still manage things like identities.
• Defense in depth involves as many layers of protection as possible
• Zero trust involves not trusting the network and constantly validating access.
• Least privilege focuses on providing only the minimum necessary access, only when needed (just-in-time).
• Assume breach involves encrypting everything, segmenting, and minimizing access.
• The approach applies to identities, devices, apps, data, infrastructure, and network encryption.

Encryption

• Symmetric encryption uses the same key for encryption and decryption.
• Asymmetric encryption uses a pair of keys, where one key's action can be undone by the other.
• Public key: used to encrypt data that only the recipient can decrypt with their private key.
• Azure Key Vault (KYT) is an Azure service for storing secrets.
• Storing keys can read, write, and import them.
• Keys can be generated but not exported, cryptographic operations can be run inside it.
• Certificates can be managed to control their lifecycle.

Identities in Microsoft Entra ID

• A tenant is a set of objects, including users, applications, devices, and groups.
• Apps and services trust a particular tenant.
• Single sign-on can be extended to on-premises directories using synchronization.

Authentication

• Authentication proves you are who you claim to be.
• Multi-factor authentication (MFA) is the minimum, requiring multiple factors for authentication.
• Factors include something you know, something you have, or something you are.
• Passwordless is ideal and involves conditional access.
• Conditional access sets requirements before granting tokens for access and authorization.

Governance

• Governance Solutions manages the lifecycle of a user.
• Onboarding, role changes, and offboarding should be monitored.
• Access reviews determine who has access to groups and applications.
• Privileged Identity Management (PIM) gives just-in-time access to roles.
• Identity Protection provides risk assessment for users and sign-in permissions.
• Management assesses permissions and validates what's needed.
• Microsoft Entra Private Access provides access to private resources in a private network.
• Internet access helps lock down services.
• Categories of Fully Qualified Domain Names (FQDN) can be used.
• Federation allows using identities against resources in another identity provider like Azure.
• Network perspective prevents distributed denial-of-service (DDoS) attacks with network or IP-level solutions.

Azure Firewall

• Azure Firewall provides a managed network appliance with layer 4 (Network) and layer 7 (Application) capabilities.
• HTTP, web application firewall for Azure Front Door (Global level) and Application Gateway (Regional).
• Virtual networks are isolated by default unless peered, which enables further segmentation using Network Security Groups (NSGs).
• NSGs are sets of rules governing traffic flow.
• Azure Virtual Network Manager allows central management using security admin rules that run before NSGs.
• The rules will funnel traffic that pass or bypass (always allow).

Azure Bastion

• Azure Bastion provides a managed jump box for accessing resources.
• Microsoft Defender for Cloud monitors cloud posture across different clouds.
• Built-in initiatives include the Microsoft cloud security baseline (free) and paid options.
• There are specific Defender plans for storage, containers, and key vaults, adding extra capabilities.
• Core-level features include just-in-time protection, adaptive network hardening, and adaptive applications.
• Security moves as far left as possible.

Microsoft Sentinel

• Sentinel gathers signals from agents (CIS logs and diagnostic settings).
• The signals from logs are collected in a log analytics workspace.
• The workspace can then run detection rules to investigate threats and automate responses.
• Microsoft Defender XDR is a comprehensive solution set across Office 365.
• It spans devices, endpoints, SaaS, cloud applications, on-premises, and hybrid identity.
• It looks for vulnerabilities across different services facing the internet.
• Threat intelligence includes six core principles of compliance control.
• Principles: transparency, security, legal protections, no content-based targeting, and benefits.
• The Service Trust Portal is a place to find different resources regarding compliance.
• Security Copilot is a large language model AI that assists across a range of services.
• Portals like the Immersive Portal offer a separate space to interact.

Microsoft Priva

• Microsoft Priva helps manage private personal data by discovering it.
• Limits its use, and helping users request access or removal.

Microsoft Purview

• Microsoft Purview offers governance, compliance, and data security solutions.
• It helps find data, classify it, protect it, prevent its loss, and govern its retention, deletion, and marking.
• Records management helps find policies to alert, triage, and manage legal holds.
• Purview eDiscovery helps find data and manage legal holds and audits.
• Compliance tools help search across Microsoft 365.