AB-900 Microsoft 365 Security Principles: Zero Trust, Authentication, Authorization and Defender XDR

The three Zero Trust principles are verify explicitly, use least privilege access and assume breach. Zero Trust replaces the old idea of a trusted corporate network with one rule: never trust a request because of where it comes from — always check it. A sign-in from inside the office is evaluated exactly like one from a café.

The principles are easy to confuse because a single control can touch more than one. Classify a control by its main purpose: checking an individual request (MFA plus a compliant device on every sign-in) is verify explicitly; sizing access to the task and time (an admin role active only for the hours it is needed, a contractor's access that expires with the contract) is least privilege; containing an intruder who has already got in (segmentation, encryption, detection analytics) is assume breach.

Zero Trust is a strategy, not a product. In Microsoft 365 it is put into practice by Microsoft Entra ID (identity and access), Microsoft Intune (device compliance), Microsoft Purview (data protection) and Microsoft Defender XDR (detection and response). Other well-known security models — layering several defenses, or splitting security duties between a cloud provider and its customer — are separate concepts, not Zero Trust principles.

Authentication proves who the caller is; authorization decides what that authenticated caller may do. In Microsoft 365, Microsoft Entra ID authenticates users and apps when they sign in, then each service checks permissions and roles to authorize every action.

A user who signs in successfully and then cannot open a SharePoint site has passed authentication and failed authorization. Recording what a caller did for later review, or trusting a partner's identity provider to sign users in, are related identity ideas, but neither of them decides whether a request is allowed.

Administrative authorization in Microsoft 365 works through role-based access control (RBAC): each built-in role grants a defined set of permissions, and you assign the narrowest role that covers the task — least privilege applied to administration. Global Administrator can do almost everything, so Microsoft recommends keeping it to a small number of people and using specific roles for daily work.

Read the requirement carefully: an auditor who must see every setting in the tenant without being able to alter any points to Global Reader; a service-desk analyst who only resets forgotten passwords for staff points to Password Administrator, because Helpdesk and User Administrator can also do it but grant more. Granting roles only when needed (just-in-time) is handled by Privileged Identity Management, covered in the core security features lesson; SharePoint site permissions are covered with the core objects of Microsoft 365.

Multifactor authentication (MFA) means proving identity with factors from at least two different categories:

• Something you know — a password, PIN or security-question answer.
• Something you have — a phone with the Microsoft Authenticator app, a FIDO2 security key, a hardware token, a smart card.
• Something you are — a fingerprint or face (biometrics).

The categories, not the number of prompts, are what count. A password plus a code from an authenticator app is MFA (know + have). Two things from the same category — a password followed by a memorized passphrase, say — are still single-factor, because both are something you know. Making a password longer or rotating it adds strength to one factor, not a second factor.

Microsoft Entra ID supports many methods: passwords, Microsoft Authenticator (push notifications, passkeys and passwordless sign-in), Windows Hello for Business, passkeys (FIDO2) on security keys or devices, certificate-based authentication, software and hardware OATH tokens, SMS and voice calls, and the Temporary Access Pass. Administrators choose which methods users may register in the Authentication methods policy.

Microsoft classes three method families as phishing-resistant: Windows Hello for Business, passkeys (FIDO2) — on security keys or in Microsoft Authenticator — and certificate-based authentication. They resist phishing because the credential is cryptographically bound to the real sign-in site and never leaves the device, so there is nothing a user can type or approve on a fake page that an attacker could replay.

This distinction matters against adversary-in-the-middle (relay) phishing: a fake page passes the user's password and one-time code to the real site in real time and steals the session cookie. MFA with codes, SMS or push does not stop it, because each of them produces something the fake page can relay. Only an origin-bound method such as a passkey does, because the key will not sign a challenge for the wrong site. Microsoft recommends phishing-resistant methods for administrators first.

A Temporary Access Pass (TAP) is a time-limited passcode an administrator issues in Microsoft Entra ID so a user can sign in when they have no usable credentials — typically to onboard and register a passwordless method such as a passkey or Windows Hello for Business, or to recover after losing their only method. It satisfies strong authentication requirements while it is valid.

The administrator sets the lifetime and whether the pass is one-time use or usable several times within that lifetime; the TAP method must be enabled in the Authentication methods policy. A TAP is not an everyday sign-in method. It differs from OATH tokens (which the user must already have registered) and from email one-time passcodes, which are used for guest access and self-service password reset rather than for bootstrapping an employee's first passkey.

Threat protection is the set of controls that prevent, detect and respond to attacks; threat intelligence is knowledge about attackers — their campaigns, tools, malicious URLs, files and infrastructure — that makes those controls smarter. Microsoft processes trillions of security signals a day from its cloud services, so a threat first seen at one customer can be blocked for every other customer.

You meet threat intelligence in two ways:

• Built into protection. When a phishing URL or malware file is identified in attacks against other organizations, Microsoft Defender for Office 365 can block it at a company that has never seen it — before delivery. The key idea is that the knowledge came from someone else's attack; controls that judge a message only by what it does in your own tenant are not this.
• As reports you read. Threat analytics in the Microsoft Defender portal publishes reports by Microsoft security researchers on active campaigns, threat actors and techniques, and shows your exposure: affected devices and mailboxes, related incidents, and which recommended mitigations are already in place. The capabilities of the former standalone Microsoft Defender Threat Intelligence product have been brought into the Defender portal.

Each Defender product protects one workload, and Microsoft Defender XDR unifies them. Match the asset in the scenario to the product:

Two Defender for Office 365 features are near-twins. Safe Links checks a URL at the time of click, so a site that turned malicious after delivery is still caught. Safe Attachments opens attachments in a sandbox (detonation) before delivery. Zero-hour auto purge acts on messages already delivered, and anti-spam policies filter bulk and junk mail at delivery.

Identity has two products: Defender for Identity watches the on-premises and hybrid identity servers (domain controllers, AD FS, AD CS, Entra Connect), while Entra ID Protection evaluates risk on cloud users and sign-ins. Entra ID Protection belongs to the Microsoft Entra family rather than Defender, but its risk signals feed into Defender XDR alongside the Defender products.

Microsoft Defender XDR (extended detection and response) is a unified suite, used in the Microsoft Defender portal, that correlates signals from the Defender products across endpoints, identities, email and collaboration, and cloud apps, and coordinates the response across all of them. Its main capabilities:

• Incidents. An alert is one detection from one product; an incident groups related alerts and evidence from several products into a single attack story, so analysts work one incident instead of dozens of alerts.
• Cross-product response. A detection in one product triggers action in another. For example, when Defender for Endpoint detects a malicious file on a laptop, Defender for Office 365 can remove copies of it from users' mailboxes. Actions confined to the laptop itself are Defender for Endpoint's own work, not cross-product response.
• Automated investigation and response (AIR). Investigates alerts and remediates affected assets — self-healing for mailboxes, devices and identities — with actions tracked in the Action center (pending approval or completed).
• Automatic attack disruption. Uses high-confidence signals from several workloads to contain an attack in progress — for example disabling a compromised user account or containing a device — without waiting for an analyst, to stop lateral movement in attacks such as human-operated ransomware or business email compromise.
• Advanced hunting. Lets analysts write custom queries in Kusto Query Language (KQL) over up to 30 days of raw endpoint, email, identity and cloud app data.
• Threat analytics. Microsoft research reports mapped to the organization's exposure (see above).

Defender XDR detects and responds to threats. It does not label documents or retain mailbox content (Microsoft Purview) and does not decide sign-in access (Microsoft Entra ID and conditional access, covered in the core security features lesson).