Cloud security | Microsoft

Microsoft Entra - Core Role

The identity and access management gatekeeper. Answers: 'Who are you and what do you have access to?' (Formerly Azure AD).

Entra Conditional Access

The 'If / Then' engine. Evaluates signals (location, risk, device compliance) to block access or demand MFA.

Entra PIM (Privileged Identity Management)

Just-In-Time (JIT) access. Gives admins high-level power for a short window with manager approvals instead of permanent admin rights.

Entra Agent ID

Identity management and security policies applied specifically to autonomous AI agents and bots.

Entra Entitlement Management

Uses 'Access Packages' to bundle access to multiple apps, groups, and sites for internal users or contractors in one click.

Microsoft Defender - Core Role

Threat detection and posture management. The internal security guard walking around looking for bad configurations or active hackers.

Defender XDR

Protects workplace tools like endpoints (laptops/phones), email/Teams (Office 365), on-prem Active Directory, and cloud apps (CASB).

Defender for Cloud - CSPM (Posture Management)

The audit checklist. Scans Azure, AWS, and GCP configurations to calculate a Secure Score and find exposed storage or open ports.

Defender for Cloud - CWPP (Workload Protection)

Real-time threat detection for cloud servers (VMs), SQL databases, and storage accounts.

Azure AI Content Safety / Defender for AI

AI guardrail. Scans inputs and outputs on OpenAI models to block jailbreak prompts, prompt injections, and harmful generated text.

Microsoft Sentinel - Core Role

Cloud-native SIEM and SOAR (Control Tower). Collects logs from EVERYTHING (Microsoft, Cisco, AWS, Linux).

KQL (Kusto Query Language)

The search language used inside Microsoft Sentinel to query and hunt for threats across billions of log lines.

Sentinel Playbooks (Logic Apps)

Automated incident response workflows (SOAR) that can instantly block an IP or disable a compromised account without human intervention.

Microsoft Purview - Core Role

Data protection and governance. Puts an armored envelope around the data itself, regardless of where it travels.

Purview Sensitivity Labels

Encrypts and watermarks files based on content (e.g., 'CONFIDENTIAL'). If emailed externally, the file remains locked and encrypted.

Purview DLP (Data Loss Prevention)

Prevents accidental leaks by blocking users from typing credit card numbers or SSNs into web forms, chats, or unapproved apps.

Microsoft Intune

Mobile Device Management (MDM) and Mobile App Management (MAM). Ensures company laptops/phones are encrypted, compliant, and can be remotely wiped if lost.