Microsoft Security, Compliance, and Identity Fundamentals (SC-900)

Provides managed domain services in Azure, including domain join, LDAP, Kerberos, and NTLM authentication, compatible with traditional Windows Server Active Directory.

• Managed domain controllers for Azure workloads
• Supports legacy authentication protocols (LDAP, Kerberos, NTLM)
• No need to deploy/manage VMs for domain controllers

Measures taken to protect the underlying networking infrastructure and network traffic from unauthorized access, misuse, malfunction, modification, destruction, or improper disclosure.

• Includes firewalls, intrusion detection/prevention systems, VPNs.
• Focuses on controlling traffic flow and securing network devices.
• Aims to prevent network-based attacks.

A decentralized identity solution that allows organizations to issue and verify digital credentials, enabling individuals to control their identity data and securely prove information to relying parties.

• Based on open standards (Decentralized Identifiers, Verifiable Credentials).
• Users control their identity data.
• Enables trusted, privacy-preserving identity verification.

A security model where no user or device is inherently trusted, regardless of whether they are inside or outside the network perimeter. All access requests are explicitly verified.

• Never trust, always verify.
• Assumes breach.
• Requires explicit verification for every access attempt.

A security principle where a user or process is granted only the minimum access rights needed to perform its function.

• Reduces the attack surface.
• Limits potential damage from breaches.
• Fundamental to secure system design.

The capability within Microsoft Entra ID that allows organizations to manage access to all applications (cloud-based and on-premises) by integrating them with Entra ID for authentication, authorization, and centralized user experience.

• Centralizes application access control
• Supports various authentication protocols (SAML, OIDC, password SSO)
• Enables Single Sign-On (SSO) for integrated apps

A comprehensive strategy and set of technologies for identifying, classifying, labeling, and protecting sensitive data throughout its lifecycle.

• Discovers sensitive data across disparate sources.
• Applies labels and encryption based on sensitivity.
• Helps comply with data privacy regulations.

The process by which Microsoft Entra ID verifies a user's identity to grant access to resources.

• Enables single sign-on (SSO) for cloud applications.
• Supports various methods like password, MFA, passwordless.
• Centralizes identity verification for Microsoft cloud services.

A regulation in EU law on data protection and privacy for all individuals within the European Union and the European Economic Area.

• Mandates strict rules for processing personal data.
• Grants individuals rights over their data (e.g., right to access, erasure).
• Applies to any organization processing EU citizens' data, regardless of location.

A security feature that evaluates specific conditions (e.g., user, location, device, risk) to determine if and how a user can access a resource.

• Enforces policies based on real-time conditions.
• Can block access, require MFA, or limit capabilities.
• Integrates with identity providers and device management.

A service that helps manage, control, and monitor access to important resources in Microsoft Entra ID, Azure, and other Microsoft Online Services, by providing just-in-time, time-bound, and approval-based access.

• Minimizes standing privileged access ('zero standing access').
• Enforces time-bound access, requiring re-activation after expiration.
• Can require MFA and business justification for role activation.

The process of recording and reviewing events and actions within a security system to maintain a log of activity, crucial for accountability and forensic analysis.

• Tracks user actions and system events.
• Provides a trail for accountability and non-repudiation.
• Essential for compliance and security investigations.

A system that allows users to authenticate with one identity provider and gain access to resources managed by other service providers without needing to create separate credentials for each service. It establishes trust between disparate identity systems.

• Enables single sign-on across different organizations.
• Relies on trusted identity providers.
• Simplifies user access and reduces credential sprawl.

A Microsoft Entra ID feature that provides secure remote access to on-premises web applications. It acts as a reverse proxy, allowing users to access internal apps from anywhere without a VPN.

• Publishes on-premises web apps to be accessible from outside the corporate network.
• Integrates with Microsoft Entra ID for authentication and Conditional Access.
• Supports various authentication methods including Kerberos (via KCD).

The process of converting information or data into a code to prevent unauthorized access, making it unreadable without the correct key.

• Protects data at rest and in transit.
• Essential for confidentiality.
• Uses algorithms and keys to scramble/unscramble data.

A centralized, hierarchical database that stores information about network resources and users, enabling efficient management and access control.

• Examples include Active Directory and Azure Active Directory.
• Provides a single source of truth for user identities.
• Facilitates authentication and authorization across an organization's resources.

A framework of policies and technologies for ensuring that the right individuals and things have the right access to the right resources at the right time and for the right reasons.

• Manages user identities and their access privileges.
• Includes authentication, authorization, and user lifecycle management.
• Central to modern security strategies.

A security system that requires users to provide two or more verification factors to gain access to a resource.

• Enhances security by requiring multiple proofs of identity.
• Combines different types of authentication factors (e.g., something you know, something you have, something you are).
• Significantly reduces the risk of unauthorized access.

A governance capability that enables organizations to manage identity and access lifecycle at scale, by automating access requests, approvals, provisioning, and de-provisioning.

• Delegates access management to business owners.
• Manages access to groups, applications, and SharePoint sites.
• Automates access lifecycle (request, approval, review, expiration).

The principle of ensuring that data is accurate, complete, and trustworthy, and has not been altered or destroyed in an unauthorized or accidental manner.

• Protects against unauthorized modification or deletion.
• Ensures data accuracy and consistency.
• Crucial for reliable decision-making and compliance.

A passwordless authentication standard that uses public-key cryptography and physical security keys to provide strong, phishing-resistant authentication for web services.

• Uses asymmetric cryptography (public/private key pairs)
• Offers phishing resistance
• Compatible with various devices and platforms

A security system that requires users to provide two or more verification methods to gain access to a resource, significantly enhancing security.

• Adds an extra layer of security beyond just a password.
• Common verification methods include phone calls, text messages, or authenticator apps.
• Helps protect against credential theft and unauthorized access.

A feature of Microsoft Entra ID that allows you to invite external users (guests) to your Microsoft Entra tenant to access your applications and resources, while they sign in with their own identities.

• Supports identities from other Microsoft Entra tenants, social providers (Google, Facebook), or email one-time passcodes.
• Simplifies sharing resources with partners, vendors, and contractors.
• Guest users are managed within your Microsoft Entra tenant.

An identity governance feature that enables organizations to efficiently manage group memberships, access to enterprise applications, and privileged role assignments.

• Automates periodic review and certification of access.
• Reviewers can be group owners or business users.
• Can automatically remove access for unapproved users.