A global consulting firm is implementing a Zero Trust strategy. They want to ensure that all sensitive documents stored in Microsoft 365, Azure Storage, and their on-premises file shares are protected from unauthorized access, even if they are downloaded or shared outside the corporate network. The protection must travel with the data itself. Which technology best addresses this requirement?
- AMicrosoft Sentinel
- BMicrosoft Defender for Cloud Apps
- CAzure Information Protection (AIP)
- DMicrosoft Entra ID Governance
Show answer & explanationAnswer & explanation
Correct answer: C. Azure Information Protection (AIP)
Azure Information Protection (AIP) is a cloud-based solution that helps organizations classify, label, and protect their documents and emails by applying encryption, rights management, and visual markings. This protection travels with the data, ensuring it remains secure regardless of where it's stored or who it's shared with, directly meeting the stated requirement.
Why the other options are wrong
- A. Microsoft Sentinel is a cloud-native SIEM and SOAR solution for security analytics and threat intelligence, not for protecting individual documents.
- B. Microsoft Defender for Cloud Apps (formerly MCAS) is a CASB that provides visibility, control, and protection for cloud apps, but its primary function isn't to embed protection directly into documents.
- D. Microsoft Entra ID Governance (formerly Azure AD Identity Governance) manages identity lifecycle, access, and privileged access, not data protection at the document level.
Azure Information Protection (AIP)
A cloud-based solution that helps organizations classify, label, and protect their documents and emails. It applies encryption, rights management, and visual markings, ensuring that protection travels with the data itself, regardless of where it's stored or shared.
- Classifies, labels, and protects documents/emails
- Protection travels with the data
- Uses encryption and rights management
- Supports on-premises and cloud data
Memory trick: AIP puts a secure wrapper directly on your sensitive files.