Core Features and Objects of Microsoft 365 Services · Topic 4 of 6
Zero Trust, Authentication and Defender XDR
AB-900 security principles: Zero Trust, authorization, authentication methods and passwordless sign in, threat protection and Defender XDR basics.
- 5 min
- Zero Trust: verify explicitly, use least privilege access, assume breach.
- Authentication proves identity. Authorization grants permissions.
- MFA and passwordless methods are stronger than a password alone. SMS is among the weaker second factors.
What it is
Microsoft 365 security rests on a few ideas. Zero Trust is the overall approach: trust nothing by default. Authentication proves who you are, and authorization decides what you may do. Threat protection finds and stops attacks, using threat intelligence from Microsoft. Microsoft Defender XDR brings the alerts from those protections into one place.
How it works
Zero Trust principles
Zero Trust replaces the old idea of a trusted internal network. It has three principles.
| Principle | Meaning |
|---|---|
| Verify explicitly | Always check identity, device, location and risk before allowing access |
| Use least privilege access | Give only the access needed, only when needed, using just in time and just enough access |
| Assume breach | Design as if an attacker is already inside, so limit damage and watch everything |
Zero Trust applies to identities, devices, apps, data, infrastructure and networks.
Authentication and authorization
Authentication answers "who are you?" Authorization answers "what may you do?" Authentication happens first. A user who signs in with a password and a code is authenticated. Whether that user can read a SharePoint site or reset passwords is authorization, controlled by roles and permissions.
Authentication methods
Microsoft Entra ID supports several methods. A stronger method uses something other than a password alone.
| Method | Notes |
|---|---|
| Password | The weakest on its own |
| Microsoft Authenticator | Approve a sign in on a phone, or use a one time code. Can be passwordless |
| Passkeys (FIDO2) | A security key or device based credential that resists phishing |
| Windows Hello for Business | Sign in to Windows with a PIN or biometric, tied to the device |
| Certificate based authentication | Sign in with a certificate |
| SMS or voice call | Works, but is considered weaker than app based methods |
| OATH tokens | Hardware or software tokens that show a changing code |
| Temporary Access Pass | A time limited code an admin issues to set up other methods |
Multifactor authentication (MFA) asks for two or more kinds of proof: something you know, something you have and something you are. Passwordless methods, such as Authenticator, passkeys and Windows Hello for Business, remove the password altogether and are the strongest choice. Security defaults are a free set of basic settings that include requiring MFA for admins and users.
Threat protection and intelligence
Threat protection means stopping and finding attacks. In Microsoft 365 it is delivered by the Defender products, each covering one area.
| Product | Protects |
|---|---|
| Defender for Office 365 | Email and collaboration, with features such as Safe Links, Safe Attachments and anti phishing |
| Defender for Endpoint | Laptops, phones and servers |
| Defender for Identity | On premises Active Directory and identity attacks |
| Defender for Cloud Apps | Cloud apps and shadow IT |
Threat intelligence is knowledge about attackers, tools and tactics that Microsoft collects from signals across its services. It feeds these products so they can recognize new attacks quickly. Threat analytics reports in the Defender portal explain active threats and tell you what to do.
Microsoft Defender XDR
Microsoft Defender XDR is the extended detection and response service that combines signals from the Defender products. It is managed in the Microsoft Defender portal at security.microsoft.com.
Its main capabilities:
- Incidents and alerts: related alerts are combined into one incident, so an analyst sees the whole attack and not scattered warnings.
- Automated investigation and response: the service can investigate alerts and take actions, which an admin approves in the Action center when needed.
- Advanced hunting: search raw data across products to look for threats.
- Threat analytics: reports on current threats and how exposed you are.
- Microsoft Secure Score: a score of your security posture, with recommended actions.
A worked example
A user receives a phishing email and clicks the link. Defender for Office 365 raises an alert for the email, Defender for Endpoint raises an alert for the unusual process on the laptop, and Defender for Identity flags a strange sign in. Defender XDR joins the three into one incident. The security team opens the incident in the Defender portal, sees the full story and approves the suggested actions to isolate the device and reset the password.
How the exam asks about this
- "Which Zero Trust principle says to give only the access needed?" Use least privilege access.
- "Which service correlates alerts from email, endpoints and identities into incidents?" Microsoft Defender XDR.
- "Which authentication method removes the need for a password?" Passwordless methods such as Microsoft Authenticator, passkeys or Windows Hello for Business.
What to remember for the exam
- Zero Trust: verify explicitly, use least privilege access, assume breach.
- Authentication proves identity. Authorization grants permissions.
- MFA and passwordless methods are stronger than a password alone. SMS is among the weaker second factors.
- Defender for Office 365 protects email, Endpoint protects devices, Identity protects Active Directory.
- Defender XDR joins alerts into incidents in the Defender portal.
Authentication and authorization are not the same. Signing in successfully does not mean the user is allowed to do everything.
Common mistakes
Calling Zero Trust a product. It is a strategy, put into practice with many products and policies.
Treating Defender XDR as a single antivirus. It correlates and responds across several Defender products.
Believing MFA means a longer password. MFA adds a different kind of proof, not just a bigger secret.
Check yourself
What are the three Zero Trust principles?
Verify explicitly, use least privilege access and assume breach.
What is the difference between authentication and authorization?
Authentication proves who you are. Authorization decides what you are allowed to do.
What does Microsoft Defender XDR add on top of the individual Defender products?
It combines their alerts into incidents and offers investigation, response, hunting and threat analytics in one portal.
Topic 4 of 6 in Core Features and Objects of Microsoft 365 Services
Test yourself on Core Features and Objects of Microsoft 365 Services
The full Microsoft AB-900 question bank has 499 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.