Design security solutions for infrastructure · Topic 3 of 6
Securing Servers, Clients, IoT and OT Endpoints
SC-100 endpoints: baselines, Defender for Servers, Intune compliance and app protection, Windows LAPS, and Defender for IoT for OT networks.
- 6 min
- Servers: Defender for Servers, baselines via Azure Machine Configuration and Policy, Trusted Launch, JIT access, update management.
- Clients: Intune compliance, security baselines, Defender for Endpoint, BitLocker and FileVault, LAPS, app protection for BYOD.
- Windows LAPS gives a unique, rotated local admin password per device, stored in Entra ID or AD.
What it is
An endpoint is any device that connects to your resources: a Windows server, a Linux VM, a laptop, a phone, a camera, a sensor or an industrial controller. Securing endpoints means specifying requirements for each kind: a hardened baseline, protection against threats, management to keep it that way, and detection and response when something goes wrong.
The exam gives you a device population and asks which requirements and Microsoft products fit.
How it works
Servers across platforms
| Requirement | Solution |
|---|---|
| Detect and respond to threats on servers | Defender for Servers with Defender for Endpoint on Windows Server and Linux, in Azure, other clouds and on premises through Azure Arc |
| Find and fix vulnerabilities | Defender Vulnerability Management (included in Defender for Servers), agentless scanning |
| Hardened configuration baseline | Microsoft Cloud Security Benchmark, CIS benchmarks and security baselines, enforced and audited with Azure Machine Configuration and Azure Policy |
| Secure boot and integrity | Trusted Launch (secure boot, vTPM, boot integrity monitoring) for Azure VMs, and Confidential VMs for data in use protection |
| Disk encryption | Encryption at host, server side encryption with customer managed keys, or Azure Disk Encryption |
| Management port exposure | Just in time VM access, Azure Bastion, no public RDP or SSH |
| Detect unauthorized change | File integrity monitoring |
| Patching | Azure Update Manager |
| Application control | App allow lists with Windows Defender Application Control or AppLocker, and Linux equivalents |
| Local administrator passwords | Windows LAPS |
Requirements differ by operating system, so specify them per platform: Windows Server, Linux distributions and containers hosts each have their own baselines and agents. Keep one management plane (Arc and Defender for Cloud) so that mixed fleets are covered consistently.
Clients and mobile devices
Microsoft Intune with Microsoft Entra ID manages and secures clients.
| Requirement | Solution |
|---|---|
| Enroll and manage | Intune enrollment, Windows Autopilot, Entra join, Apple and Android enrollment methods |
| Compliance | Device compliance policies (encryption on, OS version, no jailbreak, Defender health, risk level). Conditional Access can require a compliant device |
| Configuration baselines | Security baselines for Windows and Microsoft Edge, and endpoint security policies for antivirus, firewall, disk encryption and attack surface reduction |
| Endpoint protection | Defender for Endpoint (EDR) on Windows, macOS, Linux, iOS and Android, with attack surface reduction (ASR) rules, tamper protection and web protection |
| Disk encryption | BitLocker (Windows) and FileVault (macOS) with recovery keys escrowed to Entra ID |
| Credential protection | Credential Guard, Windows Hello for Business, Windows LAPS |
| Application control | App control for Business (WDAC), and Smart App Control |
| Corporate data on personal devices | App protection policies (MAM) that encrypt and control data inside managed apps, with selective wipe, without full device management |
| Mobile threat defense | Defender for Endpoint on mobile, or a partner mobile threat defense connector, feeding device risk to Conditional Access |
Windows LAPS automatically manages and rotates the local administrator password on each device and stores it in Microsoft Entra ID or Active Directory. Each machine has a unique password, which blocks lateral movement with a shared admin credential, and retrieval is controlled by role and audited.
A security baseline is a set of recommended settings that you deploy and then monitor for drift. Define baselines per device type, test with a pilot group, roll out in rings and measure compliance.
IoT devices and embedded systems
IoT devices are often unmanaged, long lived and hard to patch. Specify:
- Unique device identity with X.509 certificates or TPM attestation, using IoT Hub and the Device Provisioning Service, never shared or default credentials.
- Secure boot and signed firmware, with a way to deliver updates (for example Azure IoT Hub device update).
- Network segmentation so devices reach only what they must, and encrypted transport (TLS).
- Least privilege for the cloud side: per device authorization, private connectivity to IoT Hub.
- Monitoring for anomalous behavior with Defender for IoT and Defender for Cloud.
Operational technology and industrial control systems
Operational technology (OT) and industrial control systems (ICS) run factories, utilities and buildings. They use specialized protocols, cannot always be patched or scanned actively, and failures can affect safety. Microsoft Defender for IoT provides agentless network detection.
| Component | Role |
|---|---|
| Network sensors | Passive monitoring of mirrored traffic (SPAN or TAP) using deep packet inspection of OT protocols, with no impact on the process. Deployed on premises, as a physical or virtual appliance |
| Asset discovery | Builds an inventory of devices from traffic |
| Detections | Vulnerabilities, unauthorized devices, protocol anomalies and known threats, mapped to the MITRE ATT&CK for ICS matrix |
| Integration | Alerts to Microsoft Sentinel and Defender XDR, so IT and OT incidents are correlated, and an on premises management console for isolated sites |
Specify network segmentation between IT and OT (the Purdue model layers), restrict remote access with just in time and monitored channels, and avoid active scanning on fragile devices.
Choosing quickly
| Requirement | Answer |
|---|---|
| Detect threats on Linux and Windows servers in Azure and AWS | Defender for Servers |
| Prevent a stolen admin password working on every laptop | Windows LAPS |
| Ensure only compliant devices reach Microsoft 365 | Intune compliance with Conditional Access |
| Protect corporate email on personal phones without enrolling them | App protection policies |
| Monitor an industrial network without disruption | Defender for IoT agentless sensors |
A worked scenario
A manufacturer has Windows and Linux servers across plants, laptops, personal phones for managers and PLCs on the factory floor. The architect specifies Defender for Servers through Arc with MCSB baselines, Intune compliance and security baselines with LAPS, app protection policies for the managers' phones, and Defender for IoT sensors at each plant feeding Sentinel, with segmentation between the IT and OT networks.
What to remember for the exam
- Servers: Defender for Servers, baselines via Azure Machine Configuration and Policy, Trusted Launch, JIT access, update management.
- Clients: Intune compliance, security baselines, Defender for Endpoint, BitLocker and FileVault, LAPS, app protection for BYOD.
- Windows LAPS gives a unique, rotated local admin password per device, stored in Entra ID or AD.
- IoT: unique identities, secure boot, signed updates, segmentation. OT: Defender for IoT agentless sensors using SPAN or TAP.
- Defender for IoT maps to MITRE ATT&CK for ICS and integrates with Sentinel.
"Monitor industrial controllers without installing anything on them" is Defender for IoT network sensors.
How the exam asks about this
- "Block access from devices that are not encrypted." Intune compliance policy and Conditional Access.
- "Protect company data in Outlook on unmanaged personal phones." Intune app protection policies.
- "Verify that servers still match the hardened baseline." Azure Machine Configuration or Policy compliance.
- "Detect rogue devices on an OT network." Defender for IoT asset discovery and detections.
Common mistakes
Active scanning of OT devices. It can disrupt processes. Use passive monitoring.
One baseline for all platforms. Windows, Linux and mobile differ.
Shared local admin passwords. Use LAPS.
Managing BYOD with full device control. App protection policies are lighter.
Check yourself
Which tool provides unique rotated local administrator passwords?
Windows LAPS.
How does a Defender for IoT sensor see OT traffic?
Passively, through a SPAN port or network TAP.
Which Intune feature protects corporate data in apps on unmanaged devices?
App protection policies.
Topic 3 of 6 in Design security solutions for infrastructure
Test yourself on Design security solutions for infrastructure
The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.