Design solutions that align with security best practices and priorities · Topic 2 of 4
MCRA, MCSB and Zero Trust Aligned Solutions
SC-100 frameworks: the MCRA, Microsoft Cloud Security Benchmark domains, Zero Trust principles, and insider, external and supply chain threats.
- 5 min
- Zero Trust: verify explicitly, least privilege, assume breach. Pillars: identity, endpoints, data, apps, infrastructure, network.
- MCRA is a set of reference diagrams. MCSB is a set of controls in twelve domains, measured by Defender for Cloud.
- Insider threats point to Insider Risk Management, DLP, UEBA and access reviews.
What it is
Three Microsoft frameworks anchor the design questions in this exam.
| Framework | What it gives you |
|---|---|
| Microsoft Cybersecurity Reference Architectures (MCRA) | A set of reference diagrams that show Microsoft's security capabilities and how they fit together and integrate with other tools |
| Microsoft Cloud Security Benchmark (MCSB) | Prescriptive security controls, grouped in domains, for Azure and multicloud, mapped to common standards |
| Zero Trust | A strategy and guiding principles: verify explicitly, use least privilege and assume breach |
Together they answer three different questions: what capabilities do we need (MCRA), what controls should each workload meet (MCSB) and how should access decisions be made (Zero Trust).
How it works
Zero Trust principles and pillars
| Principle | Meaning |
|---|---|
| Verify explicitly | Authenticate and authorize using all available signals: identity, location, device health, workload, data classification, anomalies |
| Use least privilege access | Limit access with just in time and just enough access, risk based adaptive policies and data protection |
| Assume breach | Minimize blast radius, segment access, verify end to end encryption, use analytics to detect and improve defenses |
Zero Trust is applied across technology pillars: identity, endpoints, data, applications, infrastructure and network, with visibility, automation and orchestration tying them together. The Zero Trust adoption framework helps organizations move in stages, organized around business scenarios such as rapidly modernizing the security posture, securing remote and hybrid work, preventing or reducing damage from a breach, identifying and protecting sensitive data, and meeting regulatory requirements. A Zero Trust assessment measures current maturity per pillar.
Microsoft Cybersecurity Reference Architectures
The MCRA is a library of diagrams, not a product. Use it to see which capabilities a complete program needs and which Microsoft services provide them: security operations (SIEM, XDR), identity and access, endpoint and device security, cloud workload and infrastructure protection, data protection and compliance, operational technology and IoT security, multicloud and cross platform coverage, and the way these cover the attack chain. It also shows people and process functions such as security organization roles. When a question asks which Microsoft capability covers a gap in a design, think "what does the MCRA place there".
Microsoft Cloud Security Benchmark
The MCSB provides security controls and recommendations for cloud workloads, mapped to industry frameworks such as CIS and NIST. Its control domains are:
| Domain | Focus |
|---|---|
| Network security | Segmentation, firewalls, DDoS, private connectivity |
| Identity management | Authentication, SSO, strong authentication |
| Privileged access | Admin accounts, just in time access, secure admin workstations |
| Data protection | Classification, encryption at rest and in transit, key management |
| Asset management | Inventory, approved services |
| Logging and threat detection | Central logs, detections |
| Incident response | Process, preparation, automation |
| Posture and vulnerability management | Configuration baselines, scanning, remediation |
| Endpoint security | EDR, anti malware |
| Backup and recovery | Backups, tested recovery |
| DevOps security | Threat modeling, pipeline security, supply chain |
| Governance and strategy | Roles, strategy, policy |
The benchmark also covers AI security guidance, so AI workloads are designed against the same domain approach: protect the data, the model endpoints, the identities and the network, and monitor for abuse. Microsoft Defender for Cloud measures compliance with the MCSB (it is the default standard assigned to subscriptions), shows a secure score and recommendations, and lets you track progress by control domain. Azure Policy provides the underlying checks.
Insider, external and supply chain attacks
| Attack | Typical defenses |
|---|---|
| Insider (malicious or careless people with access) | Least privilege and PIM, Microsoft Purview Insider Risk Management, DLP, sensitivity labels, Defender for Cloud Apps session controls, UEBA in Microsoft Sentinel, access reviews |
| External (attackers with no access) | MFA and Conditional Access, email and endpoint protection (Defender XDR), WAF and DDoS protection, patching, Defender External Attack Surface Management to find exposed assets, threat intelligence |
| Supply chain (compromised vendors, packages or build systems) | Vetting vendors and OAuth apps, app governance and consent controls, dependency and secret scanning (GitHub Advanced Security, Dependabot), Defender for DevOps, signed artifacts and software bills of materials, least privilege for third party access, separation of CI/CD credentials |
Putting the frameworks to work
- Use Zero Trust to set the principles every design must meet.
- Use the MCRA to check that capabilities are not missing.
- Use the MCSB to define per workload controls.
- Use Defender for Cloud (and Azure Policy) to measure and enforce.
A worked scenario
A retailer says its Zero Trust program is stuck at slogans. The architect runs an assessment, picks the "prevent or reduce business damage from a breach" scenario, uses the MCRA to find a missing capability (no XDR for endpoints), and sets MCSB control domains as the workload standard. Defender for Cloud then shows compliance by domain, and Azure Policy initiatives enforce the network security and data protection controls.
What to remember for the exam
- Zero Trust: verify explicitly, least privilege, assume breach. Pillars: identity, endpoints, data, apps, infrastructure, network.
- MCRA is a set of reference diagrams. MCSB is a set of controls in twelve domains, measured by Defender for Cloud.
- Insider threats point to Insider Risk Management, DLP, UEBA and access reviews.
- Supply chain threats point to vendor and app governance, dependency scanning and signed artifacts.
- External attack surface discovery is Defender External Attack Surface Management.
"Which framework describes the Microsoft capabilities and how they integrate?" is MCRA. "Which gives control recommendations to measure in Defender for Cloud?" is MCSB.
How the exam asks about this
- "Measure workloads against Microsoft's security controls." MCSB assessed in Defender for Cloud.
- "Which principle says to limit blast radius and encrypt end to end?" Assume breach.
- "Reduce the risk of data theft by a departing employee." Purview Insider Risk Management with DLP.
- "Reduce exposure to a compromised open source package." Dependency scanning, signed artifacts and controlled feeds.
Common mistakes
Treating MCRA as a checklist of products. It is reference architecture, to be adapted.
Mixing up MCSB and Zero Trust. One is controls, the other is strategy.
Only defending the perimeter. Zero Trust assumes the network is hostile.
Ignoring supply chain. Third party code and apps are part of the attack surface.
Check yourself
Which three principles define Zero Trust?
Verify explicitly, use least privilege access and assume breach.
Which Azure service measures compliance with the MCSB?
Microsoft Defender for Cloud.
Which Purview solution addresses risky behavior by users with legitimate access?
Insider Risk Management.
Topic 2 of 4 in Design solutions that align with security best practices and priorities
Test yourself on Design solutions that align with security best practices and priorities
The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.