Microsoft 365 plans and the Zero Trust model
Microsoft frames its cloud as several clouds plus one security model. The exam expects you to place each product in the right group and to explain Zero Trust in plain terms.
The Microsoft cloud
| Cloud | What it is | Examples |
|---|---|---|
| Microsoft 365 | Productivity, collaboration, security, device management | Teams, Outlook, SharePoint, Intune |
| Microsoft Azure | IaaS and PaaS platform | Virtual Machines, App Service |
| Dynamics 365 | Business apps (CRM and ERP) | Sales, Business Central |
| Power Platform | Low-code tools | Power BI, Power Apps, Power Automate, Copilot Studio |
Microsoft Entra ID (formerly Azure Active Directory) is the shared identity service across all of them.
What Microsoft 365 adds
Microsoft 365 combines Office apps, Windows, and Enterprise Mobility + Security capabilities. Office 365 is only the apps and services part. Windows Enterprise and the security tools come with Microsoft 365 E3 and E5, not with Office 365 plans.
Zero Trust principles
Zero Trust replaces the idea that anything inside the corporate network is safe. There are three principles:
- Verify explicitly: always authenticate and authorize based on all data points.
- Use least privilege access: limit access with just-in-time and just-enough access, and risk-based adaptive policies.
- Assume breach: design as if an attacker is already inside. Segment access, encrypt end to end and use analytics to detect threats.
Zero Trust pillars
Zero Trust is applied to six areas. Learn a Microsoft product for each.
- Identities: Microsoft Entra ID, multifactor authentication, Conditional Access.
- Endpoints (devices): Microsoft Intune, Microsoft Defender for Endpoint.
- Apps: Microsoft Defender for Cloud Apps.
- Data: Microsoft Purview, sensitivity labels, data loss prevention.
- Infrastructure: Microsoft Defender for Cloud, Azure policies.
- Network: Azure Firewall, network segmentation, encryption.
Defense in depth
Defense in depth uses layers: physical security, identity and access, perimeter, network, compute, application and data. If one layer fails, another still protects the asset.
Exam traps
- Microsoft Entra ID protects identities. Intune manages endpoints. Purview protects data. Do not swap them.
- Zero Trust is a strategy, not a single product you can buy.
- “Assume breach” is about limiting blast radius and detecting attacks, not about trusting internal users.
- Office 365 is not the same as Microsoft 365. Only the latter includes Windows and the security stack.
- Azure Active Directory is the old name of Microsoft Entra ID. The exam may use either.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. A security team wants to verify every request explicitly, regardless of where it comes from. Which Zero Trust principle is this?
Show answer
Answer: B.Verify explicitly means authenticate and authorize every request using all available signals such as identity, location and device health.
2. Giving users only the permissions they need for a limited time follows which principle?
Show answer
Answer: A.Least privilege uses just-in-time and just-enough access (for example Privileged Identity Management) to limit exposure.
3. Which service in the Microsoft cloud is a collection of productivity SaaS apps such as Teams, Exchange Online and SharePoint?
Show answer
Answer: B.Microsoft 365 bundles the productivity apps, security and device management. Azure is the IaaS/PaaS platform.
4. Which Zero Trust pillar covers Microsoft Entra ID and Conditional Access?
Show answer
Answer: B.Entra ID and Conditional Access protect the Identities pillar.