Most organisations now run a large share of their information, communication and systems in the Microsoft cloud. The first line of defence is therefore no longer the firewall but the identity, the device and the communication channel.

Microsoft security solutions such as Entra, Defender and Intune are designed to work together. They share information about threats and risk and make it possible to coordinate security controls and responses.

The first line of defence: Identity

Most attacks start with user identities, for example stolen passwords or phishing. Microsoft Entra ID provides authentication, access policies and protection for users, devices, apps and resources (What is Microsoft Entra?). Key capabilities include:

  • Multifactor authentication (MFA) and Conditional Access, which uses signals such as user, location, device and risk to make access decisions (What is Conditional Access?).
  • Blocking legacy authentication. According to Microsoft, more than 99% of password spray attacks use legacy authentication protocols, which do not support MFA (Block legacy authentication).
  • Microsoft Entra ID Protection and PIM. ID Protection detects identity-based risk, while PIM makes it possible to grant time-limited privileged access when it is needed. Both require Entra ID P2 (Microsoft Entra licensing).

In hybrid environments, Microsoft Defender for Identity collects signals from domain controllers and detects threats such as privilege escalation and high-risk lateral movement (Microsoft Defender for Identity deployment overview).

The second line of defence: Endpoints

Microsoft Defender for Endpoint combines preventative protection, post-breach detection, automated investigation and response (Microsoft Defender for Endpoint on Windows). It protects against malware and detects threats on endpoints. As part of Microsoft Defender XDR, automatic attack disruption can automatically take action against an active attack, for example by isolating devices or restricting user access (Automatic attack disruption).

With Intune, the risk assessment from Defender for Endpoint can be connected to Conditional Access. If a device's risk exceeds the defined threshold, Intune and Conditional Access can block access to company data until the risk has been resolved (Conditional Access with Defender for Endpoint).

The third line of defence: Email and collaboration

Every mailbox in Exchange Online has baseline protection against spam, malware and spoofing. However, each organisation must configure SPF, DKIM and DMARC for its own domains (Email authentication in cloud organizations).

Microsoft Defender for Office 365 adds Safe Links, which verifies links at the time of click, and Safe Attachments, which analyses unknown attachments in an isolated environment before they are delivered. Defender for Office 365 also protects Teams, SharePoint and OneDrive (Microsoft Defender for Office 365 overview).

Securing Azure infrastructure

Microsoft Defender for Cloud assesses the security posture of cloud environments in Azure, AWS and Google Cloud and presents it through Secure Score, among other things. The baseline assessment (Foundational CSPM) is free of charge. With dedicated Defender plans, workloads such as virtual machines, containers and databases can also be protected (What is Microsoft Defender for Cloud?).

When everything works together

Microsoft Defender XDR brings together signals, alerts, investigations and responses from the Defender solutions into a shared security environment, so that security teams see one complete picture instead of many disconnected alerts (What is Microsoft Defender XDR?).

This is the essence of Zero Trust, which is built on three principles: verify explicitly, use least privilege access and assume breach (Zero Trust security in Azure).

Where to start?

  • Is MFA enabled for all users, including administrators?
  • Is legacy authentication blocked?
  • Are company devices onboarded and protected with Defender for Endpoint and Intune?
  • Are SPF, DKIM and DMARC configured for all domains?
  • Is someone monitoring alerts outside business hours?

Technology alone is not enough

The systems can detect threats and respond to some of them automatically, but someone still needs to monitor, prioritise alerts, investigate and make decisions. This is where a SOC (Security Operations Center) plays a key role (Plan for Microsoft Defender XDR operations readiness). Without active monitoring, important alerts can go unnoticed, even when an organisation has invested in strong security solutions.

At Wise, we offer Skýjavakt 365 for organisations that want active monitoring of security incidents. The service uses security solutions that in many cases are already part of an organisation's Microsoft 365 licences. Get in touch for an assessment of your environment.

Sources

All sources are from learn.microsoft.com.