Memory hook: Business impact → trust boundary → control → evidence.
Reviewed 10 October 2026. Read this once, then answer the last-pass checks without looking.
Scope/version: The published English exam update begins 21 October 2026. These notes include that upcoming AI/agent identity scope; check the outline matching your booking. This Microsoft security track complements the Azure collection.
Must remember by domain
| Domain | Rapid revision |
|---|---|
| Strategy/resilience | Prioritize threats to critical business services, then define RPO/RTO and accountable owners. Ransomware resilience combines privileged-access protection, patching, containment and independently protected recoverable backups. Restore identity, keys and dependencies as well as data. |
| Frameworks/adoption | MCRA maps security capabilities; Microsoft Cloud Security Benchmark supplies controls; Zero Trust verifies explicitly, limits privilege and assumes breach. CAF guides adoption/governance; Well-Architected evaluates workloads; landing zones implement scalable foundations. DevSecOps adds threat modeling, supply-chain controls and tested releases. |
| Operations/compliance | XDR correlates product signals; Sentinel broadens SIEM/SOAR and third-party evidence. Design source generation, ingestion, retention, roles and response together. Map ATT&CK Enterprise/Mobile/ICS coverage to real telemetry/tests. Purview, policy/compliance assessments and audit provide evidence; they do not independently determine legal compliance. |
| Identity/privilege | Separate workforce, external and workload identities. Use Conditional Access/risk/CAE appropriately, PIM for temporary privilege, access reviews for continued need and protected admin workstations for sensitive operations. Agent IDs need per-agent boundaries and owners. Hybrid AD hardening, secret/key lifecycle and emergency access remain essential. |
| Infrastructure/posture | CSPM identifies posture/attack paths; workload protection addresses service threats; EASM discovers internet-visible exposure. Endpoint baselines, Intune, LAPS, Defender and Arc have different roles. OT/ICS requires safety/availability-aware controls. Containers need image provenance, admission, runtime identity, network and monitoring beyond host security. |
| Network/SSE | Firewall, segmentation, DDoS and WAF protect different layers. Entra Internet Access supplies supported secure web access; Private Access supplies identity-aware private-app access. Verify DNS/routing and policy enforcement rather than assuming a private address means trusted traffic. |
| Apps/data/AI | Defender for Office 365 protects supported collaboration threats; Cloud Apps governs supported SaaS; Purview classifies/protects/retains data. Threat-model APIs and use managed identities, API Management and application authorization. TDE/TLS/client-side encryption meet different threats. Copilot/agents amplify existing permissions, so fix oversharing and enforce retrieval/tool boundaries. |
Architect's decision order and traps
Business outcome → likely threat and blast radius → current trust/permission boundaries → preventive/detective/recovery controls → ownership/evidence → validation and residual risk. Favor controls that actually interrupt the attack path. Secure Score is a prioritization measure, not risk eliminated. A WAF cannot reliably repair broken business authorization; a backup controlled by the compromised admin may not survive the attack.
Last-pass self-check
1. First ransomware design priority?
Identify critical services and ensure protected recovery plus privileged-access containment.
2. Which framework directly helps workload tradeoffs?
Azure Well-Architected; CAF/landing zones address broader adoption foundations.
3. How do you validate ATT&CK coverage?
Confirm telemetry, detections and representative tests, not merely mapped rule names.
4. Why clean source permissions before deploying AI search?
It makes existing overexposure easier to discover and exploit.
5. What distinguishes architect judgment from tool selection?
Justifying controls against business threats, dependencies, operational ownership and residual risk.
Sources
- Official exam scope and version
- Product documentation
- Product documentation
- Product documentation
- Product documentation
- Product documentation
Every topic at a glance
Open any topic to revisit its essential facts, decisions and exam traps. Use the full topic for active recall and supporting references.
01 · Business resilience and Zero Trust strategy
Memory hook: Protect the mission before optimizing the toolset.
Must remember
- Identify business-critical assets, likely threats, impact and recovery objectives before selecting controls. Prioritize ransomware resilience around recoverable backups, privileged-access protection, patching and containment.
- Zero Trust means verify explicitly, use least privilege and assume breach. It is an architectural approach spanning identities, devices, networks, applications, data and workloads, not one purchased appliance.
- Microsoft Cybersecurity Reference Architectures map security capabilities; the Microsoft Cloud Security Benchmark supplies control guidance. Use them to identify gaps and ownership, not as evidence that deployment is already compliant.
- Cloud Adoption Framework guides adoption/governance; Well-Architected evaluates workload tradeoffs; landing zones establish scalable identity, network, subscription and policy foundations.
- BCDR must include isolated/immutable recovery where appropriate, clean identity recovery, keys, dependencies and restoration tests. Backups controlled by the same compromised administrator can be at risk.
- Secure AI adoption adds model/tool identities, data boundaries, prompt-injection defenses, evaluation and human oversight. DevSecOps brings threat modeling, code/dependency checks and release controls into the development lifecycle.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| Budget is limited after a ransomware assessment | Prioritize critical recovery paths and privileged-access risks with measurable impact. |
| New cloud subscriptions appear inconsistently | Governed landing zones with policy and delegated ownership. |
Traps
- A high security score is not proof the business can recover.
- Zero Trust does not mean denying every request or trusting only an internal network.
02 · Identity, agents and privileged access
Memory hook: Identity is a boundary; privilege has an expiry.
Must remember
- Design workforce, external and workload identities separately. Entra ID, hybrid AD DS and B2B access have different lifecycle, authentication and trust requirements; decentralized identity addresses particular verification scenarios rather than replacing every account.
- Conditional Access combines user/workload context, device, risk and application requirements. Continuous access evaluation can improve supported revocation behavior; test emergency access and avoid blanket assumptions about token lifetime.
- Agent identities, including supported Entra Agent ID capabilities, need ownership, scope and policy. An agent should not inherit an unrestricted human administrator credential for every user request.
- Privileged Identity Management enables eligible/time-bound role activation with supported controls. Entitlement management and access reviews govern access packages and continued need; they are not substitutes for runtime authorization.
- Use the enterprise access model to protect administration across cloud tenants and on-premises systems. Secure privileged workstations, reduce standing privilege, harden AD DS and audit delegation.
- Manage secrets, keys and certificates with controlled lifecycle and recovery. Evaluate excessive cloud entitlements, external collaboration and dormant identities continuously, with accountable resource owners.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| Administrators need occasional production elevation | Eligible scoped roles through PIM with appropriate approval and audit. |
| An agent acts for many users | A dedicated constrained identity plus supported user-context authorization where required. |
Traps
- MFA does not make every endpoint or session trustworthy.
- An access review identifies continued need; it does not replace a resource’s permission checks.
03 · Security operations and compliance
Memory hook: Collect useful evidence; connect it to response.
Must remember
- Defender XDR correlates supported signals across security products; Sentinel provides SIEM/SOAR for broader data and workflows. Design source coverage, retention, access and response ownership together.
- Central logging includes cloud audit, identity, endpoints, applications and supported Purview Audit data. Data quality, time synchronization and ingestion health are prerequisites for detection.
- Map relevant threat behaviors to MITRE ATT&CK Enterprise/Mobile/ICS coverage. Rule count does not prove coverage; validate telemetry and detection with representative tests.
- Design triage, hunting, incident management, containment and escalation workflows. Automate reliable enrichment and low-risk actions; use explicit authorization for disruptive response.
- Translate regulations into control objectives, evidence, owners and review frequency. Purview supports data governance/compliance capabilities; Azure Policy governs supported resource configurations; Defender for Cloud evaluates supported posture/standards.
- Compliance reports are evidence inputs, not a universal legal conclusion. Include hybrid/multicloud resources and exceptions with documented risk acceptance.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| Need correlation across Microsoft endpoints and identities | Defender XDR, with required products and telemetry enabled. |
| Need broad third-party/cloud log correlation and automation | Sentinel with designed connectors, analytics and response workflows. |
Traps
- A policy assignment does not prove every resource was remediated.
- Passing a compliance dashboard check does not cover every process or legal requirement.
04 · Infrastructure, exposure and network security
Memory hook: Posture reduces exposure; protection detects abuse.
Must remember
- Defender for Cloud combines supported posture management and workload protection. Connect hybrid/multicloud resources through the appropriate integrations, including Azure Arc where relevant; verify plan/agent requirements.
- Secure Score, exposure management, attack paths and external attack-surface discovery help prioritize risk. Distinguish known inventory from internet-discovered assets and confirm ownership before remediation.
- Harden servers and clients with baselines, patching, endpoint protection and Windows LAPS. Use Intune/other supported management for devices; OT/ICS and IoT need specialized safety and availability constraints.
- Protect containers through trusted images, registry controls, admission/deployment policy, workload identity, runtime monitoring and network segmentation. A secure host does not automatically secure every container permission.
- SaaS, PaaS and IaaS have different shared-responsibility boundaries. Evaluate web, AI service, database and orchestration controls at the service’s actual exposed interfaces.
- Entra Internet Access addresses supported secure web access; Entra Private Access addresses access to private applications. SSE complements network design, firewalls, DDoS protection and private endpoints rather than eliminating all other controls.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| Unknown internet-facing assets may belong to the company | External attack-surface discovery followed by ownership validation. |
| Remote users need identity-aware private-app access | Evaluate Entra Private Access with application and device policies. |
Traps
- A posture score is a prioritization aid, not a guarantee of security.
- Aggressive scanning or patching can be unsafe for sensitive OT systems without operational coordination.
05 · Applications, Microsoft 365 and data protection
Memory hook: Classify the data; protect every path to it.
Must remember
- Use Defender for Office 365 for supported email/collaboration threats, Defender for Cloud Apps for supported SaaS visibility/control, Intune for device management and Purview for data/compliance controls. Evaluate overlap and required licensing rather than treating names as interchangeable.
- Microsoft 365 Copilot inherits access to organizational data through supported permissions. Overshared content remains a risk; classification, access cleanup, DLP and audit matter before and after AI adoption.
- Threat-model applications and APIs, protect the software supply chain, scan secrets/dependencies and enforce reviewed CI/CD. Managed/workload identities reduce static credentials but still need least privilege.
- API Management controls supported API exposure and policies; WAF addresses HTTP attack patterns; application code must still validate authorization and input. A WAF cannot reliably repair a broken business authorization model.
- Discover/classify data and choose encryption at rest/in transit with proper Key Vault/key custody. Protect Azure SQL, Cosmos DB, Synapse and Storage using service-specific identity, network, audit and threat-protection controls.
- AI data security includes authorized retrieval, tenant isolation, prompt/tool boundaries, safe logging and retention. Protect model endpoints and prevent tools from turning untrusted content into privileged actions.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| Copilot exposes a document to someone unexpectedly | Inspect the underlying sharing/permissions and data governance first. |
| An API allows one customer to read another’s record | Fix application authorization; do not rely solely on WAF signatures. |
Traps
- Encryption does not stop an authorized but overprivileged identity from reading data.
- A SaaS security product is only effective where the relevant integrations and policies are enabled.