AB-900 lesson 4: security operations basics

Security operations in Microsoft 365 comes down to five jobs: detect attacks across products (Microsoft Defender XDR), measure identity posture (Identity Secure Score), investigate what happened (audit logs), limit powerful roles (Privileged Identity Management), and control applications in the tenant (app registrations and enterprise applications). Each job has its own tool, and the exam asks which one fits.

Threat protection and threat intelligence

Microsoft Defender XDR joins signals from several Defender products, including Defender for Endpoint (devices), Defender for Office 365 (email and collaboration), Defender for Identity and Entra ID Protection (identities) and Defender for Cloud Apps (applications). Instead of showing many separate alerts, it groups related alerts into one incident in the Microsoft Defender portal, with the affected assets and evidence attached. It can take automatic action, such as automatic attack disruption, which contains in-progress attacks using high-confidence signals from several workloads, and it supports advanced hunting with queries across the collected data. Defender XDR correlates signals only from the products the organisation has licensed and set up.

Threat intelligence is knowledge about attackers, their techniques and indicators of compromise. It does not protect by itself; it feeds detections and helps analysts judge whether an alert matters. The topic page Defender XDR vs Defender for Cloud shows where Defender XDR stops and cloud workload protection begins.

Identity Secure Score

Identity Secure Score is a percentage that shows how closely a tenant’s identity configuration follows Microsoft’s recommendations. It is recalculated periodically, so a change does not show up instantly. Each improvement action, such as requiring MFA for administrative roles, blocking legacy authentication, or designating more than one Global Administrator, awards points fully or partly. The score is found in the Microsoft Entra admin center (Identity Secure Score, or the Recommendations page filtered to security). Two points matter: it measures adoption of recommended features, not the likelihood of being breached, and an action can be marked as planned, risk accepted or resolved by a third party. It is also the identity part of the wider Microsoft Secure Score in the Defender portal.

Audit logs for user and admin activity

Two log families answer “who did what”.

Audit (Standard) is on by default and keeps records for 180 days; Audit (Premium) extends retention, for example to one year for Exchange, SharePoint, OneDrive and Entra records by default. Entries in the Entra audit logs cannot be changed or deleted.

Privileged Identity Management

PIM removes permanent administrator access. Administrators are made eligible for a role and activate it only when needed, for a limited time, with options such as MFA, a business justification and approval by a designated approver. An active assignment has no activation step. This supports the Zero Trust principle of least privilege and makes admin use traceable. PIM needs Microsoft Entra ID P2 or an equivalent governance licence, and only a Privileged Role Administrator or Global Administrator manages assignments for other admins. See Privileged Identity Management for the activation flow.

App registrations vs enterprise applications

When an application connects to Entra ID, two related objects exist. The app registration is the application’s definition, created by whoever builds or owns the app: its identity, redirect addresses and the permissions it asks for. The enterprise application is the instance of that application in your tenant, where an admin controls access: assign users and groups, configure SSO, and review permissions that were consented to. An app from the Entra gallery appears as an enterprise application without anyone registering it. Choose the registration to define an app, the enterprise application to govern who uses it.

Worked example: a 300-person company after a suspicious week

A 300-person company notices that a sales director’s account triggered several alerts in one afternoon: a risky sign-in, a phishing email, and an unusual file download. In the Defender portal, the alerts are already grouped in one incident, so the security admin sees the full story rather than three tickets. The admin asks who changed the director’s mailbox rules and which admin reset the password, which is a question for the audit log in Purview. Afterwards, the company reviews Identity Secure Score and sees that administrator roles lack MFA, so a conditional access policy follows. Finally, three IT staff who held Global Administrator permanently become eligible in PIM instead. A new HR application purchased from the gallery appears under Enterprise applications, where the admin assigns it to the HR group only.

Easy to confuse

Key points

• Defender XDR groups related alerts from several products into incidents and can respond automatically.
• Threat intelligence informs detection; it is not a control on its own.
• Identity Secure Score measures adoption of recommended identity settings, not breach probability.
• Purview Audit covers activity across services; Entra audit logs cover directory changes.
• PIM gives just-in-time, time-limited, approval-based role activation.

Check yourself

This lesson closes domain one of the course, which carries 30 to 35% of the exam. The recap page Microsoft 365 core features explained summarises the same ground, and the cheat sheet lists the tool for each task.