Design security solutions for applications and data
Microsoft 365 Security Architecture
CoreEvaluate identity, device, threat, SaaS, data-governance, and Copilot controls as one Microsoft 365 protection model measured by risk-relevant posture evidence.
Aligned to SC-100 skills measured as of October 21, 2026; candidates testing earlier should review the transition note in the lane overview.
Why this matters
Productivity data is reached through users, devices, applications, sharing, email, agents, and AI grounding. An architect must join preventive controls with threat detection, data governance, posture measurement, and incident response without treating a score as the objective.
Must Know
- Microsoft Secure Score recommends posture improvements across supported Microsoft security controls; risk owners should prioritize actions by exposure, impact, feasibility, and compensating safeguards.
- Defender for Office 365 protects collaboration and messaging from threats, while Defender for Cloud Apps adds SaaS discovery, app governance, session controls, and cloud-app visibility.
- Intune governs device and application configuration, compliance, enrollment, and selective data protection; its signals can influence Conditional Access.
- Microsoft Purview secures Microsoft 365 data through sensitivity labels, data loss prevention, insider-risk and compliance capabilities, audit, retention, and eDiscovery according to the scenario.
- Microsoft 365 Copilot honors the user's existing permissions, making oversharing remediation, labels, DLP, audit, retention, risky-AI monitoring, and agent governance central design concerns.
- Copilot data security requires understanding prompts, responses, grounding, plugins or agents, web use, retention, audit, and how Purview and Defender controls apply.
Compare and Distinguish
- Secure Score identifies recommended control improvements; it does not prove that a specific user, document, or incident is safe.
- Defender for Office 365 addresses email and collaboration threats, while Purview governs sensitive information and compliance outcomes.
Scenario examples
- Scenario: Copilot reveals information users can already reach but should not broadly access. Think: discover oversharing, correct permissions, classify and label data, apply DLP, and monitor AI interactions rather than blocking all Copilot use.
- Scenario: Unmanaged devices need browser-only access to selected SaaS data. Think: combine identity policy, Defender for Cloud Apps session controls, and Purview data protection instead of marking the device compliant.
Exam traps
- A rising Secure Score does not replace threat modeling, exception review, or outcome validation.
- Copilot does not create permission to inaccessible Microsoft 365 content, but existing excessive access can amplify discovery and exposure.
Key takeaways
- Secure Score is decision input; it is not the business unit's risk-acceptance threshold.
- Microsoft 365 protection joins session, device, messaging, application, and data controls.
- Copilot readiness begins with source permissions and ownership, then adds AI-era evidence.
How it works
- Signals from identity, devices, messaging, cloud apps, and data policies feed posture and incident processes in Microsoft security portals.
- Copilot retrieves content within the requesting user's permissions, while Purview controls and audit add governance around data and interactions.
Objects and administrative surfaces
- Defender portal incidents and posture, Secure Score actions, Defender for Office policies, Cloud Apps connectors, app governance, and Conditional Access App Control.
- Intune compliance and app protection, Purview labels and DLP, DSPM for AI, Audit, retention, Copilot interaction evidence, and sharing controls.
When to use it
- Use this integrated model when collaboration, SaaS, endpoint, and AI access share Microsoft 365 identities and data.
Security and governance implications
- Assign posture actions to control owners, govern label and DLP changes, and require Copilot deployment readiness criteria with measurable remediation.
Troubleshooting signals
- If DLP behaves inconsistently, inspect location scope, label conditions, policy precedence, user context, and supported Copilot surface.
- If session controls do not apply, verify app support, Conditional Access targeting, Defender for Cloud Apps integration, and browser path.
More detail
- Evaluate Secure Score in business-risk context.
- Select Defender, Intune, and Purview capabilities for their distinct control boundaries.
- Design data security and compliance controls for Microsoft 365 Copilot.
Ready for the quiz?
- Which control addresses risky SaaS sessions from unmanaged devices?
- How would you reduce Copilot oversharing without disabling the service?
- Why can two equal Secure Score improvements have different risk value?
Related objectives
- D4.1.S1 — Evaluate security posture for productivity and collaboration workloads by using metrics, including Microsoft Secure Score
- D4.1.S2 — Evaluate solutions that include Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps
- D4.1.S3 — Evaluate device management solutions that include Microsoft Intune
- D4.1.S4 — Evaluate solutions for securing data in Microsoft 365 by using Microsoft Purview
- D4.1.S5 — Evaluate data security and compliance controls in Microsoft 365 Copilot