Microsoft 365 and Azure
In today's digital landscape, the utilization of cloud solutions has become increasingly prevalent, with organizations frequently opting for either Software-as-a-Service (SaaS) offerings to facilitate collaborative activities or Cloud computing solutions. These cloud-based options offer unparalleled convenience and seamless integration for both end users and IT teams, effectively alleviating the burden of infrastructure management.
However, it is crucial to recognize that even though Microsoft 365 and Azure ease the burden of managing underlying infrastructure, they demand careful consideration in terms of exposure, attack surface, and potential malicious activities. To address these concerns, Microsoft provides a plethora of settings and tools designed to assist companies in achieving compliance and attaining an optimal level of security. As a professional working in this field, it is essential to comprehend the capabilities offered by these platforms and learn how to effectively leverage them.
Before delving deeper into the security aspects of the Microsoft cloud environment, it is imperative to address a commonly asked question that arises during my work: What sets Microsoft 365, Azure, and Entra ID (formerly Azure AD) apart from one another? Understanding the distinctions between these platforms will serve as a solid foundation for exploring the security considerations inherent to the Microsoft cloud ecosystem.
Know the difference
Microsoft Azure is the cloud computing service provided by Microsoft.
It allows organization to access, store and manage a multiple range of data on Microsoft services to suit needs :
- Virtual Machines (IaaS)
- App Services and other PaaS
- Containers and Kubernetes
- Microsoft Entra ID (formerly Azure Active Directory), but more on that later
- External Identities
- B2C, now part of Entra External ID
- Microsoft Entra Domain Services (formerly AADDS)
- Entra ID Protection (formerly Azure AD Identity Protection)
- Entra Privileged Identity Management (PIM)
- Firewall, WAF & Load Balancers
- DNS
- CDN
- Several DB services and Azure datalake
- Blob, Table and queue services for example
- Automation & functions
- Application Insight
- Azure Devops
- Azure OpenAI and the other AI services to build your own applications and agents
About cloud computing
This list is not exhaustive but offers a better understanding of what is Azure Cloud computing.
Azure also provide specific security services such as Microsoft Defender For Cloud or Identities related services, onpremises integration to monitor and manage infrastructures and Active Directory.
To access Azure cloud computing ressources, you need to have a subscription. A subscription is a logical container to host create ressources and process the associated billing. These subscriptions have at least one trust relationship with an Entra ID (formerly Azure Active directory) instance. This allows to authenticate, authorize security principals and devices access.
Microsoft 365 is a cloud based (SaaS) platform that regroups productivity, collaboration and communication tools available to user anywhere, anytime. It also offers multiple way to manage devices, compliance and security and support the administrators and decision makers to reach their objectives.
- Office applications
- Collaboration and employee experience platform (Microsoft Viva, Viva Engage formerly Yammer, and more)
- Microsoft 365 Copilot, the AI assistant integrated in the apps
- Onedrive and Sharepoint
- Native Email and collaboration security
- Data protection and governance
- Unified detection, investigation and response accross identities, email, devices and applications
- MDM (Mobile Device Management) with Intune
- Microsoft Teams
As a special note regarding the security capabilities of Microsoft 365 with the Microsoft Defender portal (Defender XDR, formerly Microsoft 365 Defender). It offers a wide range of capabilities and observability along the kill chain from email to post compromise action on a device or Active Directory activities.
Microsoft Sentinel can now be onboarded in the same portal, so the SIEM and the XDR share the same incidents and the same hunting (KQL).
Part of Microsoft Entra, the identity and multicloud access platform, Entra ID (formerly Azure AD) is the focus point for authentication and authorization accross Microsoft platforms like Azure and Microsoft 365. As said for Azure, subscription access is linked to a trusted Entra ID instance and for Microsoft 365, Entra ID enables the creation of users and manage the access to all ressources accross the platform.
This cloud based service empowers users to access cloud ressources, Microsoft or third party SaaS applications. It is also a service that grant IT administrator fine grained control regarding access, audit and protect identities and credentials while meeting with global business requirements. Entra ID integrate modern authentication workflows such as OpenID Connect (OIDC), including Oauth2.0, or SAML (Security Assertion Markup Language) to access underlying data accross the Microsoft ecosystem.
The Entra family also grew around it: ID Governance, External ID, Global Secure Access (Internet Access and Private Access) and, more recently, Agent ID for the identities of AI agents.
Security platforms
These cloud services offer a wide range of capabilities but can they can be not used or put aside due to lack of knowledge or misunderstanding within IT Teams and decision makers. Regarding the specifics of cybersecurity, you'll find below a mind map to help you understand the main cybersecurity tools across Microsoft Cloud services.
You'll tell me that's quite a lot of tools, but there's fewer consoles to manage them that you can think of. For example, the Microsoft Defender portal hosts most of the security process and settings related to Microsoft 365. Regarding Azure, Defender for cloud can be integrated with Defender for Endpoint, allowing a unified management of ressources between differents endpoints.
For starter and to help reference most of the links to access Azure and Microsoft 365 consoles, you may bookmark this website made by Merill Fernando, a senior product manager @ Microsoft :
Anyway, as practices makes perfect, I would recommend reviewing your Microsoft 365 and Azure consoles at work or if you have yourself a dedicated tenant. Also, There is a great deal of contents from webinar, documentations to formations and certifications to help you with mastering Microsoft. For this matter, you can take a look at Microsoft Learn learning path and documentations.
Going further
On this blog, I propose some specific use cases throughout my articles, some related to cloud and some other personal projects that matters to me.
To go further on the topic, you can check out the M365 attack matrix and related investigations and hardening posts available there.
To keep learning and becoming a real Microsoft ninja, you can always check these awesome ressources and training courses :
References
https://learn.microsoft.com/en-us/entra/fundamentals/whatis
https://techcommunity.microsoft.com/t5/azure-developer-community-blog/the-azure-solution-architect-map/ba-p/689700
https://learn.microsoft.com/en-us/defender-xdr/microsoft-365-defender
https://learn.microsoft.com/en-us/azure/sentinel/microsoft-sentinel-defender-portal