Endpoint data loss prevention (Endpoint DLP), a feature in Microsoft Purview, supports Windows 10 and 11 and now also supports macOS for core DLP capabilities. It allows organizations to monitor and restrict actions like copying sensitive files to USBs, printing, or uploading to unapproved cloud services.
SCI Extract: "Endpoint DLP extends Microsoft Purview Data Loss Prevention to Windows 10, Windows 11, and macOS devices, allowing for monitoring and control of sensitive data usage at the endpoint." Other platforms like Linux, iOS, and Android are not currently supported for Endpoint DLP

The Microsoft Service Trust Portal contains details about Microsoft's implementation of controls and processes that protect our cloud services and the customer data therein.
Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/get-started-with-service-trust-portal?view=o365- worldwide

Explanation:

Microsoft's SCI/Learn content describes Azure AD (now Microsoft Entra ID) as a cloud service, not something you install on-premises. The docs state Azure AD is a "cloud-based identity and access management service" that "helps your employees sign in and access resources." This clarifies the third statement (IAM service) as Yes, and the first statement (on-premises deployment) as No, because the native on-prem directory is Windows Server Active Directory, whereas Azure AD runs in Microsoft's cloud and can be synchronized with on-prem AD via tools like Azure AD Connect.
Microsoft also explains licensing/availability: the service comes in several editions, and the free/Office 365 tier is included with many suites. The documentation explicitly notes that Azure AD is "included with subscriptions such as Microsoft 365" (formerly Office 365) and provides tenant-wide identity for those services. Therefore, stating that Azure AD is provided as part of a Microsoft 365 subscription is Yes.
In summary: Azure AD/Entra ID is a cloud identity and access management platform; it's not deployed on- premises, and Microsoft 365 subscriptions include an Azure AD tenant/edition to manage users, groups, apps, and access policies.

Explanation:

In Microsoft Sentinel, automation of routine or repetitive SOC tasks is delivered through playbooks.
Microsoft's Sentinel guidance defines playbooks as "collections of procedures that can be run from Microsoft Sentinel in response to an alert or incident." They are "built on Azure Logic Apps" and enable teams to
"automate and orchestrate responses to threats" such as enriching incidents, opening tickets, notifying responders, quarantining entities, or blocking indicators. The documentation further clarifies that automation rules can "trigger playbooks automatically based on analytics alerts or incident conditions," allowing consistent, scalable actions without manual intervention. By contrast, workbooks provide "data visualization and reporting" for analysis; hunting search-and-query tools (built on KQL) are used to "proactively hunt for threats"; and deep investigation tools assist analysts during incident investigation. Therefore, when the goal is to automate common tasks-for example, sending incident notifications, enriching with threat intelligence, or creating tickets in ITSM-the correct capability in Microsoft Sentinel is playbooks, because they encapsulate repeatable response procedures and can be executed automatically via automation rules or manually from incidents, alerts, or entities.

Microsoft Secure Score for Devices
* Artikel
* 12.05.2022
* 3 Minuten Lesedauer
Applies to:
* Microsoft Defender for Endpoint Plan 2
* Microsoft Defender Vulnerability Management
* Microsoft 365 Defender
Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
To sign up for the Defender Vulnerability Management public preview or if you have any questions, contact us ([email protected]).
Already have Microsoft Defender for Endpoint P2? Sign up for a free trial of the Defender Vulnerability Management Add-on.
Configuration score is now part of vulnerability management as Microsoft Secure Score for Devices.
Your score for devices is visible in the Defender Vulnerability Management dashboard of the Microsoft 365 Defender portal. A higher Microsoft Secure Score for Devices means your endpoints are more resilient from cybersecurity threat attacks. It reflects the collective security configuration state of your devices across the following categories:
* Application
* Operating system
* Network
* Accounts
* Security controls
Select a category to go to the Security recommendations page and view the relevant recommendations.
Turn on the Microsoft Secure Score connector
Forward Microsoft Defender for Endpoint signals, giving Microsoft Secure Score visibility into the device security posture. Forwarded data is stored and processed in the same location as your Microsoft Secure Score data.
Changes might take up to a few hours to reflect in the dashboard.
* In the navigation pane, go to Settings > Endpoints > General > Advanced features
* Scroll down to Microsoft Secure Score and toggle the setting to On.
* Select Save preferences.
How it works
Microsoft Secure Score for Devices currently supports configurations set via Group Policy. Due to the current partial Intune support, configurations which might have been set through Intune might show up as misconfigured. Contact your IT Administrator to verify the actual configuration status in case your organization is using Intune for secure configuration management.
The data in the Microsoft Secure Score for Devices card is the product of meticulous and ongoing vulnerability discovery process. It is aggregated with configuration discovery assessments that continuously:
* Compare collected configurations to the collected benchmarks to discover misconfigured assets
* Map configurations to vulnerabilities that can be remediated or partially remediated (risk reduction)
* Collect and maintain best practice configuration benchmarks (vendors, security feeds, internal research teams)
* Collect and monitor changes of security control configuration state from all assets