4
Microsoft's cybersecurity The four pillars
Identity, threats, monitoring and data: four platforms that work together, deployed and tuned for your business.
Identity & access management
Microsoft Entra
The identity foundation: Entra ID (formerly Azure AD) for authentication, plus ID Governance, Verified ID, and External ID. It handles MFA, conditional access, and Zero Trust access policies. Microsoft is currently making passkeys the default sign-in experience to push toward phishing-resistant authentication.
Entra IDMFAConditional accessZero TrustPasskeys
Threat protection (XDR)
Microsoft Defender
The detection-and-response layer covering endpoints, email, identity, and cloud apps. The Defender XDR family includes Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, Defender for Cloud (Azure workloads), and Vulnerability Management.
EndpointOffice 365IdentityCloud AppsCloudVulnerability Mgmt
SIEM / SOAR
Microsoft Sentinel
The cloud-native security information and event management platform that pulls signals across Microsoft, multicloud, on-premises, and third-party systems for broader visibility. Microsoft is repositioning it as a more central "agentic defense platform." It's consumption-priced based on data ingestion.
Cloud-native SIEMMulticloudOn-premisesConsumption-priced
Data security, governance & compliance
Microsoft Purview
Where Entra focuses on access and Defender on threats, Purview focuses on the data itself: classification, sensitivity labels (Public / Internal / Confidential / Highly Confidential), data loss prevention, insider risk, and compliance retention.
Sensitivity labelsDLPInsider riskRetention