Microsoft security architecture

Security permissions are used to control access to individual elements of the program: menus, menu items, action and command buttons, reports, service operations, web URL menu items, web controls, and fields in the Finance and Operations client. Individual security permissions are combined into privileges, and privileges are combined into duties. The administrator grants security roles access to the program by assigning duties and privileges to those roles.

Context-based security controls access to securable objects. When a privilege is associated with an entry point such as a menu item or a service operation , a level of access, such as Read or Delete , is specified. The authorization subsystem detects the access at run time, when that entry point is accessed, and applies the specified level of access to the securable object that the entry point leads to.

This functionality helps to ensure that there is no over-permissioning, and the developer gets the access that was intended. For more information, see Role-based security. Overview of endpoint detection and response capabilities. Behavioral blocking and containment capabilities can help identify and stop threats, based on their behaviors and process trees even when the threat has started execution.

Behavioral blocking and containment. Automated investigation uses various inspection algorithms based on processes that are used by security analysts and designed to examine alerts and take immediate action to resolve breaches. Use automated investigations to investigate and remediate threats. Advanced hunting is a query-based threat-hunting tool that lets you explore up to 30 days of raw data so that you can proactively inspect events in your network to locate threat indicators and entities.

Overview of advanced hunting. Threat analytics is a set of reports from expert Microsoft security researchers covering the most relevant threats. Track and respond to emerging threats. Because of our early and deep commitment to secure development, we were able to quickly conform to ISO after it was released. We also reorganized windows security icons and text to reflect that Windows Defender ATP describes all the platform capabilities working together to prevent, detect, and automatically respond and recover to attacks.

We faded the intranet border around these devices because of the ongoing success of phishing, watering hole, and other techniques that have weakened the network boundary. Updated SOC section — We moved several capabilities from their previous locations around the architecture into the Security Operations Center SOC as this is where they are primarily used.

This move enabled us to show a clearer vision of a modern SOC that can monitor and protect the hybrid of everything estate. We retained the visual of extranets and intranets spanning on-premises datacenters and multiple cloud provider s. Organizations see Infrastructure as a Service IaaS cloud providers as another datacenter for the intranet generation of applications, though they find Azure is much easier to manage and secure than physical datacenters.

We also added Azure Stack capability that allows customers to securely operate Azure services in their datacenter. While the attacks and defenses for this area are still evolving quickly, Microsoft continues to invest deeply to provide security for existing and new deployments of Internet of Things IoT and Operational Technology OT.

This browser is no longer supported. Download Microsoft Edge More info. Contents Exit focus mode.