Additional References: 💡 [Track changes to system files and registry keys](https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview) 💡 [Connect Microsoft Defender for Cloud alerts to Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-defender-for-cloud) 💡 [Deploying and Managing Microsoft Defender for Cloud as Code](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/deploying-and-managing-microsoft-defender-for-cloud-as-code/ba-p/3649653) 💡 [Collect data in custom log formats to Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-custom-logs?tabs=DCG) 💡 [Azure Monitor Agent overview - Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview) 💡 [Use entity behavior analytics to detect advanced threats](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics) |\r\n| | 2.4 Remote Access | Microsft Entra ID Microsft Entra ID Conditional Access (CA) Microsoft Intune Microsoft Defender for Endpoint (MDE) | 💡 [Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡 [Conditional Access APIs and PowerShell - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-apis) 💡 [Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) 💡 [Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance) 💡 [Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) 💡 [Configure Conditional Access in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) 💡 [Enhance security with the principle of least privilege](https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-least-privileged-access) 💡 [Best practices for Azure AD roles](https://learn.microsoft.com/en-us/azure/active-directory/roles/best-practices) 💡 [Least privileged roles by task in Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/roles/delegate-by-task) |\r\n| | 2.5 Partially & Fully Automated Asset, Vulnerability and Patch | Microsoft Intune Microsoft Endpoint Configuration Manager (MECM) Mircosoft Defender for Endpoint (MDE) Threat & Vulnerability Management (TVM) Azure Arc-enabled Servers Azure Automation | 💡 [What is Windows Update for Business?](https://learn.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb) 💡 [Update rings for Windows 10 and later policy in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-10-update-rings?source=recommendations) 💡 [Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure) 💡 [Deploy software updates with Configuration Manager](https://learn.microsoft.com/en-us/mem/configmgr/sum/deploy-use/deploy-software-updates) 💡 [Use Intune to remediate vulnerabilities identified by Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/mem/intune/protect/atp-manage-vulnerabilities) 💡 [Remediate vulnerabilities (Defender for Endpoint)](https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-remediation?view=o365-worldwide) 💡 [Choose how to deliver updates for the Microsoft 365 Apps](https://learn.microsoft.com/en-us/deployoffice/fieldnotes/choose-how-to-deliver-updates) 💡 [Windows Release Health](https://learn.microsoft.com/en-us/windows/release-health/) 💡 [Manage updates and patches for your VMs](https://learn.microsoft.com/en-us/azure/automation/update-management/manage-updates-for-vm) 💡 [Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) |\r\n| | 2.6 Unified Endpoint Management (UEM) & Mobile Device Management (MDM) | Microsoft Intune Azure Arc-enabled Servers Azure Autiomation | 💡 [What is Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/what-is-intune) 💡 [Manage your devices and control device features in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-devices) 💡 [Zero Trust with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/zero-trust-with-microsoft-intune) 💡 [Supported operating systems and browsers in Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/supported-devices-browsers) 💡 [Enrollment guide: Microsoft Intune enrollment](https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment) 💡 [Manage iOS/iPadOS software update policies in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-ios) 💡 [Manage macOS software update policies in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-macos) 💡 [Microsoft Intune How-To Guides](https://learn.microsoft.com/en-us/mem/intune/#how-to-guides) 💡 [What is Azure Arc-enabled servers?](https://learn.microsoft.com/en-us/azure/azure-arc/servers/overview) 💡 [Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) |\r\n| | 2.7 Endpoint & Extended Detection & Response (EDR & XDR) | Microsoft 365 Defender Microsoft Defender for Endpoint (MDE) Microsoft Defednder for Identity (MDI) Microsoft Defender for Office 365 (MDO) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 💡 [What is Microsoft Defender for Endpoint?](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide) 💡 [Zero Trust with Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/zero-trust-with-microsoft-defender-endpoint?view=o365-worldwide) 💡 [What is Microsoft 365 Defender?](https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender?view=o365-worldwide) 💡 [Zero Trust with Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/zero-trust-with-microsoft-365-defender?view=o365-worldwide) 💡 [Overview of endpoint detection and response (EDR) with Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response?view=o365-worldwide) 💡 [Implement Microsoft Sentinel and Microsoft 365 Defender for Zero Trust](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) 💡 [Manage endpoint detection and response (EDR) policy for endpoint security in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-edr-policy) 💡 [Set up your XDR tools](https://learn.microsoft.com/en-us/security/operations/setup-xdr-tools) 💡 [Architect your Microsoft Sentinel workspace](https://learn.microsoft.com/en-us/security/operations/siem-workspace) 💡 [Ingest data sources and configure incident detection in Sentinel](https://learn.microsoft.com/en-us/security/operations/ingest-data-sources) 💡 [Respond to an incident using Microsoft Sentinel and Microsoft 365 Defender](https://learn.microsoft.com/en-us/security/operations/respond-incident) |\r\n| Application & Workload 3.x | | | |\r\n| | 3.1 Application Inventory | Entra ID Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) Microsoft Intune | 💡 [Cloud Discovery Setup](https://learn.microsoft.com/en-us/defender-cloud-apps/set-up-cloud-discovery) 💡 [Deploy Intune Softare inventory & Security Policies](https://learn.microsoft.com/en-us/answers/questions/67892/can-we-use-intune-to-inventory-software-on-devices) 💡 [Configure Blocking Unwanted or Unapproved Applications](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus?view=o365-worldwide) 💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) 💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) 💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) 💡 [Active Directory Federation Services Health](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-health-adfs) 💡 [Azure Active Directory Application Audit](https://github.com/jsa2/AADAppAudit#azure-ad-application-analytics-solution) 💡 [Azure Active Directory Application Proxy](https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/what-is-application-proxy) 💡 [Using Microsoft Defender for Cloud Asset Inventory](https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory) 💡 [Working with Discovered Apps](https://learn.microsoft.com/en-us/defender-cloud-apps/discovered-apps) 💡 [Software Inventory](https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-software-inventory?view=o365-worldwide) |\r\n| | 3.2 Secure Software Development & Integration | Azure Policy Microsoft Defender for Cloud (MDfC) Microsoft Defender for Endpoint (MDE) | 💡 [DoD CIO DevSecOps with IaC & Microsoft](https://dodcio.defense.gov/Portals/0/Documents/Library/DoDRefDesignCloudGithub.pdf?ver=zXJ_uO5LfouVaysHo5Ejsw%3d%3d) 💡 [Microsoft Secure DevSecOps](https://www.microsoft.com/en-us/securityengineering/sdl/) 💡 [Application Security & DevSecOps Security](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/organize/cloud-security-application-security-devsecops?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=eb8cd3d8eb27486d87bbb4d96d996220) 💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) 💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) 💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) 💡 [Azure AI Content Moderator API Security](https://learn.microsoft.com/en-us/azure/ai-services/content-moderator/overview) |\r\n| | 3.3 Software Risk Management | Microsoft Defender for Cloud Apps (MDA) Mircosoft Defender for Endpoint (MDE) Threat & Vulnerability Management (TVM) Microsoft Intune | 💡 [Manage and Secure Apps In Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-apps) 💡 [App Protection Policies in Intune](https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy) 💡 [Microsoft Container Registry](https://mcr.microsoft.com/) 💡 [GitHub Actaion For Vulnerability Scanning](https://github.com/marketplace/actions/anchore-container-scan) 💡 [Code Scanning with CodeQL](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql) 💡 [Keeping your supply chain secure with Dependabot](https://docs.github.com/en/code-security/dependabot) 💡 [Secure Supply Chain Consumption Framework](https://www.microsoft.com/en-us/securityengineering/opensource/osssscframeworkguide) 💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) 💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) 💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) |\r\n| | 3.4 Resource Authorization & Integration | Entra ID Conditional Access (CA) Entra ID Application Proxy Azure Policy Entra ID Privilleged Identity Management (PIM) Microsoft 365 Defender Microsoft Intune Microsoft Defender for Cloud (MDfC) | 💡 [Deploy Microsoft Defender for Cloud - Enterprise Cloud Application Protection](https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction) 💡 [Configure Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/en-us/download/details.aspx?id=54431) 💡 [Deploying Application & Authorization Azure App Services](https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization) 💡 [How to create and deploy a custome Authorization Manager](https://learn.microsoft.com/en-us/dotnet/framework/wcf/extending/how-to-create-a-custom-authorization-manager-for-a-service) 💡 [Configure with Entra Identity Platform](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow) 💡 [How-to Manage Apps Remove User Access with Entra](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/methods-for-removing-user-access) 💡 [Setup Protecting Apps w. Entra Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps) 💡 [Role Based Access Control Configuration with Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control) |\r\n| | 3.5 Continuous Monitoring and Ongoing Authorizations | Entra ID - Conditional Access (CA) Microsoft Defender for Cloud Apps (MDA) Microsoft Senitnel Playbooks Entra ID - Privileged Identity Management (PIM) | 💡 [How-to-Build a Successful App Security Program](https://www.microsoft.com/en-us/security/blog/2021/03/29/how-to-build-a-successful-application-security-program/) 💡 [Setting up Hybrid Continuous Monitoring with Sentinel](https://learn.microsoft.com/en-us/azure/architecture/hybrid/hybrid-security-monitoring) 💡 [Deploy Adaptive Appliation Conrols Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls) 💡 [Configure Azure Security Management & Monitoring](https://learn.microsoft.com/en-us/azure/security/fundamentals/management-monitoring-overview) 💡 [Leverage Security Baselines for M365 Apps Enterprise](https://learn.microsoft.com/en-us/deployoffice/security/security-baseline) 💡 [Utilize Application Control for Windows](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/wdac) |\r\n| Data 4.x | | | |\r\n| | 4.1 Data Catalog Risk Alignment | Purview Data Catalog Purview Data Map Microsoft Sentinel | 💡 [Create a Azrure Data Catalog](https://learn.microsoft.com/en-us/azure/data-catalog/data-catalog-get-started) 💡 [Use the Service Catalog](https://learn.microsoft.com/en-us/system-center/scsm/service-catalog?view=sc-sm-2022) 💡 [Azure Data Catalog FAQ](https://learn.microsoft.com/en-us/azure/data-catalog/data-catalog-frequently-asked-questions) 💡 [Establishing Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) 💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) 💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Set up Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) 💡 [Discover Data & Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) |\r\n| | 4.2 DoD Enterprise Data Governance | Purview Data Governance Purview Data Estate Insights Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 💡 [Implement Microsoft Purview - IRM & Compliance - DoD Deployments](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) 💡 [Implement a Data Governance Maturity Model Framework](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) 💡 [Deploy Azure Data Governance](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) 💡 [Leverage Microsoft Defender for For Cloud Goverance Rules](https://learn.microsoft.com/en-us/azure/defender-for-cloud/governance-rules) 💡 [Implement Purview Data Governance](https://learn.microsoft.com/en-us/purview/?view=o365-worldwide) 💡 [Purview Data Lineage Machine Learning](https://learn.microsoft.com/en-us/samples/microsoft/purview-machine-learning-lineage-solution-accelerator/purview-machine-learning-lineage-solution-accelerator/) 💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Azure Collaboration Governance](https://learn.microsoft.com/en-us/microsoft-365/solutions/collaboration-governance-overview?view=o365-worldwide) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) 💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/en-us/azure/azure-sql/database/sql-insights-overview?view=azuresql) 💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) |\r\n| | 4.3 Data Labeling and Tagging | Purview Information Protection | 💡 [Create Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) 💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) 💡 [Deploy with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Utilize Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) 💡 [Use the Service Catalog](https://learn.microsoft.com/en-us/system-center/scsm/service-catalog?view=sc-sm-2022) |\r\n| | 4.4 Data Monitoring and Sensing | Purview Data Loss Protection (DLP) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) Microsoft Sentinel | 💡 [Leverage Data Monitoring & Self Healing](https://learn.microsoft.com/en-us/compliance/assurance/assurance-monitoring-and-self-healing) 💡 [Deploy Microsoft 365 Monitorning](https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-monitoring?view=o365-worldwide) 💡 [Senitnel Data Collection Best Practices](https://learn.microsoft.com/en-us/azure/sentinel/best-practices-data) 💡 [Deploy Microsoft Purview](https://learn.microsoft.com/en-us/purview/purview) 💡 [Utilze Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Configure Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) 💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/en-us/azure/azure-sql/database/sql-insights-overview?view=azuresql) |\r\n| | 4.5 Data Encryption & Rights Management | Purview Data Loss Protection (DLP) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) | 💡 [Utilize Azure Encrption](https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview) 💡 [Deploy Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Deploy Purview Information Protection](https://learn.microsoft.com/en-us/purview/information-protection) 💡 [Configure Dynamic Key & Encrption Delivery](https://learn.microsoft.com/en-us/azure/media-services/latest/drm-content-protection-concept) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) |\r\n| | 4.6 Data Loss Prevention (DLP) | Purview Data Loss Protection (DLP) Purview Information Protection | 💡 [Implement Data Loss & Prevention (DLP)](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp) 💡 [Informaiton Protection & Data Loss and Prevention- GITHUB LAB](https://microsoft.github.io/ComplianceCxE/dag/mip-dlp/) 💡 [Deploy Adaptive Protection- Data Loss & Protections](https://learn.microsoft.com/en-us/purview/dlp-adaptive-protection-learn) 💡 [Apply Rules for DLP Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/data-loss-prevention/dlp-rule-application) 💡 [Utilize Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) |\r\n| | 4.7 Data Access Control | Microsoft Defender for Cloud Apps (MDA) Entra ID Conditional Access (CA) Purview Insider Risk Management Purview Information Protection Purview Data Loss Prevention (DLP) Microsoft Intune | 💡 [Configure Conditional Access in Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview) 💡 [Use Conditional Access Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) 💡 [Use Conditional Access APIs](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-apis) 💡 [Deploy Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access#deploy-conditional-access-policies) 💡 [Use Conditional Access With Data Explorer](https://learn.microsoft.com/en-us/azure/data-explorer/security-conditional-access) 💡 [Deploy Common Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common?tabs=secure-foundation) 💡 [Build Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policies) |\r\n| Network & Environment 5.x | | | |\r\n| | 5.1 Data Flow Mapping | Azure Monitor Net Insights Network Watcher Microsoft Defender for Endpoint (MDE) | 💡 [Use Data Flow Mapping Power Platform](https://learn.microsoft.com/en-us/power-query/dataflows/create-use) 💡 [User Azure Network Traffic Analytics](https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics) 💡 [Azure Blue Print ](https://learn.microsoft.com/en-us/azure/governance/blueprints/overview) 💡 [Leverage Azure Data Visualization with Data Explorer](https://learn.microsoft.com/en-us/azure/data-explorer/viz-overview) 💡 [Use Power Automate for Event Tagging](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-microsoft-flow?view=o365-worldwide) 💡 [Secure & Govern Workloads with Network-level Segmentation](https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/network-level-segmentation) 💡 [Deploy Software Defined Netoworking](https://learn.microsoft.com/en-us/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) 💡 [Manage Software Defined Netoworking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/manage-sdn) 💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) |\r\n| | 5.2 Software Defined Networking (SDN) | Secure Access Service Edge (SASE) Microsoft Network Secuirty Groups (NSG) Entra ID App Proxy | 💡 [Use Secure Access Service Edge SASE - Software Defined Networking Zero Trust](https://www.microsoft.com/en-us/security/business/security-101/what-is-sase) 💡 [Software Defined Network Monitoring using Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/software-defined-monitoring-using-automated-notebooks-and-azure/ba-p/2587775) 💡 [Plan Software Defined Netoworking](https://learn.microsoft.com/en-us/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) 💡 [Implementing Software Defined Networking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/) 💡 [Manage Software Detined Netoworking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/manage-sdn) 💡 [Deploy Software Defined Networking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/deploy/deploy-a-software-defined-network-infrastructure-using-scripts) 💡 [Secure the Network Controller](https://learn.microsoft.com/en-us/azure-stack/hci/manage/nc-security) 💡 [SDN for Win Server 2019 and 2022](https://learn.microsoft.com/en-us/windows-server/networking/sdn/sdn-whats-new) 💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) 💡 [IPV6 Config Interface](https://learn.microsoft.com/en-us/javascript/api/%40azure/arm-databoxedge-profile-2020-09-01-hybrid/ipv6config?view=azure-node-latest&wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Leverage IPV6 for Azure Virtual Networks](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Segementation Security Strategies](https://learn.microsoft.com/en-us/azure/well-architected/security/design-segmentation) 💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) 💡 [Utilize Microsoft Packet Monitor](https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon) |\r\n| | 5.3 Macro Segmentation | Azure Subscription Azure VNet(s) Azure VNet Manager Network Security Groups (NSG) Azure Firewall | 💡 [Impletment Network Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) 💡 [Azure Features for Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation#azure-features-for-segmentation) 💡 [Segementation Security Strategies](https://learn.microsoft.com/en-us/azure/well-architected/security/design-segmentation) 💡 [Network Service Designs](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.HybridNetwork%2Fpublishers%2Fnetworkservicedesigngroups) 💡 [Network Watcher](https://portal.azure.com/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) |\r\n| | 5.4 Micro Segmentation | Azure Security Groups (ASG) Entra ID App Proxy Microsoft Tunnel | 💡 [Enabling JIT Access Controls](https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Conditional Access Block Access by Location](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-location?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Secure Networks with Zero Trust](https://learn.microsoft.com/en-us/security/zero-trust/deploy/networks) 💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation?wtmc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Microsoft Packet Monitor](https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon) |\r\n| Automation & Orchestration 6.x | | | |\r\n| | 6.1 Policy Decision Point (PDP) & Policy Orchestration | Entra ID Conditional Access (CA) Azure Policy Azure Automation Azure ML Azure Firewall Microsoft Sentinel | 💡 [Visibility,Automation and Orchestration with Zero Trust](https://learn.microsoft.com/en-us/) 💡 [Azure Orchestration for Azure Security Policy](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/azure-policy-security-baseline) 💡 [Configuration Analyzer for Security Policies](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies?view=o365-worldwide) 💡 [Azure Automation Overview](https://learn.microsoft.com/en-us/azure/automation/overview) 💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/automation-security-baseline) 💡 [Azure Policy](https://learn.microsoft.com/en-us/azure/governance/policy/overview) 💡 [What is Azure Firewall?](https://learn.microsoft.com/en-us/azure/firewall/overview) 💡 [Apply Zero Trust principles to a hub virtual network in Azure](https://learn.microsoft.com/en-us/security/zero-trust/azure-infrastructure-networking) 💡 [Management of Role Permissions and Automation](https://learn.microsoft.com/en-us/azure/automation/automation-role-based-access-control) 💡 [Using Azure Machine Learning to assign roles](https://learn.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler) 💡 [Azure AD Seccurity Groups ML](https://learn.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler#use-azure-ad-security-groups-to-manage-workspace-access) |\r\n| | 6.2 Critical Process Automation | Microsoft Power Automate Azure Logic Apps Microsoft Sentinel Playbooks Microsoft 365 Defender Automated Investigation & Response | 💡 [Azure Automation Overview](https://learn.microsoft.com/en-us/azure/automation/overview) 💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/automation-security-baseline) 💡 [Visibility, Automation, and Orchestration with Zero Trust](https://learn.microsoft.com/en-us/) 💡 [Automation in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automation) 💡 [Automate Threat Response with Playbooks](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) 💡 [Automated Investigation & Response M365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) 💡 [Power Automate U.S Government](https://learn.microsoft.com/en-us/power-automate/us-govt) |\r\n| | 6.3 Machine Learning | Microsoft Sentinel Fusion ML Microsoft Sentinel Bring Your Own Machine Learning (BYOML) Microsoft Defender for Cloud (MDfC) Azure ML | 💡 [Advanced multistage attack detection in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/fusion) 💡 [Bring your own Machine Learning (ML) into Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/bring-your-own-ml) 💡 [Azure Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/?view=azureml-api-2) 💡 [Enterprise Security & Governance w. Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/concept-enterprise-security?view=azureml-api-2) 💡 [Azure Government Isolaiton Guidelines using AI & ML](https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-impact-level-5) 💡 [Quick Start Azure Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/tutorial-azure-ml-in-a-day?view=azureml-api-2) 💡 [Azure security baseline for Azure Machine Learning](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/machine-learning-security-baseline) |\r\n| | 6.4 Artificial Intelligence | Microsoft Sentinel Fusion ML Microsoft Sentinel Tailored AI Azure ML | 💡 [AI Security Services](https://learn.microsoft.com/en-us/azure/ai-services/security-features) 💡 [Senintel Automation](https://learn.microsoft.com/en-us/azure/sentinel/automation) 💡 [AI ID & Access Risk Based Controls](https://azure.microsoft.com/en-us/products/category/identity/) 💡 [Implement Sentinel & M365 Defender for XDR - AI Driven Zero Trust ](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) 💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) |\r\n| | 6.5 Security Orchestration, Automation & Response (SOAR) | Microsoft 365 Defender Automated investigation and response Microsoft Sentinel Playbooks Microsoft Defender for Cloud (MDfC) Azure Logic Apps | 💡 [Security Ochestration, Automation & Response (SOAR) In Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automation) 💡 [Sentinel SOAR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/how-to-use-azure-sentinel-for-incident-response-orchestration/ba-p/2242397) 💡 [Microsoft Sentinel SOAR Content Catalog](https://learn.microsoft.com/en-us/azure/sentinel/sentinel-soar-content) 💡 [Automate Threat Response with Playbooks in Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) 💡 [Automated investigation and response in Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) 💡 [Workflow Automation in Microsoft Defender for Cloud](https://www.bing.com/ck/a?!&&p=9150006d50b58362JmltdHM9MTY5MDg0ODAwMCZpZ3VpZD0yMTRiYTU0My05MDAzLTY2ODAtMjJhMS1iNjFjOTQwMzYwYjYmaW5zaWQ9NTI5Mw&ptn=3&hsh=3&fclid=214ba543-9003-6680-22a1-b61c940360b6&psq=Microsoft+SOAR+Logic+Apps&u=a1aHR0cHM6Ly9sZWFybi5taWNyb3NvZnQuY29tL2VuLXVzL2F6dXJlL2RlZmVuZGVyLWZvci1jbG91ZC93b3JrZmxvdy1hdXRvbWF0aW9u&ntb=1) 💡 [SOAR Best Practices](https://www.microsoft.com/en-us/security/business/security-101/what-is-soar#SOARbestpractices) 💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) |\r\n| | 6.6 API Standardization | Azure API Management Azure Monitor Log Analytics Azure Logic Apps Azure Policy | 💡 [Microsft API Management & Security](https://azure.microsoft.com/en-us/products/api-management/) 💡 [Mitigate OWASP Top 10 Security Threats Using Microsoft API Management](https://learn.microsoft.com/en-us/azure/api-management/mitigate-owasp-api-threats) 💡 [Security Baselines for API Management](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/api-management-security-baseline) 💡 [Secure and Compliant APIs for a Hybrid and Multi Cloud World](https://azure.microsoft.com/en-us/blog/secure-and-compliant-apis-for-a-hybrid-and-multi-cloud-world/) 💡 [Web API Design Best Practice](https://learn.microsoft.com/en-us/azure/architecture/best-practices/api-design) 💡 [Monitor & Protect Your APIs](https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-use-azure-monitor) |\r\n| | 6.7 Security Operations Center (SOC) & Incident Response (IR) | Microsoft Sentinel Microsoft 365 Defender | 💡 [Security Operations In Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-security-operations) 💡 [Microsoft SOC Best Practices Landing Page](https://www.microsoft.com/en-us/security/business/security-101/what-is-a-security-operations-center-soc?ef_id=_k_ce7dcd6e8f2d1919667ca9a72f733870_k_&OCID=AIDcmmdamuj0pc_SEM__k_ce7dcd6e8f2d1919667ca9a72f733870_k_&msclkid=ce7dcd6e8f2d1919667ca9a72f733870) 💡 [Playbook for Modernizing Security Operations Centers](https://www.microsoft.com/en-us/security/blog/2021/02/11/a-playbook-for-modernizing-security-operations/) 💡 [CISO Series Lessons Learned from Microsoft's SOC](https://www.microsoft.com/en-us/security/blog/2019/10/07/ciso-series-lessons-learned-from-the-microsoft-soc-part-3a-choosing-soc-tools/) 💡 [Integrating Microsoft 365 Defender into your security operations](https://learn.microsoft.com/en-us/microsoft-365/security/defender/integrate-microsoft-365-defender-secops?view=o365-worldwide) |\r\n| Visibility & Analytics 7.x | | | |\r\n| | 7.1 Log All Traffic (Network, Data, Apps, Users) | Azure Monitor Log Analytics Microsoft Sentinel | 💡 [Azure Log Analytics](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-overview) 💡 [Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/overview) 💡 [Audit Logging and Monitoring](https://learn.microsoft.com/en-us/compliance/assurance/assurance-audit-logging) 💡 [Maturity Model for Log Management M2131](https://techcommunity.microsoft.com/t5/public-sector-blog/microsoft-sentinel-maturity-model-for-event-log-management-m-21/ba-p/3074336) 💡 [Device Log Capture - Intune](https://learn.microsoft.com/en-us/mem/intune/remote-actions/collect-diagnostics) 💡 [Application Logging](https://learn.microsoft.com/en-us/sql/relational-databases/performance/view-the-windows-application-log-windows-10?view=sql-server-ver16) 💡 [User Access Logging](https://learn.microsoft.com/en-us/windows-server/administration/user-access-logging/get-started-with-user-access-logging) 💡 [Azure Infrastructure Logs](https://learn.microsoft.com/en-us/azure/well-architected/scalability/monitor-infrastructure) 💡 [Network Logging](https://learn.microsoft.com/en-us/azure/azure-web-pubsub/howto-troubleshoot-network-trace) 💡 [Supported Logs for Network](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/supported-logs/microsoft-network-networkmanagers-logs) |\r\n| | 7.2 Security Information and Event Management (SIEM) | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) Microsoft 365 Defender | 💡 [Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/overview) 💡 [Implement Sentinel & M365](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) 💡 [Unified SIEM & XDR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-unified-microsoft-siem-and-xdr-github-community/ba-p/3249533) 💡 [Stream Alerts Defender for Cloud to SIEM](https://learn.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem#stream-alerts-to-azure-sentinel) 💡 [Azure Sentinel Github Repo](https://github.com/Azure/Azure-Sentinel) 💡 [Sentinel & SOC Analysis Process](https://learn.microsoft.com/en-us/azure/sentinel/migration-security-operations-center-processes) 💡 [Microsoft Sentinel Skill Up Training](https://learn.microsoft.com/en-us/azure/sentinel/skill-up-resources) |\r\n| | 7.3 Common Security and Risk Analytics | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) | 💡 [Microsoft Security Response Center Security Updates Guide](https://msrc.microsoft.com/update-guide) 💡 [Explore Risks to Sensitive Data Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/data-security-review-risks) 💡 [Identify & Analyze Risks Across Your Environment](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-attack-path) 💡 [Cloud Security Posture Management](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management) 💡 [Microsoft Cloud Security Benchmark](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-regulatory-compliance) |\r\n| | 7.4 User and Entity Behavior Analytics | Microsoft Sentinel UEBA Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Identity (MDI) Entra ID Conditional Access (CA) Purview Insider Risk Management | 💡 [ID Threats with User and Entity Behavior Analytics](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [Enable Entity Behavior Analytics to Detect Threats](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics) 💡 [Microsoft Sentinel UEBA Reference](https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference) 💡 [Investigate Incidents with UEBA](https://learn.microsoft.com/en-us/azure/sentinel/investigate-with-ueba) 💡 [Discover and Protect Sensitive Information in your Organization](https://learn.microsoft.com/en-us/defender-cloud-apps/tutorial-dlp) 💡 [Purview Insider Risk Management](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) |\r\n| | 7.5 Threat Intelligence Integration | Microsoft Sentinel Threat Intelligence (TI) Microsoft Graph Security Indicators Microsoft Defender Threat Intelligence (MDTI) | 💡 [Microsoft Threat Intelligence](https://learn.microsoft.com/en-us/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti) 💡 [Microsoft Security Graph API](https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview?view=graph-rest-beta) 💡 [Create Threat Intelligence Indicators](https://learn.microsoft.com/en-us/graph/api/tiindicators-post?view=graph-rest-beta&tabs=http) 💡 [Threat intelligence integration in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/threat-intelligence-integration) 💡 [Bring Your Own Threat Intelligence Feeds](https://learn.microsoft.com/en-us/defender-cloud-apps/additional-integrations) 💡 [Accessing the Threat Intelligence Portal](https://learn.microsoft.com/en-us/defender/threat-intelligence/learn-how-to-access-microsoft-defender-threat-intelligence-and-make-customizations-in-your-portal) |\r\n| | 7.6 Automated Dynamic Policies | Entra ID Protection Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel Fusion ML Microsoft Sentinel Bring Your Own Machine Learning (BYOML) Microsoft Sentinel Playbooks Microsoft Intune Azure Automation Purview Insider Risk Management | 💡 [Automate Threat Response with Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) 💡 [Adaptive Protection - Microsoft Purview](https://www.microsoft.com/en-us/security/blog/2023/02/06/introducing-adaptive-protection-in-microsoft-purview-people-centric-data-protection-for-a-multiplatform-world/#:~:text=With%20Adaptive%20Protection%2C%20DLP%20policies%20become%20dynamic%2C%20ensuring,efficient%20and%20empowered%20to%20do%20more%20with%20less.) 💡 [Adaptive Policy Scopes M365](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/using-adaptive-policy-scopes-to-apply-m365-retention-to-shared/ba-p/3053641#:~:text=Back%20in%20October,in%20Microsoft%20365.) 💡 [Adaptive Application Controls](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls) 💡 [AI-Driven Adaptive Device Controls Microsoft Defender for Endpoint](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/ai-driven-adaptive-protection-in-microsoft-defender-for-endpoint/ba-p/2966491) 💡 [AI-Driven Adaptive Protection Against Human Operated Ransomeware](https://www.microsoft.com/en-us/security/blog/2021/11/15/ai-driven-adaptive-protection-against-human-operated-ransomware/) 💡 [Microsoft Defender for Cloud Automated Security Posture Management](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management) 💡 [Improve your network security posture with adaptive network hardening](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-network-hardening) 💡 [What is Microsoft Entra ID Protection?](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection) 💡 [Azure Automation update management](https://learn.microsoft.com/en-us/azure/architecture/hybrid/azure-update-mgmt) 💡 [Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure) |"
+ },
+ "conditionalVisibility": {
+ "parameterName": "isess3Visible",
+ "comparison": "isEqualTo",
+ "value": "true"
+ },
+ "showPin": true,
+ "name": "ztalign"
+ }
+ ]
+ },
+ "conditionalVisibility": {
+ "parameterName": "pillar",
+ "comparison": "isEqualTo",
+ "value": "ess"
+ },
+ "name": "ZTGroup"
+ },
+ {
+ "type": 1,
+ "content": {
+ "json": "## DoD Zero Trust Capabilities (45) ##\r\n\r\n| ID # | Capability | Pillar | Capability Description | Capability Outcome | Impact to ZT | Associated Activities |\r\n|------|---------------------------------------------------------------------------|----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\r\n| 1.1 | User Inventory | 1 - User | Regular and Privileged users are identified and integrated into an inventory supporting regular modifications. Applications, software and services that have local users are all part of the inventory and highlighted. | System owners have control (visibility and administrative rights) of all authorized and authenticated users on the network | Users not on the authorized user list will be denied access by policy | * Inventory User |\r\n| 1.2 | Conditional User Access | 1 - User | Through maturity levels Conditional Access works to create a dynamic level of access for users in the environment. This starts with traditional role based access controls across a federate ICAM, expands to be application focused roles and ultimately utilizes enterprise attributes to provide dynamic access rules. | Eventually, organizations control user, device, and non-user entity DAAS access through dynamically changing user risk profiles and fine grained access control to include the use of user risk assessments | Users not known to the system and users who present an unacceptable degree of risk will be denied access with greater accuracy | * Implement App Based Permissions per Enterprise * Rule Based Dynamic Access Pt1 * Rule Based Dynamic Access Pt2 * Enterprise Gov't roles and Permissions Pt1 * Enterprise Gov't roles and Permissions Pt2 |\r\n| 1.3 | Multi-Factor Authentication (MFA) | 1 - User | This capability initially focuses on developing an organization focused MFA provider and Identity Provider to enable the centralization of users. Retirement of local and/or built-in accounts and groups is a critical piece to this capability. At the later maturity levels alternative and flexible MFA tokens can be used to provide access for standard and external users. | DoD organizations require users and non-user entities to authenticate using at least two of the following three attributes: knowledge (user ID/password), possession (CAC/token), or something you are (inherence, e.g., iris/fingerprints), in order to access DAAS | Users not presenting multiple forms of authentication will be denied access to DAAS system and resources | * Organizational MFA/IDP * Alternative Flexible MFA Pt1 * Alternative Flexible MFA Pt2 |\r\n| 1.4 | Privileged Access Management (PAM) | 1 - User | The capability focuses on removal of permanent administrator/elevated privileges by first creating a Privileged Account Management (PAM) system and migrating privileged users to it. The capability is then expanded upon by using automation with privilege escalation approvals and feeding analytics into the system for anomaly detection. | DoD organizations control, monitor, secure, and audit privileged identities (e.g., through password vaulting, JIT/JEA with PAWS) across their IT environments | Critical assets and applications secured, controlled, monitored and managed through limits on admin access | * Implement System and Migrate Privileged Users Pt1 * Implement System and Migrate Privileged Users Pt2 * Real time Approvals & JIT/JEA Analytics Pt1 * Real time Approvals & JIT/JEA Analytics Pt2 |\r\n| 1.5 | Identity Federation & User Credentialing | 1 - User | The initial scope of this capability focuses on standardizing the Identity Lifecycle Management (ILM) processes and integrating with the standard organizational IDP/IDM solution. Once completed the capability shifts to establishing an Enterprise ILM process/solution either through a single solution or identity federation. | DoD organizations manually issue, manage, and revoke credentials bound to DoD person, device, and NPE identities. Identity information is developed and shared across entitles and trust domains providing “single sign-on” convenience and efficiencies to identified (authenticated and authorized) users and devices. | Visibility and accuracy of user authentication information is increased, to include DoD users and users managed by other agencies. Users lacking sufficient credentials are denied access according to established policies. | * Organizational Identity Life-Cycle Management * Enterprise Identity Life-Cycle Management Pt1 * Enterprise Identity Life-Cycle Management Pt2 * Enterprise Identity Life-Cycle Management Pt3 |\r\n| 1.6 | Behavioral, Contextual ID, and Biometrics | 1 - User | Utilizing the Enterprise IDP, user and entity behavioral analytics (UEBA) are enabled with basic user attributes. Once completed this is expanded into Organizational specific attributes using Organizational IDPs as available. Finally UEBA are integrated with the PAM and JIT/JEA systems to better detect anomalous and malicious activities. | DoD organizations utilize behavioral, contextual, and biometric telemetry to enhance risk-based authentication and access controls | Behavioral, contextual, and biometric telemetry enhances MFA with | * Implement User & Entity Behavior Activity (UEBA) and User Activity Monitoring (UAM) Tooling * User Activity Monitoring Pt1 * User Activity Monitoring Pt2 |\r\n| 1.7 | Least Privileged Access | 1 - User | DoD organizations govern access to DAAS using the absolute minimum access required to perform routine, legitimate tasks or activities. DoD Application Owners identify the necessary roles and attributes for standard and privileged user access. Privileged access for all DoD organization DAAS is audited and removed when unneeded. | DoD organizations govern access to DAAS using the absolute minimum access required to perform routine, legitimate tasks or activities | Users on the network only have access to the DAAS for which they are authorized and authenticated over a specific timeframe | * Deny User by Default Policy |\r\n| 1.8 | Continuous Authentication | 1 - User | The DoD organizations and overall enterprise will methodically move towards continuous attribute based authentication. Initially the capability focuses on standardizing legacy single authentication to a organizationally approved IDP with users and groups. The second stages adds in based rule based (time) authentication and ultimately matures to Continuous Authentication based on the application/software activities and privileges requested. | DoD organizations continuously authenticate and authorize users' access to DAAS within and across sessions using MFA | Users not continuously presenting multiple forms of authentication will be denied access to DAAS system and resources | * Single Authentication * Periodic Authentication * Continuous Authentication Pt1 * Continuous Authentication Pt2 |\r\n| 1.9 | Integrated ICAM Platform | 1 - User | DoD organizations and overall enterprise employ enterprise-level identity management and public key infrastructure (PKI) systems to track user, administrator and NPE identities across the network and ensure access is limited to only those who have the need and the right to know. Organizations can verify they need and have the right to access via credential management systems, identity governance and administration tools, and an access management tool. PKI systems can be federated but must either trust a central root certificate authority (CA) and/or cross-sign standardized organizational CA’s. | DoD organizations employ enterprise-level identity management systems to track user and NPE identities across the network and ensure access is limited to only those who have the need and the right to know; organizations can verify they need and have the right to access via credential management systems, identity governance and administration tools, and an access management tool | Identities of users and NPE are centrally managed to ensure authorized and authenticated access to DAAS resources across platforms | * Enterprise PKI/IDP Pt1 * Enterprise PKI/IDP Pt2 * Enterprise PKI/IDP Pt3 |\r\n| 2.1 | Device Inventory | 2 - Device | DoD organizations establish and maintain an approved inventory list of all devices authorized to access the network and enroll all devices on the network prior to network connection. Device attributes will include technical details such as the PKI (802.1x) machine certificate, device object, patch/vulnerability status and others to enable successor activities. | DoD organizations establish and maintain a trusted inventory list of all devices authorized to access the network and enroll all devices on the network prior to network connection | By default policy, devices will be denied network access; the only devices permitted access to the network shall be known, authorized, and listed in the device inventory | * Device Health Tool Gap Analysis * NPE/PKI, Device under Management * Enterprise IDP Pt1 * Enterprise IDP Pt2 |\r\n| 2.2 | Device Detection and Compliance | 2 - Device | DoD organizations employ asset management systems for user devices to maintain and report on IT and Cybersecurity compliance. Managed devices (enterprise and mobile) attempting to connect to a DoD network or access a DAAS resource is detected and has its compliance status confirmed (via C2C) | DoD organizations employ asset management systems for user devices to maintain and report on IT compliance. Any device (including mobile, IOT, managed, and unmanaged) attempting to connect to a DoD network or access a DAAS resource is detected and has its compliance status confirmed (via C2C) | Any device attempting to connect to the network will be detected; only those devices that are compliant (e.g., anti-virus is up to date, approved configuration) will receive access to requested DAAS | * Implement C2C/Compliance Based Network Authorization Pt1 * Implement C2C/Compliance Based Network Authorization Pt2 |\r\n| 2.3 | Device Authorization w/ Real Time Inspection | 2 - Device | DoD Organizations conduct foundational and extended device tooling (NextGen AV, AppControl, File Integrity Monitoring (FIM), etc.) integration to better understand the risk posture. Organizational PKI systems are integrated to expand the existing Enterprise PKI to devices as well. Lastly Entity Activity Monitoring is also integrated to identify anomalous activities. | DoD organizations establish processes (e.g., Enterprise PKI) and utilize tools to identify any device (including unmanaged devices, infrastructure devices, and endpoint devices) attempting to access the network, and make a determination if the device should be authorized to access the network. Maturation of this capability monitoring and detection of this activity on endpoints and IT infrastructure in real time | Components can use policies to deny devices by default and explicitly allow access to DAAS resources only by devices that meet mandated configuration standards. Security threats identified are remediated faster through continuous activity inspection enables faster remediation of security threats | * Entity Activity Monitoring Pt1 * Entity Activity Monitoring Pt2 * Implement Application Control & File Integrity Monitoring (FIM) Tools * Integrate NextGen AV Tools with C2C * Fully Integrate Device Security stack with C2C as appropriate * Enterprise PKI Pt1 * Enterprise PKI Pt2 |\r\n| 2.4 | Remote Access | 2 - Device | DoD organizations audit existing device access processes and tooling to set a least privilege baseline. In phase 2 this access is expanded to cover basic BYOD and IOT support using the Enterprise IDP for approved applications. The final phases expand coverage to include all BYOD and IOT devices for services using the approved set of device attributes. | DoD organizations establish policies to allow authorized users and devices access to the network or a device from a geographical distance through a network connection | Enables properly authorized and authenticated users and NPEs to access DAAS from remote locations | * Deny Device by Default Policy * Managed and Limited BYOD & IOT Support * Managed and Full BYOD & IOT Support Pt1 * Managed and Full BYOD & IOT Support Pt2 |\r\n| 2.5 | Partially & Fully Automated Asset, Vulnerability and Patch Management | 2 - Device | DoD organizations establish processes to automatically test and deploy vendor patches for connected devices; hybrid patch management (both human and automated) is employed | DoD organizations establish processes to automatically test and deploy vendor patches for connected devices; hybrid patch management (both human and automated) is employed | Risk is minimized by automatically deploying vendor patches to all network devices | * Implement Asset, Vulnerability and Patch Management Tools |\r\n| 2.6 | Unified Endpoint Management (UEM) & Mobile Device Management (MDM) | 2 - Device | DoD organizations establish a centralized UEM solution that provides the choices of agent and/or agentless management of computer and mobile devices to a single console regardless of device location. DoD-issued devices can be remotely managed and security policies are enforced. | DoD organizations establish a centralized UEM tool that provides the choices of agent and/or agentless management of computer and mobile devices to a single console. DoD-issued mobile devices are remotely managed and security policies are enforced. | DAAS resources are protected through agent and agentless management, IT is able to manage, secure, and deploy resources and applications on any device from a single console to provide redress of cybersecurity threats. Security vulnerabilities are mitigated and policy enforcement measures are received through IT remote management of DoD-issued mobile devices | * Implement UEDM or equivalent Tools * Enterprise Device Management Pt1 * Enterprise Device Management Pt2 |\r\n| 2.7 | Endpoint & Extended Detection & Response (EDR & XDR) | 2 - Device | DoD organizations use endpoint detection and response (EDR) tooling to monitor, detect, and remediate malicious activity on endpoints. Expanding the capability to include XDR tooling allows organizations to account for activity beyond the endpoints such as cloud and network as well. | DoD organizations use EDR tools to monitor, detect, and remediate malicious activity on endpoints as a baseline. Upgrading to XDR tools allows organizations to account for activity beyond the endpoints. | Threats originating from network- connected endpoints are initially reduced through active investigation and response. Maturation focuses on forensics and faster threat detection and remediation are enabled by correlating data across multiple security layers (e.g., email, cloud, endpoint) | * Implement Endpoint Detection & Response (EDR) Tools and Integrate with C2C * Implement Extended Detection & Response (XDR) Tools and Integrate with C2C Pt1 * Implement Extended Detection & Response (XDR) Tools and Integrate with C2C Pt2 |\r\n| 3.1 | Application Inventory | 3 - Applications and Workloads | System owners ensure that all applications and application components are identified and inventoried; only applications and application components that have been authorized by the appropriate authorizing official/CISO/CIO shall be utilized within the system owner's purview | System owners ensure that all applications and application components are identified and inventoried; only applications and application components that have been authorized by the appropriate authorizing official/CISO/CIO shall be utilized within the system owner's purview | Unauthorized applications and application components are not used on or within the system | * Application/Code Identification |\r\n| 3.2 | Secure Software Development & Integration | 3 - Applications and Workloads | Foundational software and application security processes and infrastructure are established following Zero Trust principles and best practices. Controls such as code review, runtime protection, secure API gateways, container and serverless security are integrated and automated. | Organization-defined security controls and practices are integrated, to include Zero Trust security controls and virtualization, into the software development lifecycle and DevOps toolchain. Custom software development teams use DevSecOps to integrate static and dynamic application security testing into software delivery workflows in accordance with the organization's requirements (policies, technologies, and processes). | Zero Trust security concepts, processes, and capabilities are accepted and integrated across the DevOps toolchain, to include static and dynamic application security testing necessary for the discovery of weaknesses and vulnerabilities during application development | * Build DevSecOps Software Factory Pt1 * Build DevSecOps Software Factory Pt2 * Automate Application Security & Code Remediation Pt1 * Automate Application Security & Code Remediation Pt2 |\r\n| 3.3 | Software Risk Management | 3 - Applications and Workloads | DoD organizations establish software/application risk management program. Foundational controls include Bill of Materials risk management, Supplier Risk Management, approved repositories and update channels, and vulnerability management program. Additional controls include Continual validation within the CI/CD pipelines and vulnerability maturation with external sources. | DoD establishes policies and procedures to secure supply chain cybersecurity for code components within DoD and DIB systems by evaluating and identifying supplier sourcing risk for approved sources, creating repositories and update channels for use by development teams, creating Bill of Materials for applications to identify source, supportability and risk posture, and establishing industry standard (DIB) and approved vulnerability databases for use in DevSecOps | Code used in DAAS and associated components of the supply chain is secure, vulnerabilities are reduced, and DoD is aware of potential risks | * Approved Binaries/Code * Vulnerability Management Program Pt1 * Vulnerability Management Program Pt2 * Continual Validation |\r\n| 3.4 | Resource Authorization & Integration | 3 - Applications and Workloads | DoD establishes a standardized resource authorization gateway for authorizations via the CI/CD pipelines in a risk approach that reviews the User, Device and Data security posture. Authorizations utilize a programmatic (e.g., Software Defined) approach in a live/production environment. Attributes are enriched utilizing other pillar activities and the API and Authorization gateway. Approved enterprise APIs are micro- segmented using authorizations. | DoD establishes a standard approach managing the authorizations of resources in a risk approach that reviews the User, Device and Data security posture. | Resource authorization enables the ability for limited access to those resources and in a programmatic way in later stages. This improvise the ability to remove access when it is not needed. | * Resource Authorization Pt1 * Resource Authorization Pt2 * SDC Resource Authorization Pt1 * SDC Resource Authorization Pt2 * Enrich Attributes for Resource Authorization Pt1 * Enrich Attributes for Resource Authorization Pt2 * REST API Micro-Segments |\r\n| 3.5 | Continuous Monitoring and Ongoing Authorizations | 3 - Applications and Workloads | DoD organizations employ automated tools and processes to continuously monitor applications and assess their authorization to operate | DoD organizations employ automated tools and processes to continuously monitor applications and assess their authorization to operate | Near real time visibility into the effectiveness of deployed security controls | * Continuous Authorization to Operate (cATO) Pt1 * Continuous Authorization to Operate (cATO) Pt2 |\r\n| 4.1 | Data Catalog Risk Alignment | 4 - Data | Data owners ensure that data is identified and inventoried and any changes to the data landscape are automatically detected and included within the catalog. The data landscape must then be reviewed to identify potential risks related to data loss, attack, or any other unauthorized alteration and/or access | Data owners ensure that data is identified and inventoried and any changes to the data landscape are automatically detected and included within the catalog. The data landscape must then be reviewed to identify potential risks related to data loss, attack, or any other unauthorized alteration and/or access | Data assets are known and can therefore be collected, tagged, and protected according to risk levels in alignment with a prioritization framework, and encrypted for protection | * Data Analysis |\r\n| 4.2 | DoD Enterprise Data Governance | 4 - Data | DoD establishes enterprise data labeling/tagging and DAAS access control/sharing policies (e.g., SDS policy) that are enforceable. Developed enterprise standards ensure an appropriate level of interoperability between DoD Organizations. | DoD establishes enterprise data labeling/tagging and DAAS access control/sharing policies (e.g., SDS policy) that are enforceable at the field level | Decision rights and accountability framework ensure appropriate behavior in the valuation, creation, consumption, and control of data and analytics | * Define Data Tagging Standards * Interoperability Standards * Develop Software Defined Storage (SDS) Policy |\r\n| 4.3 | Data Labeling and Tagging | 4 - Data | Data owners label and tag data in compliance with DoD enterprise governance on labeling/tagging policy. As phases advance automation is used to meet scaling demands and provide better accuracy. | Data owners label and tag data in compliance with DoD enterprise governance on labeling/tagging policy | Establishing machine enforceable data access controls, risk assessment, and situational awareness require consistently and correctly labeled and tagged data | * Implement Data Tagging & Classification Tools * Manual Data Tagging Pt1 * Manual Data Tagging Pt2 * Automated Data Tagging & Support Pt1 * Automated Data Tagging & Support Pt2 |\r\n| 4.4 | Data Monitoring and Sensing | 4 - Data | Data owners will capture active metadata that includes information about the access, sharing, transformation, and use of their data assets. Data Loss Prevention (DLP) and Data Rights Management (DRM) enforcement point analysis is conducted to determine where tooling will be deployed. Data outside of DLP and DRM scope such as File Shares and Databases is actively monitored for anomalous and malicious activity using alternative tooling. | Data owners will capture active metadata that includes information about the access, sharing, transformation, and use of their data assets | Data in all states are detectable and observable | * DLP Enforcement Point Logging and Analysis * DRM Enforcement Point Logging and Analysis * File Activity Monitoring Pt1 * File Activity Monitoring Pt2 * Database Activity Monitoring * Comprehensive Data Activity Monitoring |\r\n| 4.5 | Data Encryption & Rights Management | 4 - Data | DoD organizations establish and implement a strategy for encrypting data at rest and in transit using Data Rights Management (DRM) tooling. The DRM solution utilizes data tags to determine protection and lastly integrates with ML and AI to automate protection | DoD organizations establish and implement a strategy for encrypting data at rest and in transit | Encrypting data in all states reduces the risk of unauthorized data access and improves data security | * Implement DRM and Protection Tools Pt1 * Implement DRM and Protection Tools Pt2 * DRM Enforcement via Data Tags and Analytics Pt1 * DRM Enforcement via Data Tags and Analytics Pt2 * DRM Enforcement via Data Tags and Analytics Pt3 |\r\n| 4.6 | Data Loss Prevention (DLP) | 4 - Data | DoD organizations utilize the identified enforcement points to deploy approved DLP tools and integrate tagged data attributes with DLP. Initially the DLP solution is put into a \"monitor-only\" mode to limit business impact and later using analytics is put into a \"prevent\" mode. Extended data tag attributes are used to feed the DLP solution and lastly integrate with ML and AI. | DoD organizations have identified enforcement points, deployed approved DLP tools at those enforcement points, and integrate tagged data attributes with DLP | Data breaches and data exfiltration transmissions are detected and mitigated | * Implement Enforcement Points * DLP Enforcement via Data Tags and Analytics Pt1 * DLP Enforcement via Data Tags and Analytics Pt2 * DLP Enforcement via Data Tags and Analytics Pt3 |\r\n| 4.7 | Data Access Control | 4 - Data | DoD organizations ensure appropriate access to and use of data based on the data and user/NPE/device properties. Software Defined Storage (SDS) is utilized to scale manage permissions to DAAS. Lastly the SDS solution(s) is integrated with DRM tooling improving protections. | DoD organizations ensure appropriate access to and use of data based on the data and user/NPE/device properties | Unauthorized entities, or any entity on an unauthorized device cannot access data; Zero Trust cybersecurity will be sufficiently strong to separate community of interest data access for data in the same classification | * Integrate DAAS Access w/ SDS Policy Pt1 * Integrate DAAS Access w/ SDS Policy Pt2 * Integrate DAAS Access w/ SDS Policy Pt3 * Integrate Solution(s) and Policy with Enterprise IDP Pt1 * Integrate Solution(s) and Policy with Enterprise IDP Pt2 * Implement SDS Tool and/or integrate with DRM Tool Pt1 * Implement SDS Tool and/or integrate with DRM Tool Pt2 |\r\n| 5.1 | Data Flow Mapping | 5 - Network and Environment | DoD organizations reconcile data flows by gathering, mapping, and visualizing network traffic data flows and patterns to ensure authorized access and protection for network and DAAS resources specifically tagging programmatic (e.g., API) access when possible. | DoD organizations reconcile data flows by gathering, mapping, and visualizing network traffic data flows and patterns to ensure authorized access and protection for network and DAAS resources | Sets the foundation for network segmentation and tighter access control by understanding data traffic on the network | * Define Granular Control Access Rules & Policies Pt1 * Define Granular Control Access Rules & Policies Pt2 |\r\n| 5.2 | Software Defined Networking (SDN) | 5 - Network and Environment | DoD organizations define API decision points and implement SDN programmable infrastructure to separate the control and data planes and centrally manage and control the elements in the data plane. Integrations are conducted with decision points and segmentation gateway to accomplish the plane separation. Analytics are then integrated to real time decision making for access to resources. | DoD organizations define API decision points and implement SDN programmable infrastructure to separate the control and data planes and centrally manage and control the elements in the data plane | Enables the control of packets to a centralized server, provides additional visibility into the network, and enables integration requirements | * Define SDN APIs* Implement SDN Programable Infrastructure * Segment Flows into Control, Management, and Data Planes * Network Asset Discovery & Optimization * Real-Time Access Decisions |\r\n| 5.3 | Macro Segmentation | 5 - Network and Environment | DoD organizations establish network boundaries and provide security against networked assets located within an environment by validating the device, user, or NPE on each attempt of accessing a remote resource prior to connection. | DoD organizations establish network perimeters and provide security against devices located within an environment by validating the device, user, or NPE on each attempt of accessing a remote resource prior to connection | Network segmentation is defined by a large perimeter to enable resource segmentation by function and user type | * Datacenter Macro segmentation * B/C/P/S Macro segmentation |\r\n| 5.4 | Micro Segmentation | 5 - Network and Environment | DoD organizations define and document network segmentation based on identity and / or application access in their virtualized and/or cloud environments. Automation is used to apply policy changes through programmatic (e.g., API) approaches. Lastly where possible organizations will utilize host-level process micro segmentation. | DoD organizations define and document network segmentation based on identity and / or application access in their virtualized cloud environments | Network segmentation enabled by narrower and specific segmentation in a virtualized environment via identity and / or application access, allowing for improved protection of data in transit as it crosses system boundaries (e.g., in a coalition environment, system high boundaries) and supported dynamic, real-time access decisions and policy changes | * Implement Micro segmentation * Application & Device Micro segmentation * Process Micro segmentation * Protect Data In Transit |\r\n| 6.1 | Policy Decision Point (PDP) & Policy Orchestration | 6 - Automation and Orchestration | DoD organizations initially collect and document all rule based policies to orchestrate across the security stack for effective automation; DAAS access procedures and policies will be defined, implemented, and updated. Organizations mature this capability by establishing PDPs and PEPs (including the Next Generation Firewall) to make DAAS resource determinations and enable, monitor, and terminate connections between a user/device and DAAS resources according to predefined policy. | DoD organizations initially collect and document all rule based policies to orchestrate across the security stack for effective automation; DAAS access procedures and policies will be defined, implemented, and updated. Organizations mature this capability by establishing PDPs and PEPs (including the Next Generation Firewall) to make DAAS resource determinations and enable, monitor, and terminate connections between a user/device and DAAS resources according to predefined policy | PDPs and PEPs ensure proper implementation of DAAS access policies to users or endpoints that are properly connected (or denied access) to requested resources | * Policy Inventory & Development * Organization Access Profile * Enterprise Security Profile Pt1 * Enterprise Security Profile Pt2 |\r\n| 6.2 | Critical Process Automation | 6 - Automation and Orchestration | DoD organizations employ automation methods, such as RPA, to address repetitive, predictable tasks for critical functions such as data enrichment, security controls, and incident response workflows according to system security engineering principles. | DoD organizations employ automation methods, such as RPA, to address repetitive, predictable tasks for critical functions such as data enrichment, security controls, and incident response workflows according to system security engineering principles | Response time and capability is increased with orchestrated workflows and risk management processes | * Task Automation Analysis * Enterprise Integration & Workflow Provisioning Pt1 * Enterprise Integration & Workflow Provisioning Pt2 |\r\n| 6.3 | Machine Learning | 6 - Automation and Orchestration | DoD organizations employ ML to execute (and enhance execution of) critical functions such as incident response, anomaly detection, user baselining, and data tagging. | DoD organizations employ ML to execute (and enhance execution of) critical functions such as incident response, anomaly detection, user baselining, and data tagging | Response time and capability is increased with orchestrated workflows and risk management processes | * Implement Data Tagging & Classification ML Tools |\r\n| 6.4 | Artificial Intelligence | 6 - Automation and Orchestration | DoD organizations employ AI to execute (and enhance execution of) critical functions - particularly risk and access determinations and environmental analysis. | DoD organizations employ AI to execute (and enhance execution of) critical functions - particularly risk and access determinations and environmental analysis | Response time and capability is increased with orchestrated workflows and risk management processes | * Implement AI automation tools * AI Driven by Analytics decides A&O modifications |\r\n| 6.5 | Security Orchestration, Automation & Response (SOAR) | 6 - Automation and Orchestration | DoD organizations achieve initial operational capability of security technologies to orchestrate and automate policies (e.g., PEPs and PDPs) and rulesets to improve security operations, threat and vulnerability management, and security incident response by ingesting alert data, triggering playbooks for automated response and remediation. | DoD organizations achieve IOC of security technologies to orchestrate and automate policies (e.g., PEPs and PDPs) and rulesets to improve security operations, threat and vulnerability management, and security incident response by ingesting alert data, triggering playbooks for automated response and remediation | Pre-defined playbooks from collection to incident response and triage enables initial process automation that accelerates a security team's decision and response speed | * Response Automation Analysis * Implement SOAR Tools * Implement Playbooks |\r\n| 6.6 | API Standardization | 6 - Automation and Orchestration | DoD establishes and enforces enterprise-wide programmatic interface (e.g., API ) standards; all non-compliant APIs are identified and replaced. | DoD establishes and enforces enterprise-wide API standards; all non-compliant APIs are identified and replaced | Standardizing APIs across the department improves application interfaces, enabling orchestration, and enhancing interoperability | * Tool Compliance Analysis * Standardized API Calls & Schemas Pt1 * Standardized API Calls & Schemas Pt2 |\r\n| 6.7 | Security Operations Center (SOC) & Incident Response (IR) | 6 - Automation and Orchestration | In the event a computer network defense service provider (CNDSP) does not exist, DoD organizations define and stand up security operations centers (SOC) to deploy, operate, and maintain security monitoring, protections and response for DAAS; SOCs provide security management visibility for status (upward visibility) and tactical implementation (downward visibility). Workflows within the SOC are automated using automation tooling and enrichment occurs between service providers and technologies. | In the event a CNDSP does not exist, DoD organizations define and stand up SOCs to deploy, operate, and maintain security monitoring, protections and response for DAAS; SOCs provide security management visibility for status (upward visibility) and tactical implementation (downward visibility) | Standardized, coordinated, and accelerated incident response and investigative efforts | * Workflow Enrichment Pt1 * Workflow Enrichment Pt2 * Workflow Enrichment Pt3 * Automated Workflow |\r\n| 7.1 | Log All Traffic (Network, Data, Apps, Users) | 7 - Visibility and Analytics | DoD organizations collect and process all logs including network, data, application, device, and user logs and make those logs available to the appropriate Computer Network Defense Service Provider (CNDSP) or security operations center (SOC). Logs and events follow a standardized format and rules/analytics are developed as needed. | DoD organizations collect and process all logs including network, data, application, device, and user logs and make those logs available to the appropriate Computer Network Defense Service Provider (CNDSP) or SOC | Foundational to the development of automated hunt and incident response playbooks | * Scale Considerations * Log Parsing * Log Analysis |\r\n| 7.2 | Security Information and Event Management (SIEM) | 7 - Visibility and Analytics | Computer Network Defense Service Provider (CNDSP) or security operations centers (SOC) monitor, detect, and analyze data logged into a security information and event management (SIEM) tool. User and device baselines are created using security controls and integrated with the SIEM. Alerting within the SIEM is matured over the phases to support more advanced data points (e.g., Cyber Threat Intel, Baselines, etc.) | CNDSPs/SOCs monitor, detect, and analyze data logged into a security information and event management (SIEM) tool | Processing and exploiting data in the SIEM enables effective security analysis of anomalous user behavior, alerting, and automation of relevant incident response to common threat events | * Threat Alerting Pt1 * Threat Alerting Pt2 * Threat Alerting Pt3 * Asset ID & Alert Correlation * User/Device Baselines |\r\n| 7.3 | Common Security and Risk Analytics | 7 - Visibility and Analytics | Computer Network Defense Service Provider (CNDSP) or security operations centers (SOC) employ data tools across their enterprises for multiple data types to unify data collection and examine events, activities, and behaviors. | CNDSPs/SOCs employ big data tools across their enterprises for multiple data types to unify data collection and examine events, activities, and behaviors | Analysis integrated across multiple data types to examine event, activities, and behaviors | * Implement Analytics Tools * Establish User Baseline Behavior |\r\n| 7.4 | User and Entity Behavior Analytics | 7 - Visibility and Analytics | DoD organizations initially employ analytics to profile and baseline activity of users and entities and to correlate user activities and behaviors and detect anomalies. Computer Network Defense Service Provider (CNDSP) or security operations centers (SOC) mature this capability through the employment of advanced analytics to profile and baseline activity of users and entities and to correlate user activities and behaviors, and detect anomalies. | DoD organizations initially employ analytics to profile and baseline activity of users and entities and to correlate user activities and behaviors, and detect anomalies. CNDSPs/SOCs mature this capability through the employment of advanced analytics to profile and baseline activity of users and entities and to correlate user activities and behaviors, and detect anomalies | Advanced analytics support detection of anomalous users, devices, and NPE actions and advanced threats | * Baseline & Profiling Pt1 * Baseline & Profiling Pt2 * UEBA Baseline Support Pt1 * UEBA Baseline Support Pt2 |\r\n| 7.5 | Threat Intelligence Integration | 7 - Visibility and Analytics | Computer Network Defense Service Provider (CNDSP) or security operations centers (SOC) integrate threat intelligence information and streams about identities, motivations, characteristics, and tactics, techniques and procedures (TTPs) with data collected in the SIEM. | CNDSPs/SOCs integrate threat intelligence information and streams about identities, motivations, characteristics, and tactics, techniques and procedures (TTPs) with data collected in the SIEM | Integrating threat intelligence into other SIEM data enhances monitoring efforts and incident response | * Cyber Threat Intelligence Program Pt1 * Cyber Threat Intelligence Program Pt2 |\r\n| 7.6 | Automated Dynamic Policies | 7 - Visibility and Analytics | DoD Organization ML & AI solutions dynamically and automatically update security profiles and device configuration through continuous security posture monitoring, risk and confidence scoring, and automated patch management. | CNDSPs/SOCs dynamically and automatically update security profiles and device configuration through continuous security posture monitoring, risk and confidence scoring, and automated patch management | Users and NPEs are denied access based on automated, real-time security profiles based on external conditions and evolving risk and confidence scores | * AI-enabled Network Access * AI-enabled Dynamic Access Control |",
+ "style": "info"
+ },
+ "conditionalVisibility": {
+ "parameterName": "DoDZT",
+ "comparison": "isEqualTo",
+ "value": "Capabilities"
+ },
+ "name": "ZTCapabilities"
+ },
+ {
+ "type": 1,
+ "content": {
+ "json": "## DoD Zero Trust Activities (152) ##\r\n\r\n| ID# | Activity Name | Associated Capability | Phase | Duration (months) | Descriptions | Outcomes | Controls | Predecessor(s) | Successor(s) |\r\n|-------|---------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------|-----------------|-------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|\r\n| 1.1.1 | Inventory User | 1.1 User Inventory | Target Level ZT | 25.9 | DoD Organizations establish and update a user inventory manually if needed, preparing for automated approach in later stages. Accounts both centrally managed by an IdP/ICAM and locally on systems will be identified and inventoried. Privileged accounts will be identified for future audit and both standard and privileged user accounts local to applications and systems will be identified for future migration and/or decommission. | Identified Managed Regular Users; Identified Managed Privileged Users; Identified applications using their own user account management for non-administrative and administrative accounts | | | |\r\n| 1.2.1 | Implement App Based Permissions per Enterprise | 1.2 Conditional User Access | Target Level ZT | 17.7 | The DoD enterprise working with the Organizations establishes a basic set of user attributes for authentication and authorization. These are integrated with the “Enterprise Identity Life-Cycle Management Pt1” activity process for a complete enterprise standard. The enterprise Identity, Credential and Access Management (ICAM) solution is enabled for self-service functionality for adding/updating attributes within the solution. Remaining Privileged Access Management (PAM) activities are fully migrated to PAM solution. | Enterprise roles/attributes needed for user authorization to application functions and/or data have been registered with enterprise ICAM; DoD Enterprise ICAM has self-service attribute/role registration service that enables application owners to add attributes or use existing enterprise attributes; Privileged activities are fully migrated to PAM | | | |\r\n| 1.2.2 | Rule Based Dynamic Access Pt1 | 1.2 Conditional User Access | Target Level ZT | 22.1 | DoD Organizations utilize the rules from the “Periodic Authentication” activity to build basic rules enabling and disabling privileges dynamically. High-risk user accounts utilize the PAM solution to move to dynamic privileged access using Just-In-Time access and Just-Enough Administration methods. | Access to application’s/service’s functions and/or data are limited to users with appropriate enterprise attributes; All possible applications use JIT/JEA permissions for administrative users | | Single Authentication | Rule Based Dynamic Access Pt2; AI- enabled Network Access |\r\n| 1.2.3 | Rule Based Dynamic Access Pt2 | 1.2 Conditional User Access | Advanced ZT | 15.5 | DoD Organizations expand the development of rules for dynamic access decision making accounting for risk. Solutions used for dynamic access are integrated with cross pillar Machine Learning and Artificial Intelligence functionality enabling automated rule management. | Components and services are fully utilizing rules to enable dynamic access to applications and services; Technology utilized for Rule Based Dynamic Access supports integration with AI/ML tooling | | Rule Based Dynamic Access Pt1; File Activity Monitoring Pt2 | |\r\n| 1.2.4 | Enterprise Gov't roles and Permissions Pt1 | 1.2 Conditional User Access | Advanced ZT | 11.6 | DoD Organizations federate remaining user and group attributes as appropriate to the Enterprise Identity, Credential and Access Management (ICAM) solution. The updated attribute set is used to create universal roles for Organizations to use. Core functions of the Identity Provider (IdP) and Identity, Credential and Access Management (ICAM) solutions are migrated to cloud services and/or environments enabling improved resilience and performance. | Component attribute and role data repository federated with enterprise ICAM; Cloud-based enterprise IdP can be used by cloud and on-premises applications; A standardized set of roles and permissions are created and aligned to attributes | | | Enterprise Gov't roles and Permissions Pt2 |\r\n| 1.2.5 | Enterprise Gov't roles and Permissions Pt2 | 1.2 Conditional User Access | Advanced ZT | 11.2 | DoD Organizations move all possible functions of the Identity Provider (IdP) and Identity, Credential and Access Management (ICAM) solutions to cloud environments. Enclave/DDIL environments local capabilities to support disconnected functions but ultimately are managed by the centralized Identity, Credential and Access Management (ICAM) solutions. Updated roles are now mandated for usage and exceptions are reviewed following a risk-based approach. | Majority of components utilize cloud IdP functionality Where possible on-prem IdP is decommissioned; Permissions and roles are mandated for usage when evaluating attributes | | Enterprise Gov't roles and Permissions Pt1 | |\r\n| 1.3.1 | Organizational MFA/IDP | 1.3 Multi-Factor Authentication (MFA) | Target Level ZT | 10.6 | DoD Organizations procure and implement a centralized Identity Provider (IdP) solution and Multi-Factor (MFA) solution. The IdP and MFA solution may be combined in a single application or separated as needed assuming automated integration is supported by both solutions. Both IdP and MFA support integration with the Enterprise PKI capability as well enabling key pairs to be signed by the trusted root certificate authorities. Mission/Task-Critical applications and services are utilizing the IdP and MFA solution for management of users and groups. | Component is using IdP with MFA for critical applications/services; Components have implemented an Identity Provider (IdP) that enables DoD PKI multifactor authentication; Organizational Standardized PKI for critical services | | | Alternative Flexible MFA Pt1 |\r\n| 1.3.2 | Alternative Flexible MFA Pt1 | 1.3 Multi-Factor Authentication (MFA) | Advanced ZT | 17.4 | DoD Organization’s Identity Provider (IdP) supports alternative methods of multi-factor authentication complying with Cyber Security requirements (e.g., FIPS 140-2, FIPS 197, etc.). Alternative tokens can be used for application-based authentication. Multi-Factor options support Biometric capability and can be managed using a self-service approach. Where possible multi-factor provider(s) is moved to cloud services instead of being hosted on-premise. | IdP provides user self-service alternative token; IdP provides alt token MFA for approved applications per policy | | Organizational MFA/IDP | Alternative Flexible MFA Pt2 |\r\n| 1.3.3 | Alternative Flexible MFA Pt2 | 1.3 Multi-Factor Authentication (MFA) | Advanced ZT | 14.6 | Alternative tokens utilize user activity patterns from cross pillar activities such as \"User Activity Monitoring (UAM) and User & Entity Behavior Analytics (UEBA)\" to assist with access decision making (e.g., not grant access when pattern deviation occurs). This functionality is further extended onto Biometric enabled alternative tokens as well. | User Activity Patterns Implemented | | Alternative Flexible MFA Pt1 | |\r\n| 1.4.1 | Implement System and Migrate Privileged Users Pt1 | 1.4 Privileged Access Management (PAM) | Target Level ZT | 12.4 | DoD Organizations procure and implement a Privileged Access Management (PAM) solution support all critical privileged use cases. Application/Service integration points are identified to determine status of support for the PAM solution. Applications/Services that easily integrate with PAM solution are transitioned over to using solution versus static and direct privileged permissions. | Privilege Access Management (PAM) tooling is implemented; applications and devices that support and do not support PAM tools identified; Applications that support PAM, now use PAM for controlling emergency/built-in accounts | MA-5 (1) individuals without appropriate access | | Implement System and Mitigate Privileged Users Pt2 |\r\n| 1.4.2 | Implement System and Migrate Privileged Users Pt2 | 1.4 Privileged Access Management (PAM) | Target Level ZT | 14.4 | DoD Organizations utilize the inventory of supported and unsupported Applications/Services for integration with privileged access management (PAM) solution to extend integrations. PAM is integrated with the more challenging Applications/Services to maximize PAM solution coverage. Exceptions are managed in a risk-based methodical approach with the goal of migration off and/or decommissioning Applications/Services that do not support PAM solution. | Privileged activities are migrated to PAM and access is fully managed | | Implement System and Mitigate Privileged Users Pt1 | Real time Approvals & JIT/JEA Analytics Pt1 |\r\n| 1.4.3 | Real time Approvals & JIT/JEA Analytics Pt1 | 1.4 Privileged Access Management (PAM) | Advanced ZT | 12.5 | Identification of necessary attributes (Users, Groups, etc.) are automated and integrated into the Privileged Access Management (PAM) solution. Privilege access requests are migrated to the PAM solution for automated approvals and denials. | Identified accounts, applications, devices, and data of concern (of greatest risk to DoD mission); Using PAM tools, applied JIT/JEA access to high-risk accounts; Privileged access requests are automated as appropriate | IA-12 (4) in-person validation and verification; AC-3 (14) individual access; CM-8 (4) accountability information; | Implement System and Mitigate Privileged Users Pt2 | Real time Approvals & JIT/JEA Analytics Pt2 |\r\n| 1.4.4 | Real time Approvals & JIT/JEA Analytics Pt2 | 1.4 Privileged Access Management (PAM) | Advanced ZT | 8.9 | DoD Organizations integrate User & Entity Behavior Analytics (UEBA) and User Activity Monitoring (UAM) solutions with the Privileged Access Management (PAM) solution providing user pattern analytics for decision making. | UEBA or similar analytic system integrated with PAM tools for JIT/JEA account approvals | IA-4 (5) dynamic management; AC-2 (6) dynamic account management | Real time Approvals & JIT/JEA Analytics Pt1 | |\r\n| 1.5.1 | Organizational Identity Life-Cycle Management | 1.5 Identity Federation & User Credentialing | Target Level ZT | 14.8 | DoD Organizations establish a process for life cycle management of users both privileged and standard. Utilizing the Organizational Identity Provider (IdP) the process is implemented and followed by the maximum number of users. Any users who fall outside of the standard process are approved through risk-based exceptions to be evaluated regularly for decommission. | Standardized Identity Lifecycle Process | MA-5 (1) individuals without appropriate access | | Enterprise Identity Life-cycle Management Pt1 |\r\n| 1.5.2 | Enterprise Identity Life- Cycle Management Pt1 | 1.5 Identity Federation & User Credentialing | Target Level ZT | 11.7 | The DoD Enterprise works with Organizations to review and align the existing Identity Lifecycle Processes, policy, and standards. A finalized agreed upon policy and supporting process are developed and followed by the DoD Organizations. Utilizing the centralized or federated Identity Provider (IdP) and Identity & Access Management (IdAM) solutions, DoD Organizations implement the Enterprise Lifecycle Management process for the maximum number of identities, groups, and permissions. Exceptions to the policy are managed in a risk based methodical approach. | Automated Identity Lifecycle Processes; Integrated with Enterprise ICAM process and tools | | Organization Identity Life-cycle Management | Enterprise Identity Life-cycle Management Pt2 |\r\n| 1.5.3 | Enterprise Identity Life- Cycle Management Pt2 | 1.5 Identity Federation & User Credentialing | Advanced ZT | 12.8 | DoD Organizations further integrate the critical automation functions of the Identity Provider (IdP) and Identity, Credential and Access Management (ICAM) solutions following the Enterprise Lifecycle Management process to enable Enterprise automation and analytics. Identity Lifecycle Management primary processes are integrated into the cloud-based Enterprise ICAM solution. | Integration w/ Critical IDM/IDP functions; Primary ILM functions are cloud based | | Enterprise Identity Life-cycle Management Pt1 | Enterprise Identity Life-cycle Management Pt3 |\r\n| | | | | | | | | | |\r\n| 1.5.4 | Enterprise Identity Life- Cycle Management Pt3 | 1.5 Identity Federation & User Credentialing | Advanced ZT | 9.2 | DoD Organizations integrate remaining Identity Lifecycle Management processes with the Enterprise Identity, Credential and Access Management solution. Enclave/DDIL environments while still authorized to operate integrate with the Enterprise ICAM using local connectors to the cloud environment. | All ILM functions moved to cloud as appropriate; Integration with all IDM/IDP functions | | Enterprise Identity Life-cycle Management Pt2 | |\r\n| 1.6.1 | Implement User & Entity Behavior Activity (UEBA) and User Activity Monitoring (UAM) Tooling | 1.6 Behavioral, Contextual ID, and Biometrics | Target Level ZT | 15.9 | DoD Organizations procure and implement User & Entity Behavior Analytics (UEBA) and User Activity Monitoring (UAM) solutions. Initial integration point with Enterprise IdP is completed enabling future usage in decision making. | UEBA and UAM functionality is implemented for Enterprise IDP | | | Establish User Baseline Behavior; Baseline & Profiling Pt1 |\r\n| 1.6.2 | User Activity Monitoring Pt1 | 1.6 Behavioral, Contextual ID, and Biometrics | Advanced ZT | 13.5 | DoD Organizations integrate User & Entity Behavior Analytics (UEBA) and User Activity Monitoring (UAM) solutions with Organizational Identity Providers (IdP) for extended visibility as needed. Analytics and data generated by UEBA and UAM for critical applications/services are integrated with the Just-in-Time and Just-Enough-Access solution improving decision making further. | UEBA is integrated with Org IDPs as appropriate; UEBA is integrated with JIT/JEA for critical services | | User/Device Baselines | User Activity Monitoring Pt2 |\r\n| 1.6.3 | User Activity Monitoring Pt2 | 1.6 Behavioral, Contextual ID, and Biometrics | Advanced ZT | 11.2 | DoD Organizations continue the analytics usage from User & Entity Behavior Analytics (UEBA) and User Activity Monitoring (UAM) solutions by using generated data for all monitored applications and services when decision making occurs in the Just-in-Time and Just- Enough-Access solution. | UEBA/Entity Monitoring is integrated with JIT/JEA for all services | | User Activity Monitoring Pt1 | Real-Time Access Decisions; AI- enabled Dynamic Access Control; Enrich Attributes for Resource Authorization Pt1; AI-enabled Network Access |\r\n| 1.7.1 | Deny User by Default Policy | 1.7 Least Privileged Access | Target Level ZT | 22.7 | DoD Organizations audit internal user and group usage for permissions and revoke permissions when possible. This activity includes the revocation and/or decommission of excess permissions and access for application/service-based identities and groups. Where possible static privileged users are decommissioned or reduced permissions preparing for future rule/dynamic based access. | Applications updated to deny by default to functions/data requiring specific roles/attributes for access; Reduced default permissions levels are implemented; Applications/services have reviewed/audited all privileged users and removed those users who do not need that level of access; Applications' identify functions and data requiring specific roles/attributes for access | AC-17 (10) authenticate remote commands; SC-7 (15) networked privileged access | | |\r\n| 1.8.1 | Single Authentication | 1.8 Continuous Authentication | Target Level ZT | 19.2 | DoD Organizations employ basic authentication processes to authenticate users and NPEs at least once per session (e.g., logon). Importantly users being authenticated are managed by the parallel activity “Organizational MFA/IDP” with the Organizational Identity Provider (IdP) versus using application/service-based identities and groups. | Authentication implemented across applications per session | | | Periodic Authentication; Rule Based Dynamic Access Pt1 |\r\n| 1.8.2 | Periodic Authentication | 1.8 Continuous Authentication | Target Level ZT | 25.4 | DoD Organizations enable period authentication requirements for applications and services. Traditionally these are based on duration and/or duration timeout but other period based analytics can be used to mandate re-authentication of user sessions. | Authentication implemented multiple times per session based on security attributes | | Single Authentication | Continuous Authentication Pt1; AI- enabled Network Access |\r\n| 1.8.3 | Continuous Authentication Pt 1 | 1.8 Continuous Authentication | Advanced ZT | 16.8 | DoD Organizations’ applications/service utilize multiple session authentications based on security attributes and access requested. Privilege changes and associational transaction requests required additional levels of authentication such as Multi-Factor Authentication (MFA) pushes to users. | Transaction authentication implemented per session based on security attributes | | Periodic Authentication | Continuous Authentication Pt2 |\r\n| 1.8.4 | Continuous Authentication Pt 2 | 1.8 Continuous Authentication | Advanced ZT | 16.8 | DoD Organizations continue usage of transaction-based authentication to include integration such as user patterns. | Transaction authentication implemented per session based on security attributes | | Continuous Authentication Pt1 | Real-Time Access Decisions; AI- enabled Dynamic Access Control |\r\n| 1.9.1 | Enterprise PKI/IDP Pt1 | 1.9 Integrated ICAM Platform | Target Level ZT | 12.4 | The DoD Enterprise works with Organizations to implement Enterprise Public Key Infrastructure (PKI) and Identity Provider (IdP) solutions in a centralized and/or federated fashion. The Enterprise PKI solution utilizes a single or set of Enterprise level Root Certificate Authorities (CA) which can then be trusted by Organizations to build Intermediate CA’s off. The Identity Provider solution may either be a single solution or federated set of Organizational IdPs with standard level of access across Organizations and standardized set of attributes. Organizations’ IdPs and PKI Certificated Authorities are integrated with the Enterprise IdP and PKI solutions. | Components are using IdP with MFA for all applications/services; Organizational MFA/PKI integrated with Enterprise MFA/PKI; Organizational Standardized PKI for all services | | | Enterprise PKI/IDP Pt2 |\r\n| 1.9.2 | Enterprise PKI/IDP Pt2 | 1.9 Integrated ICAM Platform | Advanced ZT | 27.2 | DoD Organizations enable Biometric support in the Identity Provider (IdP) for mission/task-critical applications and services as appropriate. Biometric functionality is moved from Organizational solutions to the Enterprise. Organizational Multi-Factor (MFA) and Public Key Infrastructure (PKI) is decommissioned and migrated to the Enterprise as appropriate. | Critical Organizational Services Integrated w/ Biometrics; Decommission organizational MFA/PKI as appropriate in leu of enterprise MFA/PKI; Enterprise Biometric Functions Implemented | | Enterprise PKI/IDP Pt1 | Enterprise PKI/IDP Pt3 |\r\n| 1.9.3 | Enterprise PKI/IDP Pt3 | 1.9 Integrated ICAM Platform | Advanced ZT | 30.0 | DoD Organizations integrate the remaining applications/services with Biometrics functionalities. Alternative Multi-Factor (MFA) tokens can be used. | All Organizational Services Integrate w/ Biometrics | | Enterprise PKI/IDP Pt2 | |\r\n| 2.1.1 | Device Health Tool Gap Analysis | 2.1 Device Inventory | Target Level ZT | 9.8 | DoD Organizations develop a manual inventory of devices within the environment. Device attributes tracked in the inventory enable functionality outlined in the ZTA target level. | Manual inventory of devices is created per organization w/ owners | | | |\r\n| 2.1.2 | NPE/PKI, Device under Management | 2.1 Device Inventory | Target Level ZT | 22.8 | DoD Organizations utilize the DoD Enterprise PKI solution/service to deploy x509 certificates to all supported and managed devices. Additional other Non-Person Entities (NPEs) that support x509 certificates are assigned in the PKI and/or IdP systems. | Non-person entities are managed via Org PKI and Org IDP | | Enterprise Device Management Pt1 | Implement C2C/Compliance Based Network Authorization Pt1; Enterprise PKI Pt1; Deny Device by Default Policy |\r\n| 2.1.3 | Enterprise IDP Pt1 | 2.1 Device Inventory | Target Level ZT | 12.8 | The DoD Enterprise Identity Provider (IdP) either using a centralized technology or federated organizational technologies integrates Non- Person Entities (NPEs) such as devices and service accounts. Integration is tracked in the Enterprise Device Management solution when applicable as to whether it is integrated or not. NPEs not able to be integrated with the IdP are either marked for retirement or excepted using a risk based methodical approach. | NPEs including devices are integrated with Enterprise IDP | IA-3 (4) device attestation | | Enterprise IDP Pt2 |\r\n| 2.1.4 | Enterprise IDP Pt2 | 2.1 Device Inventory | Advanced ZT | 8.8 | The DoD Enterprise Identity Provider (IdP) either using a centralized technology or federated organizational technologies adds additional dynamic attributes for NPEs such as location, usage patterns, etc. | Conditional device attributes are part of the IdP profile | | Enterprise IDP Pt1 | |\r\n| 2.2.1 | Implement C2C/Compliance Based Network Authorization Pt1 | 2.2 Device Detection and Compliance | Target Level ZT | 9.4 | The DoD Enterprise working with the Organizations develops a policy, standard and requirements for Comply to Connect. Once agreement is reached solution procurement is started, a vendor(s) is selected, and implementation begins with base level functionality in ZT Target environments (low risk). Base level checks are implemented in the new Comply to Connection solution enabling the ability to meet ZTA target functionalities. | C2C is enforced at the enterprise level for low risk and testing environments; Basic devices checks are implemented using C2C | AC-20 (5) network accessible storage devices – prohibited use | NPE/PKI Device Under Management; Integrate NextGen AV Tools with C2C; Managed and Limited BYOD & IOT Support; Implement Asset, Vulnerability and Patch Management Tools | Implement C2C/Compliance Based Network Authorization Pt2 |\r\n| 2.2.2 | Implement C2C/Compliance Based Network Authorization Pt2 | 2.2 Device Detection and Compliance | Advanced ZT | 18.2 | DoD Organizations expand the deployment and usage of Comply to Connect to all supported environments required to meet ZT advanced functionalities. Comply to Connect teams integrate their solution(s) with the Enterprise IdP and Authorization Gateways to better manage access and authorizations to resources. | C2C is enforced in all supported environments; Advanced devices checks are completed and integrated with dynamic access (Enterprise IDP / ZTNA) | | Implement C2C/Compliance Based Network Authorization Pt1; Fully Integrate Device Security Stack w/ C2C as appropriate | Real-Time Access Decisions |\r\n| 2.3.1 | Entity Activity Monitoring Pt1 | 2.3 Device Authorization w/ Real Time Inspection | Advanced ZT | 16.4 | Using the developed User and Device baselines, DoD Organizations utilize the implemented User and Entity Behavioral Activity (UEBA) solution to integrate baselines. UEBA device attributes and baselines are available to be used for device authorization detections. | UEBA attributes are integrated for device baselining; UEBA attributes are available for usage with device access | | User/Device Baselines; Implement User & Entity Behavior Activity (UEBA); User Activity Monitoring Tooling | Entity Activity Monitoring Pt2 |\r\n| 2.3.2 | Entity Activity Monitoring Pt2 | 2.3 Device Authorization w/ Real Time Inspection | Advanced ZT | 16.7 | DoD Organizations utilize the User and Entity Behavioral Activity (UEBA) solution with network access solutions to mandate UEBA attributes (e.g., device health, logon patterns, etc.) for accessing environments and resources. | UEBA attributes are mandated for device access | | Entity Activity Monitoring Pt1 | Real-Time Access Decisions; AI- enabled Dynamic Access Control; Enrich Attributes for Resource Authorization Pt1; AI-enabled Network Access |\r\n| 2.3.3 | Implement Application Control & File Integrity Monitoring (FIM) Tools | 2.3 Device Authorization w/ Real Time Inspection | Target Level ZT | 16.2 | DoD Organizations procure and implement File Integrity Monitoring (FIM) and Application Control solutions. FIM continues development and expansion of monitoring in the Data Pillar. Application Control is deployed to low-risk environments in a monitor only mode establishing baseline allowances. Application control teams being integration with the Enterprise and Organization PKI environments utilize certificates for application allowances. NextGen AV covers all possible services and applications. | AppControl and FIM tooling is implemented on all critical services/applications; EDR tooling covers maximum amount of services/applications; AppControl and FIM data is sent to C2C as needed | | | |\r\n| 2.3.4 | Integrate NextGen AV Tools with C2C | 2.3 Device Authorization w/ Real Time Inspection | Target Level ZT | 18.5 | DoD Organizations procure and implement Next Generation Anti-Virus & Anti-Malware solutions as needed. These solutions are integrated with the initial deployment of Comply to Connect for baseline status checks of signatures, updates, etc. | Critical NextGen AV data is being sent to C2C for checkslll; NextGen AV tooling is implemented on all critical services/applicationslll | | | Implement C2C/Compliance Based Network Authorization Pt1 |\r\n| 2.3.5 | Fully Integrate Device Security stack with C2C as appropriate | 2.3 Device Authorization w/ Real Time Inspection | Advanced ZT | 13.3 | DoD Organizations continue the deployment of Application Control to all environments and in prevention mode. File Integrity Monitoring (FIM) and Application Controls analytics are integrated into Comply to Connect for expanded access decision making data points. Comply to Connect analytics are evaluated for further device/endpoint security stack data points such as UEDM and are integrated as necessary. | AppControl and FIM deployment is expanded to all necessary services/applications; Remaining data from Device Security tooling is implemented with C2C | | | Implement C2C/Compliance Based Network Authorization Pt2; Managed and Full BYOD & IOT Support Pt2 |\r\n| 2.3.6 | Enterprise PKI Pt1 | 2.3 Device Authorization w/ Real Time Inspection | Advanced ZT | 22.7 | The DoD Enterprise Public Key Infrastructure (PKI) is expanded to include the addition of NPE and device certificates. NPEs and device that do not support PKI certificates are marked for retirement and decommission starts. | Devices that are unable to have certificates are phased out and/or moved to minimal access environments; All devices and NPEs have certs installed for authentication in the Enterprise PKI | | Implement UEDM or equivalent Tools; NPE/PKI Device Under Management | Enterprise PKI Pt2 |\r\n| 2.3.7 | Enterprise PKI Pt2 | 2.3 Device Authorization w/ Real Time Inspection | Advanced ZT | 10.5 | DoD Organizations utilize certificates for device authentication and machine to machine communications. Unsupported devices complete retirement and exceptions are approved using a risk based methodical approach. | Devices are required to authenticate to communicate with other services and devices | | Enterprise PKI Pt1 | |\r\n| 2.4.1 | Deny Device by Default Policy | 2.4 Remote Access | Target Level ZT | 9.6 | DoD Organizations block all unmanaged remote and local device access to resources. Compliant managed devices are provided risk based methodical access following ZTA target level concepts. | Components can block device access by default to resources (apps/data) and explicitly allow compliant devices per policy; Remote Access is enabled following a \"deny device by default policy\" approach | | NPE/PKI Device Under Management | |\r\n| 2.4.2 | Managed and Limited BYOD & IOT Support | 2.4 Remote Access | Target Level ZT | 39.7 | DoD Organizations utilize Unified Endpoint and Device Management (UEDM) and similar solutions to ensure that managed Bring Your Own Device (BYOD) and Internet of Things (IoT) devices are fully integrated with Enterprise IdP enable user and device-based authorization are supported. Device access for all applications requires dynamic access policies. | All applications require dynamic permissions access for devices; BYOD and IOT device permissions are baselined and integrated with Enterprise IDP | | | Implement C2C/Compliance Based Network Authorization Pt1; Managed and Full BYOD & IOT Support Pt1 |\r\n| 2.4.3 | Managed and Full BYOD & IOT Support Pt1 | 2.4 Remote Access | Advanced ZT | 24.7 | DoD Organizations utilize Unified Endpoint and Device Management (UEDM) and similar solutions to enable access for managed and approved devices to Mission and Operational Critical services/applications using dynamic access policies. BYOD and Internet of Things (IoT) devices are required to meet standard baseline checks before authorization. | Only BYOD and IOT devices that meet mandated configuration standards allowed to access resources; Critical Services require dynamic access for devices | | Managed and Limited BYOD & IOT Support | Managed and Full BYOD & IOT Support Pt2 |\r\n| 2.4.4 | Managed and Full BYOD & IOT Support Pt2 | 2.4 Remote Access | Advanced ZT | 24.6 | DoD Organizations utilize Unified Endpoint and Device Management (UEDM) and similar solutions to enable access for unmanaged devices meeting device checks and standard baselines. All possible services/applications are integrated to allow access to managed devices. Unmanaged devices are integrated with services/applications based on risk driven methodical authorization approach. | All possible services require dynamic access for deviceslll | | Fully Integrate Device Security Stack w/ C2C as appropriate; Managed and Full BYOD & IOT Support Pt1 | |\r\n| 2.5.1 | Implement Asset, Vulnerability and Patch Management Tools | 2.5 Partially & Fully Automated Asset, Vulnerability and Patch Management | Target Level ZT | 18.4 | DoD Organizations implement solution(s) for managing assets/devices configurations, vulnerabilities, and patches. Using minimum compliance standards (e.g., STIGs, etc.) teams can confirm or deny managed device compliance. As part of the procurement and implementation process for solutions, APIs or other programmatic interfaces will be in scope for future levels of automation and integration. | Components can confirm if devices meet minimum compliance standards or not; Components have asset management, vulnerability, and patching systems with APIs that will enable integration across the systems | | | Implement C2C/Compliance Based Network Authorization Pt1 |\r\n| 2.6.1 | Implement UEDM or equivalent Tools | 2.6 Unified Endpoint Management (UEM) & Mobile Device Management (MDM) | Target Level ZT | 18.1 | DoD Organizations will work closely with the “Implement Asset, Vulnerability, and Patch Management tools” activity to procure and implement and Unified Endpoint and Device Management (UEDM) solution ensuring that requirements are integrated with the procurement process. Once a solution is procured the UEDM team(s) ensure that critical ZT target functionalities such as minimum compliance, asset management, and API support are in place. | Components can confirm if devices meet minimum compliance standards or not; Components have asset management system(s) for user devices (phones, desktops, laptops) that maintains IT compliance, which is reported up to DoD enterprise; Components asset management systems can programmatically, i.e., API, provide device compliance status and if it meets minimum standards | AC-7 (2) purge or wipe mobile device | | Enterprise PKI Pt1 |\r\n| 2.6.2 | Enterprise Device Management Pt1 | 2.6 Unified Endpoint Management (UEM) & Mobile Device Management (MDM) | Target Level ZT | 17.6 | DoD Organizations migrate the manual device inventory to an automated approach using the Unified Endpoint and Device Management solution. Approved devices are able to be managed regardless of location. Devices part of critical services are mandated to be managed by the Unified Endpoint and Device Management solution supporting automation. | Manual inventory is integrated with an automated management solution for critical services; Enable ZT Device Management (from any location with or without remote access) | | | NPE/PKI Device Under Management; Enterprise Device Management Pt2 |\r\n| 2.6.3 | Enterprise Device Management Pt2 | 2.6 Unified Endpoint Management (UEM) & Mobile Device Management (MDM) | Target Level ZT | 12.6 | DoD Organizations migrate the remaining devices to Enterprise Device Management solution. EDM solution is integrated with risk and compliance solutions as appropriate. | Manual inventory is integrated with an automated management solution for all services | | Enterprise Device Management Pt1 | |\r\n| 2.7.1 | Implement Endpoint Detection & Response (EDR) Tools and Integrate with C2C | 2.7 Endpoint & Extended Detection & Response (EDR & XDR) | Target Level ZT | 16.5 | DoD Organizations procure and implement Endpoint Detection and Response (EDR) solution(s) within environments. EDR is protecting, monitoring, and responding to malicious and anomalous activities enabling ZT Target functionality and is sending data to the Comply to Connection solution for expanded device and user checks. | Endpoint Detection & Response Tooling is implemented ; Critical EDR data is being sent to C2C for checks; NextGen AV tooling covers maximum amount of services/applications | | | Implement Extended Detection & Response (XDR) & Integrate w/ C2C Pt 1 |\r\n| 2.7.2 | Implement Extended Detection & Response (XDR) Tools and Integrate with C2C Pt1 | 2.7 Endpoint & Extended Detection & Response (EDR & XDR) | Target Level ZT | 19.2 | DoD Organizations procure and implement Extended Detection & Response (XDR) solution(s). Integration points with cross pillar capabilities are identified and prioritized based on risk. The riskiest of these integration points are actioned and integration is started. EDR continues coverage of endpoints to include the maximum number of services and applications as part of the XDR implementation. Basic analytics are sent from the XDR solution stack to the SIEM. | Integration Points have been identified per Capability; Riskiest integration points have been integrated w/ XDR; Basic alerting is in place with SIEM and/or other mechanisms | | Implement Endpoint Detection & Response (EDR) Tools & Integrate w/ C2C; Threat Alerting Pt1 | Implement Extended Detection & Response (XDR) & Integrate w/ C2C Pt 2 |\r\n| 2.7.3 | Implement Extended Detection & Response (XDR) Tools and Integrate with C2C Pt2 | 2.7 Endpoint & Extended Detection & Response (EDR & XDR) | Advanced ZT | 19.9 | XDR solution stack completes identification of integration points expanding coverage to the fullest amount possible. Exceptions are tracked and managed using a risk based methodical approach for continued operation. Extended analytics enabling ZT Advanced functionalities are integrated into the SIEM and other appropriate solutions. | Remaining integration points have been integrate as appropriate; Extended alerting and response is enabled with other Analytics tools at least using SIEM | | Implement Extended Detection & Response (XDR) & Integrate w/ C2C Pt 1 | Threat Alerting Pt3 |\r\n| 3.1.1 | Application/Code Identification | 3.1 Application Inventory | Target Level ZT | 16.7 | DoD Organizations create an inventory of approved applications and code (e.g., source code, libraries, etc.). Each organization will track the supportability (i.e., active, legacy, etc.) and hosted location (i.e., cloud, on-premise, hybrid, etc.) at least in the inventory. | Component has identified applications and classified as either legacy, virtualized on-premises, and cloud hosted | | | |\r\n| 3.1.2 | Resource Authorization Pt1 | 3.4 Resource Authorization & Integration | Target Level ZT | 18.5 | The DoD Enterprise standardizes on resource authorization approaches (e.g., Software Defined Perimeter) with the organizations. At a minimum the resource authorization gateways will be integrated with identities and devices. Organizations deploy approved resource authorization gateways and enable for external facing applications/services. Additional applications for migration and applications unable to be migrated are identified for exception or decommission. | Resource Authorization Gateway is in place for external facing applications; Resource Authorization policy integrated with identity and device; Enterprise-wide Guidance on conversion standards are communicated to stakeholders | | NPE/PKI, Device under Management Datacenter Macro segmentation | Resource Authorization Pt2 |\r\n| 3.1.3 | Resource Authorization Pt2 | 3.4 Resource Authorization & Integration | Target Level ZT | 20.6 | Resource authorization gateways are used for all possible applications/services. Application unable to utilize gateways are either decommissioned or excepted using a risk based methodical approach. Authorizations are further integrated with the CI/CD pipeline for automated decision making. | Resource Authorization gateway is utilized for all applications; Resource Authorization is integrated with DevSecOps and CI/CD for automated functions | | Resource Authorization Pt1 | |\r\n| 3.2.1 | Build DevSecOps Software Factory Pt1 | 3.2 Secure Software Development & Integration | Target Level ZT | 19.3 | The DoD enterprise creates the foundational standards for modern DevSecOps processes and CI/CD pipelines. The concepts are applied in a standardized technology stack across DoD organizations able to meet future Application Security requirements. An enterprise-wide Vulnerability Management program is integrated with the CI/CD pipelines following the Vulnerability Management Program activities. | Developed Data/Service Standards for DevSecOps; CI/CD Pipeline is fully functional and tested successfully; Vulnerability Management program is officially in place and operating | SC-3 (3) minimize nonsecurity functionality | | Build DevSecOps Software Factory Pt2 |\r\n| 3.2.2 | Build DevSecOps Software Factory Pt2 | 3.2 Secure Software Development & Integration | Target Level ZT | 10.8 | DoD Organizations will use their approved CI/CD pipelines to develop most new applications. Any exceptions will follow a standardized approval process to be allowed to develop in a legacy fashion. DevSecOps processes are also used to develop all new applications and update existing applications. Continual validation functions are integrated into the CI/CD pipelines and DevSecOps processes and integrated with existing applications. | Development of applications is migrated to CI/CD pipeline; Continual validation process/technology is implemented and in use; Development of applications is migrated to DevSecOps process and technology | AC-6 (4) separate processing domains; CM 7 (6) confined environments with limited privileges | Build DevSecOps Software Factory Pt1 | Continuous Authorization to Operate (cATO) Pt1 |\r\n| 3.2.3 | Automate Application Security & Code Remediation Pt1 | 3.2 Secure Software Development & Integration | Target Level ZT | 18.0 | A standardized approach to application security including code remediation is implemented across the DoD enterprise. Part one (1) of this activity includes the integration of a Secure API gateway with applications utilizing API or similar calls. Code reviews are conducted in a methodical approach and standardized protections for containers and their infrastructure are in place. Additionally, any serverless functions where the 3rd party manages the infrastructure such as Platform as a Service utilize adequate serverless security monitoring and response functions. Code Reviews, Container and Serverless security functions are integrated into the CI/CD and/or DevSecOps process appropriate. | Secure API Gateway is operational and majority of API calls are passing through gateway; Application Security functions (e.g., code review, container and serverless security) are implemented as part of CI/CD and DevSecOps | SI-7 (12) integrity verification; SI-7 (15) code authentication; SC-7 (21) isolation of system components; | Implement Asset, Vulnerability and Patch Management Tools | Automate Application Security & Code Remediation Pt2; REST API Micro-Segments |\r\n| 3.2.4 | Automate Application Security & Code Remediation Pt2 | 3.2 Secure Software Development & Integration | Advanced ZT | 16.2 | DoD Organizations modernize approaches to delivering internally developed and managed services following best practice approaches such as Microservices. These approaches will enable more resilient and secure architectures by allowing for quicker changes to code in each microservice as security issues are discovered. Further advancement security remediation activities continue across the DoD Enterprise with the inclusion of runtime security functions for containers as appropriate, automated vulnerable library updates and automated CI/CD approvals during the release process. | Secure API Gateway is operational and majority of API calls are passing through gateway; Services are provided following a Service Oriented Architecture (SOA); Security Remediation activities (e.g., runtime security, library updates, release approvals) are fully automated | CM-7 (7) code execution in protected environments; CM-14 Signed Components; SI-7 (17) runtime application self-protection | Automate Application Security & Code Remediation Pt1 | |\r\n| 3.3.1 | Approved Binaries/Code | 3.3 Software Risk Management | Target Level ZT | 23.4 | The DoD enterprise uses best practice approaches to manage approved binaries and code in a methodical approach. These approaches will include supplier sourcing risk management, approved repository usage, bill of materials supply chain risk management, and industry standard vulnerability management. | Supplier sourcing risk evaluated and identified for approved sources; Repository and update channel established for use by development teams; Bill of Materials is created for applications identify source, supportability and risk posture; Industry standard (DIB) and approved vulnerability databases are pulled in to be used in DevSecOps | SI-19 (7) validated algorithms and software | Vulnerability Management Program Pt1 | |\r\n| 3.3.2 | Vulnerability Management Program Pt1 | 3.3 Software Risk Management | Target Level ZT | 7.8 | The DoD Enterprise works with Organizations to establish and manage a Vulnerability Management program. The program includes a policy and standards agreed upon by all Organizations. The developed program includes at a minimum the track and management of public vulnerabilities based on DoD applications/services. Organizations establish a vulnerability management team with key stakeholders where vulnerabilities are discussed and managed following the Enterprise policy and standards. | Vulnerability Management Team is in place w/ appropriate stakeholder membership; Vulnerability Management policy and process is in place and agreed to w/ stakeholders; Public source of vulnerabilities are being utilized for tracking | SA-11 (2) threat modeling and vulnerability analyses | | Approved Binaries/Code; Vulnerability Management Program Pt2 |\r\n| 3.3.3 | Vulnerability Management Program Pt2 | 3.3 Software Risk Management | Target Level ZT | 12.1 | Processes are established at the DoD Enterprise level for managing the disclosure of vulnerabilities in DoD maintained/operated services both publicly and privately accessible. DoD Organizations expand the vulnerability management program to track and manage closed vulnerability repositories such as DIB, CERT, and others. | Controlled (e.g., DIB, CERT) sources of vulnerabilities are being utilized for tracking; Vulnerability management program has a process for accepting external/public disclosures for managed services | | Vulnerability Management Program Pt1 | Automate Application Security & Code Remediation Pt1 |\r\n| 3.3.4 | Continual Validation | 3.3 Software Risk Management | Target Level ZT | 11.1 | DoD Organizations will implement a continual validation approach for application development where parallel deployment is conducted and integrated with an approved environment level (e.g., UAT, Prod). Applications unable to integrate continual validation into their CI/CD process are identified and exceptions are provided as needed using a methodical approach. | Updated Applications are deployed in a live and/or production environment; Applications that were marked for retirement and transition are decommissioned; Continual validation tools are implemented and applied to code in the CI/CD pipeline; Code requiring continuous validation is identified and validation criteria are established | | | |\r\n| 3.4.1 | SDC Resource Authorization Pt1 | 3.4 Resource Authorization & Integration | Target Level ZT | 31.1 | The DoD Enterprise provides a standardized approach for code based compute management (i.e., Software Defined Compute) following industry best practices. Using risk-based approaches baselines are created using the approved set of code libraires and packages. DoD Organizations work with the approved code/binaries activities to ensure that applications are identified which can and cannot support the approach. Applications which can support a modern software- based configuration and management approaches are identified and transitioning begins. Applications which cannot follow software-based configuration and management approaches are identified and allowed through exception using a methodical approach. | Applications unable to be updated to use approved binaries/code are marked for retirement and transition plans are created; Identified applications without approved binaries and code are updated to use approved binaries/code; Enterprise-wide Guidance on conversion standards are communicated to stakeholders | | | SDC Resource Authorization Pt2 |\r\n| 3.4.2 | SDC Resource Authorization Pt2 | 3.4 Resource Authorization & Integration | Target Level ZT | 21.8 | Applications which support software-based configuration and management have been transitioned to a production/live environment and are in normal operations. Where possible applications which cannot support software-based configuration and management are decommissioned. | Updated Applications are deployed in a live and/or production environment; Applications that were marked for retirement and transition are decommissioned | | SDC Resource Authorization Pt1 | |\r\n| 3.4.3 | Enrich Attributes for Resource Authorization Pt1 | 3.4 Resource Authorization & Integration | Advanced ZT | 17.6 | Initial attributes from sources such as User and Entity Activity Monitoring, Micro-segmentation services, DLP and DRM are integrated into the Resource Authorization technology stack and policy. Any additional attributes for later integration are identified and planned. Attributes are used to create basic risk posture of users, NPEs and devices allowing for authorization decisions. | Most API calls are passing through the Secure API Gateway; Resource Authorization receives data from Analytics Engine; Authorization policies incorporate identified attributes in making authorization decisions; Attributes to be used for initial enrichment are identified; Identified attributes are assigned to resources and/or entities | SC-3 (2) access and flow control functions | User Activity Monitoring Pt2; Entity Activity Monitoring Pt2; Application & Device Micro segmentation; Manual Data Tagging Pt2; DLP Enforcement via Data Tags and Analytics Pt2; DRM Enforcement via Data Tags and Analytics Pt2 | Enrich Attributes for Resource Authorization Pt2 |\r\n| 3.4.4 | Enrich Attributes for Resource Authorization Pt2 | 3.4 Resource Authorization & Integration | Advanced ZT | 17.8 | Extended identified attributes are integrated with the resource authorization technology and policy. Confidence scoring is introduced across the attributes to create a more advanced method of authorization decision making in an automated fashion. | Authorization policies incorporate confidence levels in making authorization decisions; Confidence levels for attributes are defined | | Enrich Attributes for Resource Authorization Pt1 | |\r\n| 3.4.5 | REST API Micro-Segments | 3.4 Resource Authorization & Integration | Advanced ZT | 18.1 | Using the DoD Enterprise approved API gateway(s), application calls are micro-segmented only allowing authenticated and authorized access to specific destinations (e.g., microservices). When possible, API Micro-Segmentation consoles are integrated and aware of other Micro Segmentation consoles such as Software Defined Perimeter Controllers and/or Software Defined Networking Consoles. | Approved Enterprise APIs are Micro-Segmented appropriately | SC-39 (2) separate execution domain per thread | Automate Application Security & Code Remediation Pt1 | |\r\n| 3.5.1 | Continuous Authorization to Operate (cATO) Pt1 | 3.5 Continuous Monitoring and Ongoing Authorizations | Advanced ZT | 15.1 | DoD Organizations utilize automation solutions within the environment to standardize the monitoring of controls and offer the capability to identify deviations. Where appropriate monitoring and testing is integrated with DevSecOps processes. | Controls derivation is standardized and ready for automation; Controls testing is integrated with DevSecOps processes and technology | | Policy Inventory & Development; Build DevSecOps Software Factory Pt2 | Continuous Authorization to Operate (ATO) Pt2 |\r\n| 3.5.2 | Continuous Authorization to Operate (cATO) Pt2 | 3.5 Continuous Monitoring and Ongoing Authorizations | Advanced ZT | 21.8 | DoD Organizations fully automate control derivation, testing and monitoring processes. Deviations are automatically tested and resolved using existing cross pillar automation infrastructure. Dashboarding is used to monitor the status of authorizations and analytics are integrated with the responsible authorizing officials. | Controls testing is fully automated; Integration with standard IR and SOC operations is automated; Control derivation and applicability is fully automated; Dashboards are used to track continuing authorization status | | Continuous Authorization to Operate (ATO) Pt1; Threat Alerting Pt3; Automated Workflow | |\r\n| 4.1.1 | Data Analysis | 4.1 Data Catalog Risk Alignment | Target Level ZT | 17.4 | DoD Organizations update the service and application catalog(s) with data classifications. Data tags are also added to each service and application. | The service catalog is updated with data types for each application and service based on data classification levels | | | |\r\n| 4.2.1 | Define Data Tagging Standards | 4.2 DoD Enterprise Data Governance | Target Level ZT | 15.8 | The DoD Enterprise works with organizations to establish data tagging and classification standards based on industry best practices. Classifications are agreed upon and implemented in processes. Tags are identified as manual and automated for future activities. | Enterprise data classification and tagging standards are developed; Organizations align to enterprise standards and begin implementation | | | Implement Data Tagging & Classification Tools; Manual Data Tagging Pt1 |\r\n| 4.2.2 | Interoperability Standards | 4.2 DoD Enterprise Data Governance | Target Level ZT | 14.4 | The DoD Enterprise collaborating with the organizations develops interoperability standards integrating mandatory Data Rights Management (DRM) and Protection solutions with necessary technologies to enable ZT target functionality. | Formal standards are in place by the Enterprise for the appropriate data standards | | | Implement DRM and Protection Tools Pt1 |\r\n| 4.2.3 | Develop Software Defined Storage (SDS) Policy | 4.2 DoD Enterprise Data Governance | Target Level ZT | 9.9 | The DoD enterprise working with organizations establishes a software define storage (SDS) policy and standards based on industry best practices. DoD organizations evaluate current data storage strategy and technology for implementation of SDS. Where appropriate storage technology is identified for SDS implementation. | Determine need for SDS tool implementation; Policy for SDS is created at the enterprise and org levels | | | Integrate DAAS Access w/ SDS Policy Pt1; Integrate Solution & Policy w/ Enterprise IDP Pt1 |\r\n| 4.3.1 | Implement Data Tagging & Classification Tools | 4.3 Data Labeling and Tagging | Target Level ZT | 15.9 | DoD Organizations utilize the enterprise standard and requirements to implement data tagging and classification solution(s). Organizations ensure that future ML and AI integrations are supported by solutions through DoD enterprise requirements. | A requirement of Data classification and tagging tools must include integration and/or support of Machine Learning (ML); Data classification and tagging tools are implemented at org and enterprise levels | | Define Data Tagging Standards | Implement Enforcement Points |\r\n| 4.3.2 | Manual Data Tagging Pt1 | 4.3 Data Labeling and Tagging | Target Level ZT | 17.6 | Using the DoD Enterprise data tagging and classification policy and standards, manual tagging starts using basic data level attributes to meet ZT target functionality. | Manual data tagging begins at the enterprise level with basic attributes | SI-18 (2) data tags | Define Data Tagging Standards | Manual Data Tagging Pt2; DRM Enforcement via Data Tags and Analytics Pt1; DLP Enforcement via Data Tags and Analytics Pt1 |\r\n| 4.3.3 | Manual Data Tagging Pt2 | 4.3 Data Labeling and Tagging | Advanced ZT | 16.1 | DoD organizational specific data level attributes are integrated into the manual data tagging process. DoD enterprise and organizations collaborate to decide which attributes are required to meet ZTA advanced functionality. Data level attributes for ZTA advanced functionality are standardized across the enterprise and incorporated. | Manual data tagging is expanded to the program/org levels with specific attributes | AC-4 (6) metadata | Manual Data Tagging Pt1 | Enrich Attributes for Resource Authorization Pt1 |\r\n| 4.3.4 | Automated Data Tagging & Support Pt1 | 4.3 Data Labeling and Tagging | Advanced ZT | 14.1 | DoD Organizations use data loss prevention, rights management, and/or protection solutions to conduct scanning of data repositories. Standardized tags are applied to supported data repositories and data types. Unsupported data repositories and types are identified. | Basic automation begins by scanning data repositories and applying tags | | Implement Data Tagging & Classification ML Tools | Automated Data Tagging & Support Pt2 |\r\n| 4.3.5 | Automated Data Tagging & Support Pt2 | 4.3 Data Labeling and Tagging | Advanced ZT | 38.8 | Remaining supported data repositories have basic and extended data tags which are applied using machine learning and artificial intelligence. Extended data tags are applied to existing repositories. Unsupported data repositories and data types are evaluated for decommissioning using a risk based methodical approach. Approved exceptions utilize manual data tagging approaches with data owners and/or custodians to manage tagging. | Full automation of data tagging is completed; Results of data tagging are fed into ML algorithms to develop AI driven data tagging | | Automated Data Tagging & Support Pt1 | |\r\n| 4.4.1 | DLP Enforcement Point Logging and Analysis | 4.4 Data Monitoring and Sensing | Target Level ZT | 10.8 | DoD Organizations identify data loss prevention (DLP) enforcement points such as specific services and user endpoints. Using the established DoD Enterprise cybersecurity incident response standard, DoD organizations ensure the appropriate detail of data is captured. Additionally, protection, detection, and response use cases are developed to better outline solution coverage. | Enforcement points are identified; Standardized Logging schema is enforced at the enterprise and org levels | AC-3 (8) revocation of access authorizations | | Comprehensive Data Activity Monitoring |\r\n| 4.4.2 | DRM Enforcement Point Logging and Analysis | 4.4 Data Monitoring and Sensing | Target Level ZT | 12.6 | DoD Organizations identify data rights management (DRM) enforcement points such as specific services and user endpoints. Using the established DoD Enterprise cybersecurity incident response standard, DoD organizations ensure the appropriate detail of data is captured. Additionally, protection, detection, and response use cases are developed to better outline solution coverage. | Enforcement points are identified; Standardized Logging schema is enforced at the enterprise and org levels | | | Comprehensive Data Activity Monitoring |\r\n| 4.4.3 | File Activity Monitoring Pt1 | 4.4 Data Monitoring and Sensing | Target Level ZT | 16.8 | DoD Organizations utilize File Monitoring tools to monitor the most critical data classification levels in applications, services, and repositories. Analytics from monitoring is fed into the SIEM with basic data attributes to accomplish ZT Target functionality. | Data and files of critical classification are actively being monitored; Basic Integration is in place with monitoring system such as the SIEM | MP-8 (3) controlled unclassified information | | File Activity Monitoring Pt2 |\r\n| 4.4.4 | File Activity Monitoring Pt2 | 4.4 Data Monitoring and Sensing | Target Level ZT | 18.9 | DoD Organizations utilize File Monitoring tools to monitor all regulatory protected data (e.g., CUI, PII, PHI, etc.) in applications, services, and repositories. Extended integration is used to send data to appropriate inter/intra-pillar solutions such as Data Loss Prevention, Data Rights Management/Protection and User & Entity Behavior Analytics. | Data and files of all regulated classifications are actively being monitored; Extended integrations are in place as appropriate to further manage risk | MP-8 (4) classified information | File Activity Monitoring Pt1 | Rule Based Dynamic Access Pt2; Database Activity Monitoring |\r\n| 4.4.5 | Database Activity Monitoring | 4.4 Data Monitoring and Sensing | Advanced ZT | 18.2 | DoD Organizations procure, implement, and utilize Database Monitor solutions to monitor all databases containing regulated data types (CUI, PII, PHI, etc.). Logs and analytics from the database monitoring solution are fed to the SIEM for monitoring and response. Analytics are fed into cross pillar activities such as \"Enterprise Security Profile\" and \"Real Time Access\" to better direct decision making. | Appropriate Database are being actively monitored; Monitoring technology is integrated with solutions such as SIEM, PDP and Dynamic Access Control mechanisms | | File Activity Monitoring Pt2 | Comprehensive Data Activity Monitoring |\r\n| 4.4.6 | Comprehensive Data Activity Monitoring | 4.4 Data Monitoring and Sensing | Advanced ZT | 27.2 | DoD Organizations expand monitoring of data repositories including databases as appropriate based on a methodical risk approach. Additional data attributes to meet the ZT Advanced functionalities are integrated into the analytics for additional integrations. | Data Activity monitoring mechanisms are integrated to provide a unified view of monitoring across data repositories; Appropriate integrations exist with solutions such as SIEM and PDP | | DLP Enforcement Point Logging and Analysis; DRM Enforcement Point Logging and Analysis; Database Activity Monitoring | AI-enabled Dynamic Access Control; FF Baseline & Profiling Pt. 2; AI- enabled Network Access |\r\n| 4.5.1 | Implement DRM and Protection Tools Pt1 | 4.5 Data Encryption & Rights Management | Target Level ZT | 11.7 | DoD Organizations procure and implement DRM and Protection solution(s) as needed following the DoD Enterprise standard and requirements. Newly implement DRM and protection solution(s) are implemented with high risk data repositories using ZTA target level protections. | DRM and protection tools are enabled for high risk data repositories with basic protections | AU-9 (2) store on separate physical systems or components | Interoperability Standards | Implement DRM and Protection Tools Pt2 |\r\n| 4.5.2 | Implement DRM and Protection Tools Pt2 | 4.5 Data Encryption & Rights Management | Target Level ZT | 22.0 | DRM and protection coverage is expanded to cover all in scope data repositories. Encryption keys are automatically managed to meet best practices (e.g., FIPS). Extended data protection attributes are implemented based on the environment classification. | DRM and protection tools are enabled for possible repositories | AC-3 (9) controlled release; MP-6 (8) remote purging or wiping of information; SI-19 (4) removal, masking, encryption, hashing, or replacement of direct identifiers | Implement DRM and Protection Tools Pt1 | |\r\n| 4.5.3 | DRM Enforcement via Data Tags and Analytics Pt1 | 4.5 Data Encryption & Rights Management | Target Level ZT | 16.2 | Data rights management (DRM) and protection solutions are integrated with basic data tags defined by the DoD Enterprise standard. Initial data repositories are monitored and have protect and response actions enabled. Data at rest is encrypted in repositories. | Data Tags are integrated with DRM and monitored repositories are expanded; Based on data tags, data is encrypted at rest | | Manual Data Tagging Pt1 | DRM Enforcement via Data Tags and Analytics Pt2 |\r\n| 4.5.4 | DRM Enforcement via Data Tags and Analytics Pt2 | 4.5 Data Encryption & Rights Management | Advanced ZT | 19.0 | Extended data repositories are protected with DRM and Protection solutions. DoD Organizations implement extended data tags applicable to organizations versus mandated enterprise. Data is encrypted in extended repositories using additional tags. | All applicable data repositories are protected using DRM; Data is encrypted using extended data tags from the org levels | SC-16 (3) cryptographic binding | DRM Enforcement via Data Tags and Analytics Pt1 | Enrich Attributes for Resource Authorization Pt1; DRM Enforcement via Data Tags and Analytics Pt3 |\r\n| 4.5.5 | DRM Enforcement via Data Tags and Analytics Pt3 | 4.5 Data Encryption & Rights Management | Advanced ZT | 23.3 | DRM and Protection solutions integrate with AI and ML tooling for encryption, rights management and protection functions. | Analytics from ML/AI are integrated with DRM to better automate protections; Encryption protection is integrated with AI/ML and updated encryption methods are used as needed | AC-4 (19) validation of metadata | DRM Enforcement via Data Tags and Analytics Pt2 | |\r\n| 4.6.1 | Implement Enforcement Points | 4.6 Data Loss Prevention (DLP) | Target Level ZT | 21.2 | Data loss prevention (DLP) solution is deployed to the in-scope enforcement points. DLP solution is set to “monitor-only” and/or “learning” mode limiting impact. DLP solution results are analyzed, and policy is fine tuned to manage risk to an acceptable level. | Identified enforcement points have DLP tool deployed and set to monitor mode with standardized logging | | Implement Data Tagging & Classification Tools | Process Micro segmentation |\r\n| 4.6.2 | DLP Enforcement via Data Tags and Analytics Pt1 | 4.6 Data Loss Prevention (DLP) | Target Level ZT | 21.3 | Data loss prevention (DLP) solution is updated from monitor only mode to prevention mode. Basic data tags are utilized for DLP solution and logging schema is integrated. | Enforcement Points to set to prevent mode integrating the logging schema and manual tags | | Manual Data Tagging Pt1 | DLP Enforcement via Data Tags and Analytics Pt2 |\r\n| 4.6.3 | DLP Enforcement via Data Tags and Analytics Pt2 | 4.6 Data Loss Prevention (DLP) | Advanced ZT | 19.0 | Data loss prevention (DLP) solution is updated to include extended data tags based on parallel Automation activities. | Enforcement points have extended data tag attributes applied for additional prevention | | DLP Enforcement via Data Tags and Analytics Pt1 | Enrich Attributes for Resource Authorization Pt1; DLP Enforcement via Data Tags and Analytics Pt3 |\r\n| 4.6.4 | DLP Enforcement via Data Tags and Analytics Pt3 | 4.6 Data Loss Prevention (DLP) | Advanced ZT | 41.6 | Data loss prevention (DLP) solution is integrated with automated data tagging techniques to include any missing enforcement points and tags. | Automated tagging attributes are integrated with DLP and resulting metrics are used for ML | | DLP Enforcement via Data Tags and Analytics Pt2 | |\r\n| 4.7.1 | Integrate DAAS Access w/ SDS Policy Pt1 | 4.7 Data Access Control | Target Level ZT | 15.3 | Utilizing the DoD enterprise SDS policy, organizational DAAS policy is developed with intended integration in mind. SDS implementation guide is developed by DoD organizations due to environment specific nature. | Attribute base fine-grained DAAS policy is developed w/ enterprise and org level support; SDS Integration plan is developed to support DAAS policy | | Develop Software Defined Storage (SDS) Policy | Integrate DAAS Access w/ SDS Policy Pt2 |\r\n| 4.7.2 | Integrate DAAS Access w/ SDS Policy Pt2 | 4.7 Data Access Control | Advanced ZT | 12.6 | DoD Organizations implement the DAAS policy in an automated fashion. | Attribute based fine-grained DAAS Policy implemented in an automated fashion | | Integrate DAAS Access w/ SDS Policy Pt1; Implement SDS Tool and/or Integrate w/ DRM Tool Pt1 | Integrate DAAS Access w/ SDS Policy Pt3 |\r\n| 4.7.3 | Integrate DAAS Access w/ SDS Policy Pt3 | 4.7 Data Access Control | Advanced ZT | 9.2 | Newly implemented SDS technology and/or functionalities are integrated with the DAAS policy in a risk-based fashion. A phased approach should be taken to during implementation to measure results and adjust accordingly. | SDS is integrated with DAAS policy functionality; all data in all applications are protected with attribute based fine- grained DAAS policy | | Integrate DAAS Access w/ SDS Policy Pt2 | |\r\n| 4.7.4 | Integrate Solution(s) and Policy with Enterprise IDP Pt1 | 4.7 Data Access Control | Target Level ZT | 13.9 | DoD Organizations develop an integration plan using the SDS policy and technology/functionality with the enterprise Identity Provider (IdP) solution. | Integration plan between SDS and authoritative Identity Provider is developed to support existing DAAS access | | Develop Software Defined Storage (SDS) Policy; Enterprise IDP Pt1 | Integrate Solution & Policy w/ Enterprise IDP Pt2 |\r\n| 4.7.5 | Integrate Solution(s) and Policy with Enterprise IDP Pt2 | 4.7 Data Access Control | Advanced ZT | 9.2 | Newly implemented SDS technology and/or functionalities are integrated with the Enterprise Identity Provider (IdP) following the integration plan. Identity attributes required to meet ZT Target functionalities are required for integration. | Complete integration with Enterprise IDP and SDS toolingto support all attribute based fine-grained DAAS access | | Integrate Solution & Policy w/ Enterprise IDP Pt1 | |\r\n| 4.7.6 | Implement SDS Tool and/or integrate with DRM Tool Pt1 | 4.7 Data Access Control | Advanced ZT | 17.4 | Depending on the need for a Software Defined Storage tool, a new solution is implemented or an existing solution is identified meeting the functionality requirements to be integrated with DLP, DRM/Protection, and ML solutions. | If tooling is needed ensure there is supported integrations with DLP, DRM and ML tooling | | Develop Software Defined Storage (SDS) Policy; Integrate Solution & Policy w/ Enterprise IDP Pt1 | Integrate DAAS Access w/ SDS Policy Pt2; Implement SDS Tool and/or Integrate w/ DRM Tool Pt2 |\r\n| 4.7.7 | Implement SDS Tool and/or integrate with DRM Tool Pt2 | 4.7 Data Access Control | Advanced ZT | 15.3 | DoD Organizations configure the SDS functionality and/or solution to be integrated with the underlying DLP and DRM/Protection infrastructure as appropriate. Lower-level integrations enable more effective protection and response. | Integrate SDS infrastructure with existing DLP and DRM infrastructure | | Implement SDS Tool and/or Integrate w/ DRM Tool Pt1 | |\r\n| 5.1.1 | Define Granular Control Access Rules & Policies Pt1 | 5.1 Data Flow Mapping | Target Level ZT | 10.3 | The DoD Enterprise working with the Organizations creates granular network access rules and policies. Associated Concept of Operations (ConOps) are developed in alignment with access policies as well ensure future supportability. Once agreed upon, DoD Organizations will implement these access policies into existing network technologies (e.g., Next Generation Firewalls, Intrusion Prevention Systems, etc.) to improve initial risk levels. | Provide Technical Standards; Develop Concept of Operations; Identify Communities of Interest | | | Define SDN APIs; Define Granular Control Access Rules & Policies Pt2 |\r\n| 5.1.2 | Define Granular Control Access Rules & Policies Pt2 | 5.1 Data Flow Mapping | Target Level ZT | 8.0 | DoD Organizations utilize data tagging and classification standards to develop data filters for API access to the SDN Infrastructure. API Decision Points are formalized within the SDN architecture and implemented with non-mission/task critical applications and services. | Define Data Tagging Filters for API Infrastructure | | Define Granular Control Access Rules & Policies Pt1 | |\r\n| 5.2.1 | Define SDN APIs | 5.2 Software Defined Networking (SDN) | Target Level ZT | 8.3 | The DoD Enterprise works with the Organizations to define the necessary APIs and other programmatic interfaces to enable Software Defined Networking (SDN) functionalities. These APIs will enable Authentication Decision Point, Application Delivery Control Proxy and Segmentation Gateways automation. | SDN APIs are standardized and implemented; APIs are functional for AuthN Decision Point, App Delivery Control Proxy and Segmentation Gateways | | Define Granular Control Access Rules & Policies Pt1 | Implement SDN Programable Infrastructure |\r\n| 5.2.2 | Implement SDN Programable Infrastructure | 5.2 Software Defined Networking (SDN) | Target Level ZT | 32.0 | Following the API standards, requirements and SDN API functionalities, DoD Organizations will implement Software Defined Networking (SDN) infrastructure to enable automation tasks. Segmentation Gateways and Authentication Decision Points are integrated into the SDN infrastructure along with output logging into a standardized repository (e.g., SIEM, Log Analytics) for monitoring and alerting. | Implemented Application Delivery Control Proxy; Established SIEM Logging Activities; Implemented User Activity Monitoring (UAM); Integrated with Authentication Decision Point; Implemented Segmentation Gateways | | Define SDN APIs; Standardized API Calls & Schemas Pt1 | |\r\n| 5.2.3 | Segment Flows into Control, Management, and Data Planes | 5.2 Software Defined Networking (SDN) | Target Level ZT | 13.0 | Network infrastructure and flows are segmented either physically or logically into control, management, and data planes. Basic segmentation using IPv6/VLAN approaches is implemented to better organize traffic across data planes. Analytics and NetFlow from the updated infrastructure is automatically fed into Operations Centers and analytics tools. | IPv6 Segmentation; Enable Automated NetOps Information Reporting; Ensure Configuration Control Across Enterprise; Integrated with SOAR | AC-4 (21) physical or logical separation of information flows | | B/C/P/S Macro segmentation; Application & Device Micro segmentation |\r\n| 5.2.4 | Network Asset Discovery & Optimization | 5.2 Software Defined Networking (SDN) | Advanced ZT | 30.2 | DoD Organizations automate network asset discovery through the SDN infrastructure limiting access to devices based on risk based methodical approaches. Optimization is conducted based on the SDN analytics to improve overall performance along with provide necessary approved access to resources. | Technical Refreshment/Technology Evolution; Provide Optimization/Performance Controls | | | |\r\n| 5.2.5 | Real-Time Access Decisions | 5.2 Software Defined Networking (SDN) | Advanced ZT | 15.6 | SDN Infrastructure utilizes cross Pillar data sources such as User Activity Monitoring, Entity Activity Monitoring, Enterprise Security Profiles and more for real-time access decisions. Machine learning is used to assist decision making based on advanced network analytics (full packet capture, etc.). Policies are consistently implemented across the Enterprise using unified access standards. | Analyze SIEM Logs with Analytics Engine to Provide Real- Time Policy Access Decisions; Support Sending Captured Packets, Data/Network Flows, and other Specific Logs for Analytics; Segment End-to-End Transport Network Flows; Audit Security Policies for Consistency across Enterprise; Protect Data-in-Transit During Coalition Information Sharing | | Continuous Authentication Pt2; User Activity Monitoring Pt2; Implement C2C/Compliance Based Network Authorization Pt2; Entity Activity Monitoring Pt2; AI-enabled Network Access; Enterprise Security Profile Pt2 | |\r\n| 5.3.1 | Datacenter Macro segmentation | 5.3 Macro Segmentation | Target Level ZT | 17.6 | DoD Organizations implement data center focused macro- segmentation using traditional tiered (web, app, db) and/or service- based architectures. Proxy and/or enforcement checks are integrated with the SDN solution(s) based on device attributes and behavior. | Log Actions to SIEM; Establish Proxy/Enforcement Checks of Device Attributes, Behavior, and other Data; Analyze Activities with Analytics Engine | | | Implement Micro segmentation |\r\n| 5.3.2 | B/C/P/S Macro segmentation | 5.3 Macro Segmentation | Target Level ZT | 18.1 | DoD Organizations implement base, camp, post, and station macro- segmentation using logical network zones limiting lateral movement. Proxy and/or enforcement checks are integrated with the SDN solution(s) based on device attributes and behavior. | Establish Proxy/Enforcement Checks of Device Attributes, Behavior, and other Data; Log Actions to SIEM; Analyze Activities with Analytics Engine; Leverage SOAR to Provide RT Policy Access Decisions | | Segment Flows into Control, Management, and Data Planes | |\r\n| 5.4.1 | Implement Micro segmentation | 5.4 Micro Segmentation | Target Level ZT | 17.3 | DoD Organizations implement Micro-Segmentation infrastructure into SDN environment enabling basic segmentation of service components (e.g., web, app, db), ports and protocols. Basic automation is accepted for policy changes including API decision making. Virtual hosting environments implement micro-segmentation at the host/container level. | Accept Automated Policy Changes; Implement API Decision Points; Implement NGF/Micro FW/Endpoint Agent in Virtual Hosting Environment | SC-7 (22) separate subnets for connecting to different security domains | Datacenter Macro segmentation | Application & Device Micro segmentation |\r\n| 5.4.2 | Application & Device Micro segmentation | 5.4 Micro Segmentation | Target Level ZT | 17.9 | DoD Organizations utilize Software Defined Networking (SDN) solution(s) to establish infrastructure meeting the ZT Target functionalities – logical network zones, role, attribute and conditional based access control for user and devices, privileged access management services for network resources, and policy-based control on API access. | Assign Role, Attribute, & Condition Based Access Control to User & Devices; Provide Privileged Access Management Services; Limit Access on Per Identity Basis for User & Device; Create Logical Network Zones; Support Policy Control via REST API | | Segment Flows into Control, Management, and Data Planes; Implement Micro segmentation | Enrich Attributes for Resource Authorization Pt1 |\r\n| 5.4.3 | Process Micro segmentation | 5.4 Micro Segmentation | Advanced ZT | 20.3 | DoD Organizations utilize existing micro-segmentation and SDN automation infrastructure enabling process micro-segmentation. Host- level processes are segmented based on security policies and access is granted using real-time access decision making. | Segment Host-Level Processes for Security Policies; Support Real-Time Access Decisions and Policy Changes; Support Offload of Logs for Analytics and Automation; Support Dynamic Deployment of Segmentation Policy | AC-4 (7) one-way flow mechanisms; AC-4 (17) domain authentication; SC-7 (20) dynamic isolation and segregation | Implement Enforcement Points | |\r\n| 5.4.4 | Protect Data In Transit | 5.4 Micro Segmentation | Target Level ZT | 9.1 | Based on the data flow mappings and monitoring, policies are enabled by DoD Organizations to mandate protection of data in transit. Common use cases such as Coalition Information Sharing, Sharing Across System Boundaries and Protection across Architectural Components are included in protection policies. | Protect Data In Transit During Coalition Information Sharing; Protect Data in Transit Across System High Boundaries; Integrate Data In Transit Protection Across Architecture Components | | | |\r\n| 6.1.1 | Policy Inventory & Development | 6.1 Policy Decision Point (PDP) & Policy Orchestration | Target Level ZT | 9.8 | The DoD Enterprise works with the Organizations to catalog and inventory existing Cyber Security policies and standards. Policies are updated and created in cross pillar activities as needed to meet critical ZT Target functionality. | Policies have been collected in reference to applicable compliance and risk (e.g. RMF, NIST); Policies have been reviewed for missing Pillars and Capabilities per the ZTRA; Missing areas of policies are updated to meet the capabilities per ZTRA | | | Continuous Authorization to Operate (cATO) Pt1 |\r\n| 6.1.2 | Organization Access Profile | 6.1 Policy Decision Point (PDP) & Policy Orchestration | Target Level ZT | 19.4 | DoD Organizations develop basic access profiles for mission/task and non-mission/task DAAS access using the data from the User, Data, Network, and device pillars. The DoD Enterprise works with the Organizations to develop an Enterprise Security Profile using the existing Organizational security profiles to create a common access approach to DAAS. A phased approach can be used in organizations to limit risk to mission/task critical DAAS access once the security profile(s) are created. | Organization scoped profile(s) are created to determine access to DAAS using capabilities from User, Data, Network, and Device pillars; Initial enterprise profile access standard is developed for access to DAAS ; When possible the organization profile(s) utilizes enterprise available services in the User, Data, Network and Device pillars; Organization Mission/Task critical profile(s) are created | | | Enterprise Security Profile Pt1 |\r\n| 6.1.3 | Enterprise Security Profile Pt1 | 6.1 Policy Decision Point (PDP) & Policy Orchestration | Target Level ZT | 16.0 | The Enterprise Security profile covers the User, Data, Network and Device pillars initially. Existing Organizational Security Profiles are integrated for non-mission/task DAAS access following an iterative approach to tuning access. | Enterprise Profile(s) are created to access DAAS using capabilities from User, Data, Network and Device Pillars; Non-mission/task critical organization profile(s) are integrated with the enterprise profile(s) using a standardized approach | | Organization Access Profile | Enterprise Security Profile Pt2 |\r\n| 6.1.4 | Enterprise Security Profile Pt2 | 6.1 Policy Decision Point (PDP) & Policy Orchestration | Advanced ZT | 12.5 | The minimum number of Enterprise Security Profile(s) exist granting access to the widest range of DAAS across Pillars within the DoD Organizations. Mission/task organization profiles are integrated with the Enterprise Security Profile(s) and exceptions are managed in a risk based methodical approach. | Enterprise Profile(s) have been reduced and simplified to support widest array of access to DAAS; Where appropriate Mission/Task Critical profile(s) have been integrated and supported Organization profiles are considered the exception | | Enterprise Security Profile Pt1 | Real-Time Access Decisions AI-enabled Dynamic Access Control |\r\n| 6.2.1 | Task Automation Analysis | 6.2 Critical Process Automation | Target Level ZT | 6.3 | DoD Organizations identify and enumerate all task activities that can be executed both manually and in an automated fashion. Task activities are organized into automated and manual categories. Manual activities are analyzed for possible retirement. | Automatable tasks are identified; Tasks are enumerated | | | |\r\n| 6.2.2 | Enterprise Integration & Workflow Provisioning Pt1 | 6.2 Critical Process Automation | Target Level ZT | 23.4 | The DoD enterprise establishes baseline integrations within the Security Orchestration, Automation and Response solution (SOAR) required to enable target level ZTA functionality. DoD organizations identify integration points and prioritize key ones per the DoD enterprise baseline. Critical integrations occur meeting key services enabling recovery and protection capabilities. | Implement full enterprise integration; Identify key integrations; Identify recovery and protection requirements | | | Enterprise Integration & Workflow Provisioning Pt2 |\r\n| 6.2.3 | Enterprise Integration & Workflow Provisioning Pt2 | 6.2 Critical Process Automation | Advanced ZT | 12.7 | DoD Organizations integrate remaining services to meet baseline requirements and advanced ZTA functionality requirements as appropriate per environment. Service provisioning is integrated and automated into workflows where required meeting ZTA target functionalities. | Services identified; Service provisioning is implemented | CM-3 (3) automated change implementation | Enterprise Integration & Workflow Provisioning Pt1 | Automated Workflow |\r\n| 6.3.1 | Implement Data Tagging & Classification ML Tools | 6.3 Machine Learning | Target Level ZT | 16.0 | DoD Organizations utilize existing Data Tagging and Classification standards and requirements to procure Machine Learning solution(s) as needed. Machine Learning solution(s) is implemented in organizations and existing tagged and classified data repositories are used to establish baselines. Machine learning solution(s) applies data tags in a supervised approach to continually improve analysis. | Implemented data tagging and classification tools are integrated with ML tools | | Define Data Tagging Standards | Automated Data Tagging & Support Pt1 |\r\n| 6.4.1 | Implement AI automation tools | 6.4 Artificial Intelligence | Advanced ZT | 25.7 | DoD Organizations identify areas of improvement based on existing machine learning techniques for Artificial Intelligence. AI solutions are identified, procured, and implemented using the identified areas as requirements. | Develop AI Tool Requirements; Procure and Implement AI Tools | | | Automated Workflow |\r\n| 6.4.2 | AI Driven by Analytics decides A&O modifications | 6.4 Artificial Intelligence | Advanced ZT | 42.0 | DoD Organizations utilizing existing machine learning functions implement and use AI technology such as neural networks to drive automation and orchestration decisions. Decision making is moved to AI as much as possible freeing up human staff for other efforts. Utilizing historical patterns, AI will make anticipatory changes in the environment to better reduce risk. | AI is able to make changes to automated workflow activities | | | |\r\n| 6.5.1 | Response Automation Analysis | 6.5 Security Orchestration, Automation & Response (SOAR) | Target Level ZT | 9.0 | DoD Organizations identify and enumerate all response activities that executed both manually and in an automated fashion. Response activities are organized into automated and manual categories. Manual activities are analyzed for possible retirement. | Automatable response activities are identified; Response activities are enumerated | AC-21 (1) automated decision support; SI- 4 (3) automated tool and mechanism integration; SI-18 (1) automation support | | |\r\n| 6.5.2 | Implement SOAR Tools | 6.5 Security Orchestration, Automation & Response (SOAR) | Target Level ZT | 14.9 | DoD enterprise working with Organizations develops a standard set of requirements for security orchestration, automation, and response (SOAR) tooling to enable target level ZTA functions. DoD Organizations use approved requirements to procure and implement SOAR solution. Basic infrastructure integrations for future SOAR functionality is completed. | Develop requirements for SOAR tool; Procure SOAR tools | | Standardized API Calls & Schemas Pt1; Workflow Enrichment Pt1 | |\r\n| 6.5.3 | Implement Playbooks | 6.5 Security Orchestration, Automation & Response (SOAR) | Advanced ZT | 14.0 | DoD organizations review all existing playbooks to identify for future automation. Existing manual and automated processes missing playbooks have playbooks developed. Playbooks are prioritized for automation to be integrated with the Automated Workflows activities covering Critical Processes. Manual processes without playbooks are authorized using a risk based methodical approach. | When possible automated playbooks based on automated workflows capability; Manual Playbooks are developed and implemented | CA-7 (6) automation support for monitoring; CM-3 (1) automated documentation, notification, and prohibition of changes; CM-3 (5) automated security response | | |\r\n| 6.6.1 | Tool Compliance Analysis | 6.6 API Standardization | Target Level ZT | 7.3 | Automation and Orchestration tooling and solutions are analyzed for compliance and capabilities based on the DoD Enterprise programmatic interface standard and requirements. Any additional tooling or solutions are identified to support the programmatic interface standards and requirements. | API status is determined compliance or non-compliance to API standards; Tools to be used are Identified | | | |\r\n| 6.6.2 | Standardized API Calls & Schemas Pt1 | 6.6 API Standardization | Target Level ZT | 13.6 | The DoD enterprise works with organizations to establish a programmatic interface (e.g., API) standard and requirements as needed to enable target ZTA functionalities. DoD Organizations update programmatic interfaces to the new standard and mandate newly acquired/developed tools to meet the new standard. Tools unable to meet the standard are allowed by exception using a risk based methodical approach. | Initial calls and schemas are implemented; Non-compliant tools are replaced | | | Implement SDN Programable Infrastructure; Implement SOAR Tools; Standardized API Calls & Schemas Pt2 |\r\n| 6.6.3 | Standardized API Calls & Schemas Pt2 | 6.6 API Standardization | Target Level ZT | 14.2 | DoD Organizations complete the migration to the new programmatic interface standard. Tools marked for decommission in the previous activity are retired and functions are migrated to modernized tools. Approved schemas are adopted based on the DoD Enterprise standard/requirements. | All calls and schemas are implemented | | Standardized API Calls & Schemas Pt1 | |\r\n| 6.7.1 | Workflow Enrichment Pt1 | 6.7 Security Operations Center (SOC) & Incident Response (IR) | Target Level ZT | 7.3 | DoD Enterprise works with organizations to establish a cybersecurity incident response standard using industry best practices such as NIST. DoD Organizations utilize the enterprise standard to determine incident response workflows. External sources of enrichment are identified for future integration. | Threat events are identified; Workflows for threat events are developed | | | Implement SOAR Tools; Workflow Enrichment Pt2 |\r\n| 6.7.2 | Workflow Enrichment Pt2 | 6.7 Security Operations Center (SOC) & Incident Response (IR) | Target Level ZT | 9.1 | DoD organizations identify and establish extended workflows for additional incident response types. Initial enrichment data sources are used for existing workflows. Additional enrichment sources are identified for future integrations. | Workflows for Advanced threat events are developed; Advanced Threat events are identified | SI-4 (7) automated response to suspicious events | Workflow Enrichment Pt1 | Workflow Enrichment Pt3 |\r\n| 6.7.3 | Workflow Enrichment Pt3 | 6.7 Security Operations Center (SOC) & Incident Response (IR) | Advanced ZT | 12.4 | DoD organizations use final enrichment data sources on basic and extended threat response workflows. | Enrichment data has been identified; Enrichment data is integrated into workflows | | Workflow Enrichment Pt2 | Automated Workflow |\r\n| 6.7.4 | Automated Workflow | 6.7 Security Operations Center (SOC) & Incident Response (IR) | Advanced ZT | 14.4 | DoD organizations focus on automating Security Orchestration, Automation and Response (SOAR) functions and playbooks. Manual processes within security operations are identified and fully automated as possible. Remaining manual processes are decommissioned when possible or marked for exception using a risk based approach. | Workflow processes are fully automated; Manual Processes have been identified; Remaining Processes are marked as exceptions and documented | MA-2 (2) automated maintenance activities; PE-8 (1) automated records maintenance and review; RA-5 (6) automated trend analysis; SC-7 (17) automated enforcement of protocol formats; SI-5 (1) automated alerts and advisories; SI-7 (2) automated notifications of integrity violations; SI-7 (5) automated response to integrity violations | Workflow Enrichment Pt3; Implement AI automation tools; Enterprise Integration & Workflow Provisioning Pt2 | Continuous Authorization to Operate (cATO) Pt2 |\r\n| 7.1.1 | Scale Considerations | 7.1 Log All Traffic (Network, Data, Apps, Users) | Target Level ZT | 11.6 | DoD Organizations conduct analysis to determine current and future needs of scaling. Scaling is analyzed following common industry best practice methods and ZT Pillars. The team works with existing Business Continuity Planning (BCP) and Disaster Recovery Planning (DPR) groups to determine distributed environment needs in emergencies and as organizations grow. | Sufficient infrastructure in place; Distributed environment established; Sufficient bandwidth for network traffic | | | |\r\n| 7.1.2 | Log Parsing | 7.1 Log All Traffic (Network, Data, Apps, Users) | Target Level ZT | 6.3 | DoD Organizations identify and prioritize log and flow sources (e.g., Firewalls, Endpoint Detection & Response, Active Directory, Switches, Routers, etc.) and develop a plan for collection of high priority logs first then low priority. An open industry-standard log format is agreed upon at the DoD Enterprise level with the Organizations and implemented in future procurement requirements. Existing solutions and technologies are migrated to the format on a continual basis. | Standardized log formats; Rules developed for each log format | | | Implement Analytics Tools; Asset ID & Alert Correlation |\r\n| 7.1.3 | Log Analysis | 7.1 Log All Traffic (Network, Data, Apps, Users) | Target Level ZT | 10.3 | Common user and device activities are identified and prioritized based on risk. Activities deemed the most simplistic and risky have analytics created using different data sources such as logs. Trends and patterns are developed based on the analytics collected to look at activities over longer periods of time. | Develop analytics per activity; Identify activities to analyze | RA-5 (10) correlate scanning information; SI-4 (13) analyze traffic and event patterns; SI-4 (18) analyze traffic and covert exfiltration | | Establish User Baseline Behavior; User/Device Baselines; Baseline & Profiling Pt1 |\r\n| 7.2.1 | Threat Alerting Pt1 | 7.2 Security Information and Event Management (SIEM) | Target Level ZT | 7.5 | DoD Organizations utilize existing Security Information and Event Management (SIEM) solution to develop basic rules and alerts for common threat events (malware, phishing, etc.) Alerts and/or rule firings are fed into the parallel “Asset ID & Alert Correlation” activity to being automation of responses. | Rules developed for threat correlation | | | Threat Alerting Pt2; Implement Extended Detection & Response (XDR) Tools and Integrate with C2C Pt1 |\r\n| 7.2.2 | Threat Alerting Pt2 | 7.2 Security Information and Event Management (SIEM) | Target Level ZT | 16.5 | DoD Organizations expand threat alerting in the Security Information and Event Management (SIEM) solution to include Cyber Threat Intelligence (CTI) data feeds. Deviation and anomaly rules are developed in the SIEM to detect advanced threats. | Develop analytics to detect deviations | | Threat Alerting Pt1; Cyber Threat Intelligence Program Pt1 | Threat Alerting Pt3 |\r\n| 7.2.3 | Threat Alerting Pt3 | 7.2 Security Information and Event Management (SIEM) | Advanced ZT | 12.9 | Threat Alerting is expanded to include advanced data sources such as Extended Detection & Response (XDR), User & Entity Behavior Analytics (UEBA), and User Activity Monitoring (UAM). These advanced data sources are used to develop improved anomalous and pattern activity detections. | Identify Triggering Anomalous Events; Implement Triggering Policy | AU-6 (6) correlation with physical monitoring; PE-6 (4) monitoring physical access to systems | Threat Alerting Pt2; Implement Extended Detection & Response (XDR) Tools and Integrate with C2C Pt2 | Continuous Authorization to Operate (cATO) Pt2 |\r\n| 7.2.4 | Asset ID & Alert Correlation | 7.2 Security Information and Event Management (SIEM) | Target Level ZT | 10.2 | DoD Organizations develop basic correlation rules using asset and alert data. Response to common threat events (e.g., malware, phishing, etc.) are automated within the Security Information and Event Management (SIEM) solution. | Rules developed for asset ID based responses | | Log Parsing | |\r\n| 7.2.5 | User/Device Baselines | 7.2 Security Information and Event Management (SIEM) | Target Level ZT | 13.0 | DoD Organizations develop user and device baseline approaches based on DoD Enterprise standards for the appropriate pillar. Attributes utilized in baselining are pulled from the enterprise wide standards developed in cross pillar activities. | Identify user and device baselines | | Implement User & Entity Behavior Activity (UEBA) and User Activity Monitoring (UAM) Tooling; Log Analysis | User Activity Monitoring Pt1; Entity Activity Monitoring Pt1 |\r\n| 7.3.1 | Implement Analytics Tools | 7.3 Common Security and Risk Analytics | Target Level ZT | 12.1 | DoD Organizations procure and implement basic Cyber-focused analytics tools. Analytics development is prioritized based on risk and complexity looking for easy impactful analytics first. Continued analytics development focuses on Pillar requirements to better meet reporting needs. | Develop requirements for analytic environment; Procure and implement analytic tools | | Log Parsing | |\r\n| 7.3.2 | Establish User Baseline Behavior | 7.3 Common Security and Risk Analytics | Target Level ZT | 13.8 | Utilizing the analytics developed for users and devices in a parallel activity, baselines are established in a technical solution. These baselines are applied to an identified set of users based on risk initially and then expanded to the larger DoD Organization user base. The technical solution used is integrated with machine learning functionality to begin automation. | Identify users for baseline; Establish ML-based baselines | | Implement User & Entity Behavior Activity (UEBA) and User Activity Monitoring (UAM) Tooling; Log Analysis | |\r\n| 7.4.1 | Baseline & Profiling Pt1 | 7.4 User and Entity Behavior Analytics | Target Level ZT | 12.3 | Utilizing the analytics developed for users and devices in a parallel activity, common profiles are created for typical user and device types. Analytics taken from baselining are updated to look at larger containers, profiles. | Develop analytics to detect changing threat conditions; Identify user and device threat profiles | | Implement User & Entity Behavior Activity (UEBA) and User Activity Monitoring (UAM) Tooling; Log Analysis | Baseline & Profiling Pt2; UEBA Baseline Support Pt 1 |\r\n| 7.4.2 | Baseline & Profiling Pt2 | 7.4 User and Entity Behavior Analytics | Advanced ZT | 22.7 | DoD Organizations expand baselines and profiles to include unmanaged and non-standard device types including Internet of Things (IoT) and Operational Technology (OT) through data output monitoring. These devices are again profiled based on standardized attributes and use cases. Analytics are updated to consider the new baselines and profiles accordingly enabling further detections and response. Specific risky users and devices are automatically prioritized for increased monitoring based on risk. Detection and response are integrated with cross pillar functionalities. | Add threat profiles for IoT and OT devices; Develop and extend analytics; Extend threat profiles to individual users and devices | | Baseline & Profiling Pt1 | |\r\n| 7.4.3 | UEBA Baseline Support Pt 1 | 7.4 User and Entity Behavior Analytics | Advanced ZT | 6.3 | User & Entity Behavior Analytics (UEBA) within DoD Organizations expands monitoring to advanced analytics such as Machine Learning (ML). These results are in turn reviewed and fed back into the ML algorithms to improve detection and response. | Implement ML-based Analytics to detect anomalies | RA-3 (4) predictive cyber analytics; SI-4 (25) optimize network traffic analysis | Baseline & Profiling Pt1 | AI-enabled Network Access; UEBA Baseline Support Pt2 |\r\n| 7.4.4 | UEBA Baseline Support Pt 2 | 7.4 User and Entity Behavior Analytics | Advanced ZT | 6.3 | User & Entity Behavior Analytics (UEBA) within DoD Organizations completes it expansion by using traditional and machine learning (ML) based results to be fed into Artificial Intelligence (AI) algorithms. Initially AI based detections are supervised but ultimately using advanced techniques such as neural networks, UEBA operators are not part of the learning process | Implement ML-based Analytics to detect anomalies | | UEBA Baseline Support Pt1 | |\r\n| 7.5.1 | Cyber Threat Intelligence Program Pt1 | 7.5 Threat Intelligence Integration | Target Level ZT | 9.9 | The DoD Enterprise works with the Organizations to develop and Cyber Threat Intelligence (CTI) program policy, standard and process. Organizations utilize this documentation to develop organizational CTI teams with key mission/task stakeholders. CTI Teams integrate common feeds of data with the Security Information and Event Management (SIEM) for improved alerting and response. Integrations with Device and Network enforcement points (e.g., Firewalls, Endpoint Security Suites, etc.) are created to conduct basic monitoring of CTI driven data. | Cyber Threat Intelligence team is in place with critical stakeholders; Public and Baseline CTI feeds are being utilized by SIEM for alerting; Basic integration points exist with Device and Network enforcement points (e.g., NGAV, NGFW, NG-IPS) | AU-6 (5) integrated analysis of audit records; SI-4 (17) integrated situational awareness | | Cyber Threat Intelligence Program Pt2; Threat Alerting Pt 2 |\r\n| 7.5.2 | Cyber Threat Intelligence Program Pt2 | 7.5 Threat Intelligence Integration | Target Level ZT | 19.5 | DoD Organizations expand their Cyber Threat Intelligence (CTI) teams to include new stakeholders as appropriate. Authenticated, private and controlled CTI data feeds are integrated into Security Information and Event Management (SIEM) and enforcement points from the Device, User, Network and Data pillars. | Cyber Threat Intelligence team is in place with extended stakeholders as appropriate; Controlled and Private feed are being utilized by SIEM and other appropriate Analytics tools for alerting and monitoring; Integration is in place for extended enforcement points within the Device, User, Network and Data pillars (UEBA, UAM) | AU-5 (2) real-time alerts; SI-6 (3) report verification results | Cyber Threat Intelligence Program Pt1 | |\r\n| 7.6.1 | AI-enabled Network Access | 7.6 Automated Dynamic Policies | Advanced ZT | 27.8 | DoD Organizations utilize the SDN Infrastructure and Enterprise Security Profiles to enable Artificial Intelligence (AI)/Machine Learning (ML) driven network access. Analytics from previous activities is used to teach the AI/ML algorithms improving decision making. | Network Access is AI driven based on environment analytics | SI-8 (3) continuous learning capability | UEBA Baseline Support Pt1; Periodic Authentication; Rule Based Dynamic Access Pt1 The following activities are to be completed in parallel: Comprehensive Data Activity Monitoring User Activity Monitoring Pt2 Entity Activity Monitoring Pt2 | Real-Time Access Decisions; AI- enabled Dynamic Access Control |\r\n| 7.6.2 | AI-enabled Dynamic Access Control | 7.6 Automated Dynamic Policies | Advanced ZT | 24.4 | DoD Organizations utilize previous rule based dynamic access to teach Artificial Intelligence (AI)/Machine Learning (ML) algorithms to make access decision to various resources. The “AI-enabled Network Access” activity algorithms are updated to enable broader decision making to all DAAS. | JIT/JEA are integrated with AI; Access is AI driven based on environment analytics | | Continuous Authentication Pt2; AI- enabled Network Access |\t|",
+ "style": "info"
+ },
+ "conditionalVisibility": {
+ "parameterName": "DoDZT",
+ "comparison": "isEqualTo",
+ "value": "Activities"
+ },
+ "name": "ZTActivities"
+ }
+ ],
+ "fromTemplateId": "sentinel-UserWorkbook",
+ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
+}
\ No newline at end of file
From c5d2c6105f9aa336476710fbebf9b2f0b01faa37 Mon Sep 17 00:00:00 2001
From: "Chhorn Lim (MSFT)" <50709199+ChhornGLim@users.noreply.github.com>
Date: Fri, 18 Aug 2023 14:27:45 -0400
Subject: [PATCH 02/12] Finished 7.6 + cleanup
Added final example visual for Capability 7.6 + cleanup for release
---
Workbooks/DoDZeroTrustWorkbook.json | 2348 ++++++++++++++++++++-------
1 file changed, 1787 insertions(+), 561 deletions(-)
diff --git a/Workbooks/DoDZeroTrustWorkbook.json b/Workbooks/DoDZeroTrustWorkbook.json
index e8fc37c7714..daeb6f60307 100644
--- a/Workbooks/DoDZeroTrustWorkbook.json
+++ b/Workbooks/DoDZeroTrustWorkbook.json
@@ -108,7 +108,7 @@
"allowCustom": true
},
"value": {
- "durationMs": 2592000000
+ "durationMs": 7776000000
}
}
],
@@ -10737,6 +10737,166 @@
"styleSettings": {
"maxWidth": "50"
}
+ },
+ {
+ "type": 1,
+ "content": {
+ "json": "## AWS network activities"
+ },
+ "name": "text - 0"
+ },
+ {
+ "type": 9,
+ "content": {
+ "version": "KqlParameterItem/1.0",
+ "parameters": [
+ {
+ "id": "b9e68383-3369-42fc-b7e7-506fd187832d",
+ "version": "KqlParameterItem/1.0",
+ "name": "TimeRange",
+ "type": 4,
+ "isRequired": true,
+ "value": {
+ "durationMs": 1209600000
+ },
+ "typeSettings": {
+ "selectableValues": [
+ {
+ "durationMs": 300000
+ },
+ {
+ "durationMs": 900000
+ },
+ {
+ "durationMs": 1800000
+ },
+ {
+ "durationMs": 3600000
+ },
+ {
+ "durationMs": 14400000
+ },
+ {
+ "durationMs": 43200000
+ },
+ {
+ "durationMs": 86400000
+ },
+ {
+ "durationMs": 172800000
+ },
+ {
+ "durationMs": 259200000
+ },
+ {
+ "durationMs": 604800000
+ },
+ {
+ "durationMs": 1209600000
+ },
+ {
+ "durationMs": 2419200000
+ },
+ {
+ "durationMs": 2592000000
+ },
+ {
+ "durationMs": 5184000000
+ },
+ {
+ "durationMs": 7776000000
+ }
+ ],
+ "allowCustom": true
+ }
+ }
+ ],
+ "style": "pills",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "name": "parameters - 1"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "let data = AWSCloudTrail;\r\ndata\r\n| summarize Count = count() by AWSRegion\r\n| join kind = fullouter (datatable(AWSRegion:string)['OneDrive', 'SharePoint']) on AWSRegion\r\n| project AWSRegion = iff(AWSRegion == '', AWSRegion1, AWSRegion), Count = iff(AWSRegion == '', 0, Count)\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AWSRegion)\r\n on AWSRegion\r\n| project-away AWSRegion1, TimeGenerated\r\n| extend AWSRegion = AWSRegion\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend AWSRegion = 'All', AWSRegions = '*' \r\n)\r\n| order by Count desc\r\n| take 10\r\n",
+ "size": 4,
+ "title": "Top 10 active regions - click to filter",
+ "timeContextFromParameter": "TimeRange",
+ "exportFieldName": "AWSRegion",
+ "exportParameterName": "AWSRegion",
+ "exportDefaultValue": "All",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "tiles",
+ "tileSettings": {
+ "titleContent": {
+ "columnMatch": "AWSRegion",
+ "formatter": 1,
+ "formatOptions": {
+ "showIcon": true
+ }
+ },
+ "leftContent": {
+ "columnMatch": "Count",
+ "formatter": 12,
+ "formatOptions": {
+ "palette": "auto",
+ "showIcon": true
+ },
+ "numberFormat": {
+ "unit": 17,
+ "options": {
+ "maximumSignificantDigits": 3,
+ "maximumFractionDigits": 2
+ }
+ }
+ },
+ "secondaryContent": {
+ "columnMatch": "Trend",
+ "formatter": 9,
+ "formatOptions": {
+ "min": 0,
+ "palette": "blue",
+ "showIcon": true
+ }
+ },
+ "showBorder": false
+ }
+ },
+ "name": "query - 2"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "AWSCloudTrail\r\n//| where EventSource == \"ec2.amazonaws.com\" and (EventName startswith \"create\" or EventName startswith \"replace\" or EventName startswith \"delete\" or EventName startswith \"authorize\" or EventName startswith \"revoke\") and (EventName !contains \"Volume\" and EventName !contains \"KeyPair\" and EventName !contains \"Tags\" and EventName !contains \"Image\" and EventName !contains \"LaunchTemplate\")\r\n| where AWSRegion == '{AWSRegion}' or '{AWSRegion}' == \"All\"\r\n| summarize count() by AWSRegion, bin(TimeGenerated, {TimeRange:grain})",
+ "size": 0,
+ "title": "Network events, by region",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "barchart"
+ },
+ "customWidth": "50",
+ "name": "query - 3"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "AWSCloudTrail\r\n//| where EventSource == \"ec2.amazonaws.com\" and (EventName startswith \"create\" or EventName startswith \"replace\" or EventName startswith \"delete\" or EventName startswith \"authorize\" or EventName startswith \"revoke\") and (EventName !contains \"Volume\" and EventName !contains \"KeyPair\" and EventName !contains \"Tags\" and EventName !contains \"Image\" and EventName !contains \"LaunchTemplate\")\r\n| where AWSRegion == '{AWSRegion}' or '{AWSRegion}' == \"All\"\r\n| summarize count() by EventName, bin(TimeGenerated, {TimeRange:grain})",
+ "size": 0,
+ "title": "Network event types",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "areachart"
+ },
+ "customWidth": "50",
+ "name": "query - 4"
}
]
},
@@ -10837,116 +10997,673 @@
"links": []
},
"name": "links - 3"
- }
- ]
- },
- "conditionalVisibility": {
- "parameterName": "isNE54Visible",
- "comparison": "isEqualTo",
- "value": "true"
- },
- "name": "5.4Activities",
- "styleSettings": {
- "showBorder": true
- }
- }
- ]
- },
- "conditionalVisibility": {
- "parameterName": "pillar",
- "comparison": "isEqualTo",
- "value": "p5"
- },
- "name": "P5Activities"
- },
- {
- "type": 12,
- "content": {
- "version": "NotebookGroup/1.0",
- "groupType": "editable",
- "items": [
- {
- "type": 3,
- "content": {
- "version": "KqlItem/1.0",
- "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t\\t{ \\\"Select All (Automation & Orchestration 6.x)\\\": \\\"6.1 Policy Decision Point (PD) & Policy Orchestration\\\", \\\"tab\\\": \\\"AO61\\\" },\\r\\n\\t\\t{ \\\"Select All (Automation & Orchestration 6.x)\\\": \\\"6.2 Critical Process Automation \\\", \\\"tab\\\": \\\"AO62\\\" },\\r\\n\\t\\t{ \\\"Select All (Automation & Orchestration 6.x)\\\": \\\"6.3 Machine Learning\\\", \\\"tab\\\": \\\"AO63\\\" },\\r\\n\\t\\t{ \\\"Select All (Automation & Orchestration 6.x)\\\": \\\"6.4 Artifical Learning\\\", \\\"tab\\\": \\\"AO64\\\" },\\r\\n\\t\\t{ \\\"Select All (Automation & Orchestration 6.x)\\\": \\\"6.5 Security Orchestration, Automation & Response (SOAR)\\\", \\\"tab\\\": \\\"AO65\\\" },\\r\\n\\t\\t{ \\\"Select All (Automation & Orchestration 6.x)\\\": \\\"6.6 API Standardization\\\", \\\"tab\\\": \\\"AO66\\\" },\\r\\n\\t\\t{ \\\"Select All (Automation & Orchestration 6.x)\\\": \\\"6.7 Security Operations Center (SOC) & Incident Response (IR)\\\", \\\"tab\\\": \\\"AO67\\\" }\\r\\n\\t\\t]\",\"transformers\":null}",
- "size": 3,
- "exportMultipleValues": true,
- "exportedParameters": [
- {
- "fieldName": "tab",
- "parameterName": "Tab",
- "parameterType": 1
- }
- ],
- "queryType": 8,
- "gridSettings": {
- "formatters": [
- {
- "columnMatch": "Select All (Automation & Orchestration 6.x)",
- "formatter": 0,
- "formatOptions": {
- "customColumnWidthSetting": "75ch"
- }
- },
- {
- "columnMatch": "tab",
- "formatter": 5
- },
- {
- "columnMatch": "Zero Trust",
- "formatter": 0,
- "formatOptions": {
- "customColumnWidthSetting": "75ch"
- }
- }
- ]
- }
- },
- "customWidth": "90",
- "name": "AutomationOrchZT",
- "styleSettings": {
- "showBorder": true
- }
- },
- {
- "type": 9,
- "content": {
- "version": "KqlParameterItem/1.0",
- "parameters": [
+ },
{
- "id": "42fc8445-0772-439f-b490-461fb17e5d2f",
- "version": "KqlParameterItem/1.0",
- "name": "isAO61Visible",
"type": 1,
- "isHiddenWhenLocked": true,
- "criteriaData": [
- {
- "criteriaContext": {
- "leftOperand": "Tab",
- "operator": "contains",
- "rightValType": "static",
- "rightVal": "AO61",
- "resultValType": "static",
- "resultVal": "true"
- }
- },
- {
- "criteriaContext": {
- "operator": "Default",
- "resultValType": "static",
- "resultVal": "false"
- }
- }
- ],
- "timeContext": {
- "durationMs": 86400000
- }
+ "content": {
+ "json": "## Azure AD audit logs"
+ },
+ "name": "text - 1"
},
{
- "id": "6d0940d2-e259-49de-b490-75d026dd6ad3",
- "version": "KqlParameterItem/1.0",
- "name": "isAO62Visible",
+ "type": 9,
+ "content": {
+ "version": "KqlParameterItem/1.0",
+ "parameters": [
+ {
+ "id": "bc372bf5-2dcd-4efa-aa85-94b6e6fafe14",
+ "version": "KqlParameterItem/1.0",
+ "name": "TimeRange",
+ "type": 4,
+ "isRequired": true,
+ "value": {
+ "durationMs": 7776000000
+ },
+ "typeSettings": {
+ "selectableValues": [
+ {
+ "durationMs": 300000
+ },
+ {
+ "durationMs": 900000
+ },
+ {
+ "durationMs": 1800000
+ },
+ {
+ "durationMs": 3600000
+ },
+ {
+ "durationMs": 14400000
+ },
+ {
+ "durationMs": 43200000
+ },
+ {
+ "durationMs": 86400000
+ },
+ {
+ "durationMs": 172800000
+ },
+ {
+ "durationMs": 259200000
+ },
+ {
+ "durationMs": 604800000
+ },
+ {
+ "durationMs": 1209600000
+ },
+ {
+ "durationMs": 2419200000
+ },
+ {
+ "durationMs": 2592000000
+ },
+ {
+ "durationMs": 5184000000
+ },
+ {
+ "durationMs": 7776000000
+ }
+ ],
+ "allowCustom": true
+ }
+ },
+ {
+ "id": "e032b9f7-5449-4180-9c20-75760afa96f6",
+ "version": "KqlParameterItem/1.0",
+ "name": "User",
+ "type": 2,
+ "isRequired": true,
+ "multiSelect": true,
+ "quote": "'",
+ "delimiter": ",",
+ "query": "AuditLogs\r\n| where SourceSystem == \"Azure AD\"\r\n| extend initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \"\", tostring(InitiatedBy.user.userPrincipalName), \"unknown\")\r\n//| where initiator!= \"\"\r\n| summarize Count = count() by initiator\r\n| order by Count desc, initiator asc\r\n| project Value = initiator, Label = strcat(initiator, ' - ', Count), Selected = false",
+ "value": [
+ "value::all"
+ ],
+ "typeSettings": {
+ "additionalResourceOptions": [
+ "value::all"
+ ],
+ "selectAllValue": "All"
+ },
+ "timeContext": {
+ "durationMs": 0
+ },
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ {
+ "id": "0a59a0b3-6d93-4fee-bdbe-147383c510c6",
+ "version": "KqlParameterItem/1.0",
+ "name": "Category",
+ "type": 2,
+ "isRequired": true,
+ "multiSelect": true,
+ "quote": "'",
+ "delimiter": ",",
+ "query": "AuditLogs\r\n| extend initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \"\", tostring(InitiatedBy.user.userPrincipalName), \"unknown\")\r\n| where \"{User:lable}\" == \"All\" or initiator in ({User})\r\n| summarize Count = count() by Category\r\n| order by Count desc, Category asc\r\n| project Value = Category, Label = strcat(Category, ' - ', Count)",
+ "value": [
+ "value::all"
+ ],
+ "typeSettings": {
+ "additionalResourceOptions": [
+ "value::all"
+ ],
+ "selectAllValue": "All"
+ },
+ "timeContext": {
+ "durationMs": 0
+ },
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ {
+ "id": "4d2b245b-5e59-4eb6-9f51-ba926581ab47",
+ "version": "KqlParameterItem/1.0",
+ "name": "Result",
+ "type": 2,
+ "isRequired": true,
+ "multiSelect": true,
+ "quote": "'",
+ "delimiter": ",",
+ "query": "AuditLogs\r\n| extend initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \"\", tostring(InitiatedBy.user.userPrincipalName), \"unknown\")\r\n| where \"{User:lable}\" == \"All\" or initiator in ({User})\r\n| summarize Count = count() by Result\r\n| order by Count desc, Result asc\r\n| project Value = Result, Label = strcat(Result, ' - ', Count, ' sign-ins')",
+ "value": [
+ "value::all"
+ ],
+ "typeSettings": {
+ "additionalResourceOptions": [
+ "value::all"
+ ],
+ "selectAllValue": "All"
+ },
+ "timeContext": {
+ "durationMs": 0
+ },
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ }
+ ],
+ "style": "pills",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "name": "parameters - 1"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "let data = AuditLogs\r\n| where \"{Category:lable}\" == \"All\" or Category in ({Category})\r\n| where \"{Result:lable}\" == \"All\" or Result in ({Result})\r\n| extend initiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\r\n| where initiatingUserPrincipalName != \"\" \r\n| where \"{User:lable}\" == \"All\" or initiatingUserPrincipalName in ({User});\r\ndata\r\n| summarize Count = count() by Category\r\n| join kind = fullouter (datatable(Category:string)['Medium', 'high', 'low']) on Category\r\n| project Category = iff(Category == '', Category1, Category), Count = iff(Category == '', 0, Count)\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Category)\r\n on Category\r\n| project-away Category1, TimeGenerated\r\n| extend Category = Category\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend Category = 'All', Categorys = '*' \r\n)\r\n| order by Count desc\r\n| take 10",
+ "size": 4,
+ "title": "Access Categories ",
+ "timeContextFromParameter": "TimeRange",
+ "exportFieldName": "Category",
+ "exportParameterName": "CategoryFIlter",
+ "exportDefaultValue": "All",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "tiles",
+ "tileSettings": {
+ "titleContent": {
+ "columnMatch": "Category",
+ "formatter": 1,
+ "formatOptions": {
+ "showIcon": true
+ }
+ },
+ "leftContent": {
+ "columnMatch": "Count",
+ "formatter": 12,
+ "formatOptions": {
+ "palette": "auto",
+ "showIcon": true
+ },
+ "numberFormat": {
+ "unit": 17,
+ "options": {
+ "style": "decimal",
+ "maximumFractionDigits": 2,
+ "maximumSignificantDigits": 3
+ }
+ }
+ },
+ "secondaryContent": {
+ "columnMatch": "Trend",
+ "formatter": 21,
+ "formatOptions": {
+ "palette": "purple",
+ "showIcon": true
+ }
+ },
+ "showBorder": false
+ }
+ },
+ "name": "query - 4"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "let data = AuditLogs\r\n| where \"{Result:lable}\" == \"All\" or Result in ({Result})\r\n| extend initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \"\", tostring(InitiatedBy.user.userPrincipalName), \"unknown\")\r\n| where \"{User:lable}\" == \"All\" or initiator in ({User})\r\n| where \"{Category:lable}\" == \"All\" or Category in ({Category})\r\n| where Category == '{CategoryFIlter}' or '{CategoryFIlter}' == \"All\";\r\nlet appData = data\r\n| summarize TotalCount = count() by OperationName, Category\r\n| join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by OperationName\r\n | project-away TimeGenerated) on OperationName\r\n| order by TotalCount desc, OperationName asc\r\n| project OperationName, TotalCount, Trend, Category\r\n| serialize Id = row_number();\r\ndata\r\n| summarize TotalCount = count() by initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \"\", tostring(InitiatedBy.user.userPrincipalName), \"unknown\"), Category, OperationName\r\n| join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by OperationName, initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \"\", tostring(InitiatedBy.user.userPrincipalName), \"unknown\")\r\n | project-away TimeGenerated) on OperationName, initiator\r\n| order by TotalCount desc, OperationName asc\r\n| project OperationName, initiator, TotalCount, Category, Trend\r\n| serialize Id = row_number(1000000)\r\n| join kind=inner (appData) on OperationName\r\n| project Id, Name = initiator, Type = 'initiator', ['Operations Count'] = TotalCount, Trend, Category, ParentId = Id1\r\n| union (appData \r\n | project Id, Name = OperationName, Type = 'Operation', ['Operations Count'] = TotalCount, Category, Trend)\r\n| order by ['Operations Count'] desc, Name asc",
+ "size": 0,
+ "showAnalytics": true,
+ "title": "Conditional Acess & User activities",
+ "timeContextFromParameter": "TimeRange",
+ "exportParameterName": "UserInfo",
+ "exportDefaultValue": "{ \"Name\":\"\", \"Type\":\"*\"}",
+ "showExportToExcel": true,
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Id",
+ "formatter": 5,
+ "formatOptions": {
+ "showIcon": true
+ }
+ },
+ {
+ "columnMatch": "Type",
+ "formatter": 5,
+ "formatOptions": {
+ "showIcon": true
+ }
+ },
+ {
+ "columnMatch": "Operations Count",
+ "formatter": 8,
+ "formatOptions": {
+ "min": 0,
+ "palette": "blue",
+ "showIcon": true
+ },
+ "numberFormat": {
+ "unit": 0,
+ "options": {
+ "style": "decimal"
+ }
+ }
+ },
+ {
+ "columnMatch": "Trend",
+ "formatter": 9,
+ "formatOptions": {
+ "min": 0,
+ "palette": "turquoise",
+ "showIcon": true
+ },
+ "numberFormat": {
+ "unit": 0,
+ "options": {
+ "style": "decimal"
+ }
+ }
+ },
+ {
+ "columnMatch": "ParentId",
+ "formatter": 5,
+ "formatOptions": {
+ "showIcon": true
+ }
+ }
+ ],
+ "rowLimit": 1000,
+ "filter": true,
+ "hierarchySettings": {
+ "idColumn": "Id",
+ "parentColumn": "ParentId",
+ "treeType": 0,
+ "expanderColumn": "Name"
+ }
+ }
+ },
+ "customWidth": "70",
+ "showPin": true,
+ "name": "query - 2"
+ },
+ {
+ "type": 9,
+ "content": {
+ "version": "KqlParameterItem/1.0",
+ "parameters": [
+ {
+ "id": "80e332f7-8176-461f-b27a-0a52242fe6c9",
+ "version": "KqlParameterItem/1.0",
+ "name": "TimeRange",
+ "type": 4,
+ "isRequired": true,
+ "value": {
+ "durationMs": 86400000
+ },
+ "typeSettings": {
+ "selectableValues": [
+ {
+ "durationMs": 300000
+ },
+ {
+ "durationMs": 900000
+ },
+ {
+ "durationMs": 1800000
+ },
+ {
+ "durationMs": 3600000
+ },
+ {
+ "durationMs": 14400000
+ },
+ {
+ "durationMs": 43200000
+ },
+ {
+ "durationMs": 86400000
+ },
+ {
+ "durationMs": 172800000
+ },
+ {
+ "durationMs": 259200000
+ },
+ {
+ "durationMs": 604800000
+ },
+ {
+ "durationMs": 1209600000
+ },
+ {
+ "durationMs": 2419200000
+ },
+ {
+ "durationMs": 2592000000
+ },
+ {
+ "durationMs": 5184000000
+ },
+ {
+ "durationMs": 7776000000
+ }
+ ],
+ "allowCustom": true
+ }
+ },
+ {
+ "id": "5a93ede8-361d-4cc6-93f8-967dfc355143",
+ "version": "KqlParameterItem/1.0",
+ "name": "Activity",
+ "type": 2,
+ "isRequired": true,
+ "multiSelect": true,
+ "quote": "'",
+ "delimiter": ",",
+ "query": "SecurityEvent\r\n| summarize Count = count() by Activity\r\n| order by Count desc, Activity asc\r\n| project Value = Activity, Label = strcat(Activity, ' - ', Count)",
+ "value": [
+ "value::all"
+ ],
+ "typeSettings": {
+ "additionalResourceOptions": [
+ "value::all"
+ ],
+ "selectAllValue": "All"
+ },
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ }
+ ],
+ "style": "pills",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "name": "parameters - 1"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "let data = SecurityEvent\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity});\r\ndata\r\n| summarize Count = count() by Activity\r\n| join kind = fullouter (datatable(Activity:string)['Medium', 'high', 'low']) on Activity\r\n| project Activity = iff(Activity == '', Activity1, Activity), Count = iff(Activity == '', 0, Count)\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Activity)\r\n on Activity\r\n| project-away Activity1, TimeGenerated\r\n| extend Activitys = Activity\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend Activity = 'All', Activitys = '*' \r\n)\r\n| order by Count desc\r\n| take 10",
+ "size": 4,
+ "title": "Top 10 Identity & Access Activities - click to filter by activity",
+ "timeContextFromParameter": "TimeRange",
+ "exportFieldName": "Activity",
+ "exportParameterName": "ActivityPiker",
+ "exportDefaultValue": "All",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "tiles",
+ "tileSettings": {
+ "titleContent": {
+ "columnMatch": "Activity",
+ "formatter": 1,
+ "formatOptions": {
+ "showIcon": true
+ }
+ },
+ "leftContent": {
+ "columnMatch": "Count",
+ "formatter": 12,
+ "formatOptions": {
+ "palette": "auto",
+ "showIcon": true
+ },
+ "numberFormat": {
+ "unit": 17,
+ "options": {
+ "maximumSignificantDigits": 3,
+ "maximumFractionDigits": 2
+ }
+ }
+ },
+ "secondaryContent": {
+ "columnMatch": "Trend",
+ "formatter": 9,
+ "formatOptions": {
+ "palette": "lightBlue",
+ "showIcon": true
+ }
+ },
+ "showBorder": false
+ }
+ },
+ "name": "query - 2"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "let data = SecurityEvent\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| where Activity == '{ActivityPiker}' or '{ActivityPiker}' == \"All\" and AccountType == 'User'\r\n| extend Name = extract(@'^(.*\\\\)?([^@]*)(@.*)?$', 2, tolower(Account));\r\nlet appData = data\r\n| summarize TotalCount = count() by Name\r\n| join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Name\r\n | project-away TimeGenerated) on Name\r\n| order by TotalCount desc, Name asc\r\n| project Name, TotalCount, Trend\r\n| serialize Id = row_number();\r\ndata\r\n| summarize TotalCount = count() by Activity , Name\r\n| join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Name, Activity\r\n | project-away TimeGenerated) on Name, Activity\r\n| order by TotalCount desc, Name asc\r\n| project Name, Activity, TotalCount, Trend\r\n| serialize Id = row_number(1000000)\r\n| join kind=inner (appData) on Name\r\n| project Id, Name = Activity, Type = 'Activity', ['Activity Count'] = TotalCount, Trend, ParentId = Id1\r\n| union (appData \r\n | project Id, Name = Name, Type = 'Computer', ['Activity Count'] = TotalCount, Trend )\r\n| order by ['Activity Count'] desc, Name asc",
+ "size": 0,
+ "title": "User activities",
+ "timeContextFromParameter": "TimeRange",
+ "exportParameterName": "Userinfo",
+ "exportDefaultValue": "{ \"Name\":\"\", \"Type\":\"*\"}",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Id",
+ "formatter": 5,
+ "formatOptions": {
+ "showIcon": true
+ }
+ },
+ {
+ "columnMatch": "Activity Count",
+ "formatter": 8,
+ "formatOptions": {
+ "min": 0,
+ "palette": "blueGreen",
+ "showIcon": true
+ }
+ },
+ {
+ "columnMatch": "Trend",
+ "formatter": 9,
+ "formatOptions": {
+ "palette": "greenDark",
+ "showIcon": true
+ }
+ },
+ {
+ "columnMatch": "IpAddress",
+ "formatter": 5,
+ "formatOptions": {
+ "showIcon": true
+ }
+ },
+ {
+ "columnMatch": "ParentId",
+ "formatter": 5,
+ "formatOptions": {
+ "showIcon": true
+ }
+ }
+ ],
+ "filter": true,
+ "hierarchySettings": {
+ "idColumn": "Id",
+ "parentColumn": "ParentId",
+ "treeType": 0,
+ "expanderColumn": "Name"
+ }
+ }
+ },
+ "customWidth": "50",
+ "name": "query - 3"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "//let Users = dynamic({Userinfo});\r\nlet data = SecurityEvent\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| where Activity == '{ActivityPiker}' or '{ActivityPiker}' == \"All\" and AccountType == 'Machine'\r\n| extend user = extract(@'^(.*\\\\)?([^@]*)(@.*)?$', 2, tolower(Account))\r\n| where dynamic({Userinfo}).Type == '*' or (dynamic({Userinfo}).Type == 'Computer' and user == dynamic({Userinfo}).Name);\r\nlet appData = data\r\n| summarize TotalCount = count() by Computer\r\n| join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Computer\r\n | project-away TimeGenerated) on Computer\r\n| order by TotalCount desc, Computer asc\r\n| project Computer, TotalCount, Trend\r\n| serialize Id = row_number();\r\ndata\r\n| summarize TotalCount = count() by Activity , Computer\r\n| join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Computer, Activity\r\n | project-away TimeGenerated) on Computer, Activity\r\n| order by TotalCount desc, Computer asc\r\n| project Computer, Activity, TotalCount, Trend\r\n| serialize Id = row_number(1000000)\r\n| join kind=inner (appData) on Computer\r\n| project Id, Name = Activity, Type = 'Activity', ['Activity Count'] = TotalCount, Trend, ParentId = Id1\r\n| union (appData \r\n | project Id, Name = Computer, Type = 'Computer', ['Activity Count'] = TotalCount, Trend )\r\n| order by ['Activity Count'] desc, Name asc",
+ "size": 0,
+ "title": "Machine activities",
+ "timeContextFromParameter": "TimeRange",
+ "exportFieldName": "",
+ "exportParameterName": "MachineInfo",
+ "exportDefaultValue": "{ \"Name\":\"\", \"Type\":\"*\"}",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Id",
+ "formatter": 5,
+ "formatOptions": {
+ "showIcon": true
+ }
+ },
+ {
+ "columnMatch": "Activity Count",
+ "formatter": 8,
+ "formatOptions": {
+ "min": 0,
+ "palette": "blue",
+ "showIcon": true
+ }
+ },
+ {
+ "columnMatch": "Trend",
+ "formatter": 9,
+ "formatOptions": {
+ "showIcon": true
+ }
+ },
+ {
+ "columnMatch": "ParentId",
+ "formatter": 5,
+ "formatOptions": {
+ "showIcon": true
+ }
+ }
+ ],
+ "filter": true,
+ "hierarchySettings": {
+ "idColumn": "Id",
+ "parentColumn": "ParentId",
+ "treeType": 0,
+ "expanderColumn": "Name"
+ }
+ }
+ },
+ "customWidth": "50",
+ "name": "query - 4"
+ }
+ ]
+ },
+ "conditionalVisibility": {
+ "parameterName": "isNE54Visible",
+ "comparison": "isEqualTo",
+ "value": "true"
+ },
+ "name": "5.4Activities",
+ "styleSettings": {
+ "showBorder": true
+ }
+ }
+ ]
+ },
+ "conditionalVisibility": {
+ "parameterName": "pillar",
+ "comparison": "isEqualTo",
+ "value": "p5"
+ },
+ "name": "P5Activities"
+ },
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "items": [
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t\\t{ \\\"Select All (Automation & Orchestration 6.x)\\\": \\\"6.1 Policy Decision Point (PD) & Policy Orchestration\\\", \\\"tab\\\": \\\"AO61\\\" },\\r\\n\\t\\t{ \\\"Select All (Automation & Orchestration 6.x)\\\": \\\"6.2 Critical Process Automation \\\", \\\"tab\\\": \\\"AO62\\\" },\\r\\n\\t\\t{ \\\"Select All (Automation & Orchestration 6.x)\\\": \\\"6.3 Machine Learning\\\", \\\"tab\\\": \\\"AO63\\\" },\\r\\n\\t\\t{ \\\"Select All (Automation & Orchestration 6.x)\\\": \\\"6.4 Artifical Learning\\\", \\\"tab\\\": \\\"AO64\\\" },\\r\\n\\t\\t{ \\\"Select All (Automation & Orchestration 6.x)\\\": \\\"6.5 Security Orchestration, Automation & Response (SOAR)\\\", \\\"tab\\\": \\\"AO65\\\" },\\r\\n\\t\\t{ \\\"Select All (Automation & Orchestration 6.x)\\\": \\\"6.6 API Standardization\\\", \\\"tab\\\": \\\"AO66\\\" },\\r\\n\\t\\t{ \\\"Select All (Automation & Orchestration 6.x)\\\": \\\"6.7 Security Operations Center (SOC) & Incident Response (IR)\\\", \\\"tab\\\": \\\"AO67\\\" }\\r\\n\\t\\t]\",\"transformers\":null}",
+ "size": 3,
+ "exportMultipleValues": true,
+ "exportedParameters": [
+ {
+ "fieldName": "tab",
+ "parameterName": "Tab",
+ "parameterType": 1
+ }
+ ],
+ "queryType": 8,
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Select All (Automation & Orchestration 6.x)",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "75ch"
+ }
+ },
+ {
+ "columnMatch": "tab",
+ "formatter": 5
+ },
+ {
+ "columnMatch": "Zero Trust",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "75ch"
+ }
+ }
+ ]
+ }
+ },
+ "customWidth": "90",
+ "name": "AutomationOrchZT",
+ "styleSettings": {
+ "showBorder": true
+ }
+ },
+ {
+ "type": 9,
+ "content": {
+ "version": "KqlParameterItem/1.0",
+ "parameters": [
+ {
+ "id": "42fc8445-0772-439f-b490-461fb17e5d2f",
+ "version": "KqlParameterItem/1.0",
+ "name": "isAO61Visible",
+ "type": 1,
+ "isHiddenWhenLocked": true,
+ "criteriaData": [
+ {
+ "criteriaContext": {
+ "leftOperand": "Tab",
+ "operator": "contains",
+ "rightValType": "static",
+ "rightVal": "AO61",
+ "resultValType": "static",
+ "resultVal": "true"
+ }
+ },
+ {
+ "criteriaContext": {
+ "operator": "Default",
+ "resultValType": "static",
+ "resultVal": "false"
+ }
+ }
+ ],
+ "timeContext": {
+ "durationMs": 86400000
+ }
+ },
+ {
+ "id": "6d0940d2-e259-49de-b490-75d026dd6ad3",
+ "version": "KqlParameterItem/1.0",
+ "name": "isAO62Visible",
"type": 1,
"isHiddenWhenLocked": true,
"criteriaData": [
@@ -13920,7 +14637,206 @@
"content": {
"json": "----\n## AuditLogs\n\nThese tables are an example Azure Security Administrators and Zero Trust Implementtors can use so to make sure that the Zero Trust Logging activties of user operations are successfully executed. \nIt also benefits the security operator by seeing which operations are perfomed by which users or services. Therefore he or she can act quickly on a suspicious operation."
},
- "name": "text - 9"
+ "name": "text - 9"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "\nAuditLogs\n| summarize Runs = count(), Success = countif(Result == 'success'), Fails = countif(Result != 'success') by OperationName // Summarize the total, successful and failed operations by name\n| extend SuccessRate = (Success * 100 / Runs) // Calculate the percentage of succesful operations against the total\n| join (\nAuditLogs\n| where Result == 'success'\n| make-series TrendList = count() on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by OperationName \n) on OperationName\n| project OperationName, Runs, SuccessRate, TrendList\n| top 10 by Runs desc // Show the top 10 of most run operations",
+ "size": 0,
+ "title": "Top 10 operation by successrate",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Runs",
+ "formatter": 4,
+ "formatOptions": {
+ "showIcon": true
+ }
+ },
+ {
+ "columnMatch": "SuccessRate",
+ "formatter": 8,
+ "formatOptions": {
+ "min": 0,
+ "max": 100,
+ "palette": "redGreen",
+ "showIcon": true
+ }
+ },
+ {
+ "columnMatch": "TrendList",
+ "formatter": 9,
+ "formatOptions": {
+ "showIcon": true
+ }
+ }
+ ]
+ }
+ },
+ "customWidth": "50",
+ "name": "query - 5"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "\nAuditLogs\n| summarize Runs = count(), Success = countif(Result == 'success'), Fails = countif(Result != 'success') by OperationName // Summarize the total, successful and failed operations by name\n| extend SuccessRate = (Success * 100 / Runs) // Calculate the percentage of succesful operations against the total\n| project OperationName, Runs, SuccessRate, Fails\n| top 10 by SuccessRate asc // Show the 10 Operation by least SuccessRate",
+ "size": 0,
+ "title": "Top 10 most failed operations",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Runs",
+ "formatter": 4,
+ "formatOptions": {
+ "showIcon": true
+ }
+ },
+ {
+ "columnMatch": "SuccessRate",
+ "formatter": 8,
+ "formatOptions": {
+ "min": 0,
+ "max": 100,
+ "palette": "redGreen",
+ "showIcon": true
+ }
+ },
+ {
+ "columnMatch": "Fails",
+ "formatter": 8,
+ "formatOptions": {
+ "palette": "redBright",
+ "showIcon": true
+ }
+ }
+ ]
+ }
+ },
+ "customWidth": "50",
+ "name": "query - 5 - Copy"
+ }
+ ]
+ },
+ "conditionalVisibility": {
+ "parameterName": "isVA71Visible",
+ "comparison": "isEqualTo",
+ "value": "true"
+ },
+ "name": "7.1Activities",
+ "styleSettings": {
+ "showBorder": true
+ }
+ },
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "title": "7.2 Activities",
+ "expandable": true,
+ "items": [
+ {
+ "type": 12,
+ "content": {
+ "version": "NotebookGroup/1.0",
+ "groupType": "editable",
+ "items": [
+ {
+ "type": 1,
+ "content": {
+ "json": "# 7.2 Security Information & Event Management (SIEM)\r\n
\r\n## Microsoft Portals Department of Defense\r\n🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) \r\n🔀 [M365 Admin Center](https://portal.apps.mil/) \r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.us/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0) \r\n"
+ },
+ "customWidth": "33",
+ "name": "LT-1"
+ },
+ {
+ "type": 1,
+ "content": {
+ "json": "
\r\n## Microsoft Portals Government\r\n🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) \r\n🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) \r\n🔀 [Logic Apps](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Logic%2Fworkflows) \r\n🔀 [Azure Active Directory](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) \r\n🔀 [Azure Automation](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/d2175af3-6958-4008-83ac-ac2b81eafac7/appId/fc75330b-179d-49af-87dd-3b1acf6827fa) \r\n"
+ "version": "KqlParameterItem/1.0",
+ "crossComponentResources": [
+ "{Subscription}"
+ ],
+ "parameters": [
+ {
+ "id": "bc9db514-ebcc-4e47-bf23-a0dfe8cb1594",
+ "version": "KqlParameterItem/1.0",
+ "name": "SelectCompliance",
+ "label": "Control",
+ "type": 2,
+ "isRequired": true,
+ "query": "securityresources\r\n| where type == \"microsoft.security/regulatorycompliancestandards\"\r\n| project name\r\n",
+ "crossComponentResources": [
+ "{Subscription}"
+ ],
+ "value": "Microsoft-cloud-security-benchmark",
+ "typeSettings": {
+ "additionalResourceOptions": [
+ "value::1"
+ ],
+ "showDefault": false
+ },
+ "timeContext": {
+ "durationMs": 86400000
+ },
+ "queryType": 1,
+ "resourceType": "microsoft.resourcegraph/resources"
+ },
+ {
+ "id": "385b8e2e-be15-416d-8ed0-730f6dd34737",
+ "version": "KqlParameterItem/1.0",
+ "name": "selectState",
+ "label": "State",
+ "type": 2,
+ "isRequired": true,
+ "query": "securityresources\r\n| where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend state \t\t = trim(' ', tostring(properties.state))\r\n| summarize by state",
+ "crossComponentResources": [
+ "{Subscription}"
+ ],
+ "value": "Passed",
+ "typeSettings": {
+ "additionalResourceOptions": [
+ "value::1"
+ ]
+ },
+ "timeContext": {
+ "durationMs": 86400000
+ },
+ "queryType": 1,
+ "resourceType": "microsoft.resourcegraph/resources"
+ }
+ ],
+ "style": "pills",
+ "queryType": 1,
+ "resourceType": "microsoft.resourcegraph/resources"
},
- "customWidth": "33",
- "name": "LT-1 - Copy"
+ "name": "parameters - 5"
},
{
- "type": 1,
+ "type": 3,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [Automate Threat Response with Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) \r\n💡 [Adaptive Protection - Microsoft Purview](https://www.microsoft.com/en-us/security/blog/2023/02/06/introducing-adaptive-protection-in-microsoft-purview-people-centric-data-protection-for-a-multiplatform-world/#:~:text=With%20Adaptive%20Protection%2C%20DLP%20policies%20become%20dynamic%2C%20ensuring,efficient%20and%20empowered%20to%20do%20more%20with%20less.) \r\n💡 [Adaptive Policy Scopes M365](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/using-adaptive-policy-scopes-to-apply-m365-retention-to-shared/ba-p/3053641#:~:text=Back%20in%20October,in%20Microsoft%20365.) \r\n💡 [Adaptive Application Controls](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls) \r\n💡 [AI-Driven Adaptive Device Controls Microsoft Defender for Endpoint](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/ai-driven-adaptive-protection-in-microsoft-defender-for-endpoint/ba-p/2966491) \r\n💡 [AI-Driven Adaptive Protection Against Human Operated Ransomeware](https://www.microsoft.com/en-us/security/blog/2021/11/15/ai-driven-adaptive-protection-against-human-operated-ransomware/) \r\n💡 [Microsoft Defender for Cloud Automated Security Posture Management](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management) \r\n💡 [Improve your network security posture with adaptive network hardening](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-network-hardening) \r\n💡 [What is Microsoft Entra ID Protection?](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection) \r\n💡 [Azure Automation update management](https://learn.microsoft.com/en-us/azure/architecture/hybrid/azure-update-mgmt) \r\n💡 [Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure) "
+ "version": "KqlItem/1.0",
+ "query": "securityresources\r\n| where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n| parse id with *\"/regulatoryComplianceStandards/\" strControlName \"/regulatory\"*\r\n | extend \r\n\t state \t\t = trim(' ', tostring(properties.state))\r\n\t,description = trim(' ', tostring(properties.description))\r\n| where strControlName startswith '{SelectCompliance}'\r\n| extend isState = iif(isempty('{selectState}'),\"All states\",'{selectState}')\r\n//| where isSstate == '{selectState}'\r\n| summarize by ControlName = strControlName, name, Status = isState, description",
+ "size": 0,
+ "queryType": 1,
+ "resourceType": "microsoft.resourcegraph/resources",
+ "crossComponentResources": [
+ "{Subscription}"
+ ],
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Status",
+ "formatter": 18,
+ "formatOptions": {
+ "thresholdsOptions": "colors",
+ "thresholdsGrid": [
+ {
+ "operator": "==",
+ "thresholdValue": "Passed",
+ "representation": "greenDark",
+ "text": "{0}{1}"
+ },
+ {
+ "operator": "==",
+ "thresholdValue": "Failed",
+ "representation": "redBright",
+ "text": "{0}{1}"
+ },
+ {
+ "operator": "==",
+ "thresholdValue": "Skipped",
+ "representation": "gray",
+ "text": "{0}{1}"
+ },
+ {
+ "operator": "==",
+ "thresholdValue": "Unsupported",
+ "representation": "blue",
+ "text": "{0}{1}"
+ },
+ {
+ "operator": "Default",
+ "thresholdValue": null,
+ "representation": "blue",
+ "text": "{0}{1}"
+ }
+ ]
+ }
+ }
+ ]
+ }
},
- "customWidth": "33",
- "name": "LT-1 - Copy - Copy"
+ "name": "query - 3"
}
]
},
- "name": "group - 6"
- },
- {
- "type": 1,
- "content": {
- "json": "## Example Visual Representations \r\n"
+ "conditionalVisibility": {
+ "parameterName": "Tab",
+ "comparison": "isEqualTo",
+ "value": "ASC"
},
- "name": "text - 5"
+ "name": "ASC"
}
]
},
@@ -18205,6 +19428,9 @@
"name": "ZTActivities"
}
],
+ "fallbackResourceIds": [
+ "/subscriptions/3ab4869f-acc9-49ec-a399-12efd162502f/resourcegroups/cets-sentinel/providers/microsoft.operationalinsights/workspaces/cetsgovsentinel"
+ ],
"fromTemplateId": "sentinel-UserWorkbook",
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
-}
\ No newline at end of file
+}
From 638286604f8f9e9c1b857e689bdf3aace07a09b6 Mon Sep 17 00:00:00 2001
From: "Chhorn Lim (MSFT)" <50709199+ChhornGLim@users.noreply.github.com>
Date: Mon, 21 Aug 2023 09:56:23 -0500
Subject: [PATCH 03/12] Cleaning up FAQ & Links
Changed some FAQ verbiage and updated URL links (placeholders)
---
Workbooks/DoDZeroTrustWorkbook.json | 20 +++++++++-----------
1 file changed, 9 insertions(+), 11 deletions(-)
diff --git a/Workbooks/DoDZeroTrustWorkbook.json b/Workbooks/DoDZeroTrustWorkbook.json
index daeb6f60307..683e71589ff 100644
--- a/Workbooks/DoDZeroTrustWorkbook.json
+++ b/Workbooks/DoDZeroTrustWorkbook.json
@@ -153,7 +153,7 @@
{
"type": 1,
"content": {
- "json": "# [DoD Zero Trust Strategy Workbook](https://dodcio.defense.gov/Portals/0/Documents/Library/DoD-ZTExecutionRoadmap.pdf)\n---\n\n\"The journey to Zero Trust requires all DoD Components to adopt and integrate Zero Trust capabilities, technologies, solutions, and processes across their architectures, systems, and within their budget and execution plans. Perhaps most importantly, they must also address Zero Trust requirements within their staffing, training, and professional development processes as well.\" For more information, see the💡 [DoD CIO Zero Trust Strategy](https://dodcio.defense.gov/Portals/0/Documents/Library/DoD-ZTStrategy.pdf).
\nThis workbook solution provides an intuitive, customizable, framework intended to help track/report Zero Trust implementation in accordance with the latest DoD CIO Zero Trust Strategy (November 2022). It fully aligns with the DoD CIO Zero Trust Strategy and also enables the following: \n- Maturity Situational Awareness of the DoD CIO Zero Trust Framework\n- Provides Configuration Guides, Examples, Resources, and Steps for Deployment \n- Enables actions and reporting on DoD CIO Zero Trust Framework Pillars, Capabilities, and Activities \n\n"
+ "json": "# [DoD Zero Trust Strategy Workbook](https://dodcio.defense.gov/Portals/0/Documents/Library/DoD-ZTExecutionRoadmap.pdf)\n---\n\n\"The journey to Zero Trust requires all DoD Components to adopt and integrate Zero Trust capabilities, technologies, solutions, and processes across their architectures, systems, and within their budget and execution plans. Perhaps most importantly, they must also address Zero Trust requirements within their staffing, training, and professional development processes as well.\" For more information, see the💡 [DoD CIO Zero Trust Strategy](https://dodcio.defense.gov/Portals/0/Documents/Library/DoD-ZTStrategy.pdf).
\nThis workbook solution provides an intuitive, customizable, framework intended to help track/report Zero Trust implementation in accordance with the latest DoD Zero Trust Strategy (November 2022). It fully aligns with the DoD Zero Trust Strategy and also enables the following: \n- Maturity Situational Awareness of the DoD Zero Trust Framework\n- Provides Configuration Guides, Examples, Resources, and Steps for Deployment \n- Enables actions and reporting on DoD Zero Trust Framework Pillars, Capabilities, and Activities \n\n"
},
"name": "Workbook Overview"
},
@@ -165,24 +165,25 @@
"links": [
{
"id": "1bad541e-219a-4277-9510-876b0e8cad51",
- "cellValue": "https://learn.microsoft.com/en-us/azure/sentinel/monitor-your-data",
- "linkTarget": "Url",
+ "cellValue": "Coming soon!",
+ "linkTarget": "CellDetails",
"linkLabel": "Solution Blog",
"postText": "",
"style": "link"
},
{
"id": "b9a6293e-1c7b-4ec2-ad2a-d72b5ee01722",
- "cellValue": "https://www.youtube.com/watch?app=desktop&v=tGhZkuSPMiM&feature=youtu.be",
- "linkTarget": "Url",
+ "cellValue": "Coming soon!",
+ "linkTarget": "CellDetails",
"linkLabel": "Video Overview",
+ "postText": "",
"style": "link"
},
{
"id": "7e8ff8aa-f632-4a4d-90cf-a71da0dc6b31",
- "cellValue": "https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/DoDZeroTrust",
+ "cellValue": "https://github.com/Azure/Azure-Sentinel",
"linkTarget": "Url",
- "linkLabel": "GitHub Repo",
+ "linkLabel": "Sentinel GitHub Repo",
"postText": "",
"style": "link"
},
@@ -19369,7 +19370,7 @@
{
"type": 1,
"content": {
- "json": "## DoD Zero Trust Strategy Workbook Workbook FAQ \r\n\r\n \r\n### What will this workbook do for my organization? \r\n\r\nThis workbook provides structure, guidance, and simplification of the DoD CIO Zero Trust Strategy to make it easier to track, prioritize, and improve Zero Trust Target (and Advanced) level Capabilities/Activities that are required to be implemented by 2027. \r\n\r\n \r\n### Does this workbook only pertain to Microsoft-specific capabiltiies?\r\n\r\nNo, the out-of-the-box content of this Sentinel workbook includes references to Microsoft-specific capabilities/solutions. However, the workbook has been designed to account for \"Alternate Implementations\" (non-Microsoft), which can also meet the Target (and Advanced)-level Zero Trust Capabilities and Activities. \r\n\r\n \r\n### How will this workbook help with deployment and maturity of the DoD CIO Zero Trust Strategy Capabilities & Activities? \r\n\r\n* Provides Zero Trust roll-up of organizational maturity and situational awareness as it relates directly to the 2027 Zero Trust Target-level deadline. \r\n\r\n* Provides DoD Zero Trust Activity simplification and improved awareness, allowing responsible parties for each pillar(s) to report which capabilities are planned, implemented, or not applicable. \r\n\r\n* Provides guidance and recommendations to meet the 45 capabilities (and supporting 152 activities) \r\n\r\n* Provides a working (and evolving) organized method of orchestrating and managing/tracking efforts around the Zero Trust Capabilities and Activities covered in the DoD CIO Zero Trust Strategy. \r\n\r\n \r\n### Why are some of the visualizations not working in my workbook? \r\n\r\nThe visualizations within this workbook are simply examples and rely on specific logs to populate accordingly. We realize that not every organization leverages the same solution logs used to build/populate this workbook. In addition, we also realize that many customers leverage third-party solutions for their needs. Every implementation of this workbook is unique to the respective environment in which it is installed. It is intended to be a starting point and can be further customized to better meet the needs of each customer. Please contact your Account Representative if your team requires further assistance and/or customizations. \r\n\r\nVisualizations can be used to show examples of the DoD CIO Zero Trust Activities in use/or configurations themselves. They can also be used to further develop automations related to improving cyber hygiene through deploying Zero Trust principals. \r\n\r\n \r\n### Who should use this workbook? \r\n\r\nThis workbook is designed for both executives and individuals who are directly responsible for implementing the respective Capabilities/Activities due by 2027 outlined in the DoD CIO Zero Trust Strategy. \r\n\r\nThis workbook derives language and terminology specific to the DoD CIO Zero Trust Strategy. However, many non-DoD organizations can also leverage this guidance for their needs. \r\n\r\n \r\n### Where does the Zero Trust Maturity (Percentage) score come from? \r\n\r\nThe Zero Trust Maturity score is calculated based on the interactive capabilities sections contained within each of the pillars. When updated, the drop-down boxes labeled, “Implementation Status” directly contribute to the overall level of maturity reported under the “Zero Trust Essentials” → \"DoD CIO Zero Trust Assessment Tracker\". \r\n\r\n \r\n### How can I make recommendations to improve this workbook? \r\n\r\nPlease utilize the link in the opening screen labeled, “Please take some time to take a quick survey”. Our team values these responses and takes them very seriously. Any feedback that you can provide is greatly appreciated. \r\n\r\n \r\n### Can this workbook be customized? \r\n\r\nYes! This workbook has been created with additional customization in mind. Please contact your Account Representative if you would to like to inquire about any additional assistance with customizing this workbook to suit your organizational goals related to DoD CIO Zero Trust Strategy maturity. \r\n\r\n \r\n### Do other customers outside the DoD utilize this workbook? \r\n\r\nYes, Many customers outside the DoD have gravitated toward the DoD CIO Zero Trust Strategy because it includes specfiic \"Capabilities and Activities\" that apply to the Zero Trust Principals. \r\n\r\n \r\n### Who created this workbook? \r\n\r\nThis workbook was created by a collaboration of Microsoft teams and subject matter experts along with our pilot customers. \r\n\r\n \r\n### Does this workbook cover all 152 “Activities” defined in the Strategy? \r\n\r\nYes, the recommendations, visualizations, and guidance, while centered around the 45 capabilities, will still apply to all 152 activities. This workbook aims to simplify the Target (and Advanced)-level Zero Trust Capabilities and Activities. Based on prior feedback, this workbook may be updated in the future to include further guidance, reporting, and relevant information. ",
+ "json": "## DoD Zero Trust Strategy Workbook Workbook FAQ \r\n\r\n \r\n### What will this workbook do for my organization? \r\n\r\nThis workbook provides structure, guidance, and simplification of the DoD Zero Trust Strategy to make it easier to track, prioritize, and improve Zero Trust Target (and Advanced) level Capabilities/Activities that are required to be implemented by 2027. \r\n\r\n \r\n### Does this workbook only pertain to Microsoft-specific capabiltiies?\r\n\r\nNo, the out-of-the-box content of this Sentinel workbook includes references to Microsoft-specific capabilities/solutions. However, the workbook has been designed to account for \"Alternate Implementations\" (non-Microsoft), which may also meet the Target (and Advanced)-level Zero Trust Capabilities and Activities. In addition, Microsoft Sentinel supports custom log formats and multiple third-party [data connectors](\"https://learn.microsoft.com/en-us/azure/sentinel/data-connectors-reference\") that can provide visibility for non-Microsoft solutions. \r\n\r\n \r\n### How will this workbook help with deployment and maturity of the DoD Zero Trust Strategy Capabilities & Activities? \r\n\r\n* Provides Zero Trust roll-up of organizational maturity and situational awareness as it relates directly to the 2027 Zero Trust Target-level deadline. \r\n\r\n* Provides DoD Zero Trust Activity simplification and improved awareness, allowing responsible parties for each pillar(s) to report which capabilities are planned, implemented, or not applicable. \r\n\r\n* Provides guidance and recommendations to meet the 45 capabilities (and supporting 152 activities) \r\n\r\n* Provides a working (and evolving) organized method of orchestrating and managing/tracking efforts around the Zero Trust Capabilities and Activities covered in the DoD Zero Trust Strategy. \r\n\r\n \r\n### Why are some of the visualizations not working in my workbook? \r\n\r\nThe visualizations within this workbook are simply examples and rely on specific logs to populate accordingly. We realize that not every organization leverages the same solution logs used to build/populate this workbook. In addition, we also realize that many customers leverage third-party solutions for their needs. Every implementation of this workbook is unique to the respective environment in which it is installed. It is intended to be a starting point and can be further customized to better meet the needs of each customer. Please contact your Account Representative if your team requires further assistance and/or customizations. \r\n\r\nVisualizations can be used to show examples of the DoD Zero Trust Activities in use/or configurations themselves. They can also be used to further develop automations related to improving cyber hygiene through deploying Zero Trust principals. \r\n\r\n \r\n### Who should use this workbook? \r\n\r\nThis workbook is designed for both executives and individuals who are directly responsible for implementing the respective Capabilities/Activities due by 2027 outlined in the DoD Zero Trust Strategy. \r\n\r\nThis workbook derives language and terminology specific to the DoD Zero Trust Strategy. However, many non-DoD organizations can also leverage this guidance for their needs. \r\n\r\n \r\n### Where does the Zero Trust Maturity (Percentage) score come from? \r\n\r\nThe Zero Trust Maturity score is calculated based on the interactive capabilities sections contained within each of the pillars. When updated, the drop-down boxes labeled, “Implementation Status” directly contribute to the overall level of maturity reported under the “Zero Trust Essentials” → \"DoD Zero Trust Assessment Tracker\". \r\n\r\n \r\n### How can I make recommendations to improve this workbook? \r\n\r\nPlease utilize the link in the opening screen labeled, “Please take some time to take a quick survey”. Our team values these responses and takes them very seriously. Any feedback that you can provide is greatly appreciated. \r\n\r\n \r\n### Can this workbook be customized? \r\n\r\nYes! This workbook has been created with additional customization in mind. Please contact your Account Representative if you would to like to inquire about any additional assistance with customizing this workbook to suit your organizational goals related to DoD Zero Trust Strategy maturity. \r\n\r\n \r\n### Do other customers outside the DoD utilize this workbook? \r\n\r\nYes, many customers outside the DoD have also gravitated toward the DoD Zero Trust Strategy because it focuses on an outcomes-focused methodology and includes specific \"Capabilities and Activities\" that apply to core Zero Trust principals. \r\n\r\n \r\n### Who created this workbook? \r\n\r\nThis workbook was created by a collaboration of Microsoft teams and subject matter experts along with our pilot customers. \r\n\r\n \r\n### Does this workbook cover all 152 “Activities” defined in the Strategy? \r\n\r\nYes, the recommendations, visualizations, and guidance, while centered around the 45 capabilities, will still apply to all 152 activities. This workbook aims to simplify the Target (and Advanced)-level Zero Trust Capabilities and Activities. Based on prior feedback, this workbook may be updated in the future to include further guidance, reporting, and relevant information. ",
"style": "info"
},
"conditionalVisibility": {
@@ -19428,9 +19429,6 @@
"name": "ZTActivities"
}
],
- "fallbackResourceIds": [
- "/subscriptions/3ab4869f-acc9-49ec-a399-12efd162502f/resourcegroups/cets-sentinel/providers/microsoft.operationalinsights/workspaces/cetsgovsentinel"
- ],
"fromTemplateId": "sentinel-UserWorkbook",
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}
From 4a43a5e3f32435b8830af19a640c0521cd66f53c Mon Sep 17 00:00:00 2001
From: "Chhorn Lim (MSFT)" <50709199+ChhornGLim@users.noreply.github.com>
Date: Tue, 5 Sep 2023 08:46:16 -0500
Subject: [PATCH 04/12] Final Release v1.0
Final release v1.0
---
Workbooks/DoDZeroTrustWorkbook.json | 3447 +++++++++++++++++++++++++--
1 file changed, 3248 insertions(+), 199 deletions(-)
diff --git a/Workbooks/DoDZeroTrustWorkbook.json b/Workbooks/DoDZeroTrustWorkbook.json
index 683e71589ff..da57082d436 100644
--- a/Workbooks/DoDZeroTrustWorkbook.json
+++ b/Workbooks/DoDZeroTrustWorkbook.json
@@ -153,7 +153,7 @@
{
"type": 1,
"content": {
- "json": "# [DoD Zero Trust Strategy Workbook](https://dodcio.defense.gov/Portals/0/Documents/Library/DoD-ZTExecutionRoadmap.pdf)\n---\n\n\"The journey to Zero Trust requires all DoD Components to adopt and integrate Zero Trust capabilities, technologies, solutions, and processes across their architectures, systems, and within their budget and execution plans. Perhaps most importantly, they must also address Zero Trust requirements within their staffing, training, and professional development processes as well.\" For more information, see the💡 [DoD CIO Zero Trust Strategy](https://dodcio.defense.gov/Portals/0/Documents/Library/DoD-ZTStrategy.pdf).
\nThis workbook solution provides an intuitive, customizable, framework intended to help track/report Zero Trust implementation in accordance with the latest DoD Zero Trust Strategy (November 2022). It fully aligns with the DoD Zero Trust Strategy and also enables the following: \n- Maturity Situational Awareness of the DoD Zero Trust Framework\n- Provides Configuration Guides, Examples, Resources, and Steps for Deployment \n- Enables actions and reporting on DoD Zero Trust Framework Pillars, Capabilities, and Activities \n\n"
+ "json": "# [DoD Zero Trust Strategy Workbook](https://dodcio.defense.gov/Portals/0/Documents/Library/DoD-ZTExecutionRoadmap.pdf)\n---\n\n\"The journey to Zero Trust requires all DoD Components to adopt and integrate Zero Trust capabilities, technologies, solutions, and processes across their architectures, systems, and within their budget and execution plans. Perhaps most importantly, they must also address Zero Trust requirements within their staffing, training, and professional development processes as well.\" For more information, see the [DoD CIO Zero Trust Strategy](https://dodcio.defense.gov/Portals/0/Documents/Library/DoD-ZTStrategy.pdf).
\r\n## Microsoft Portals Government\r\n🔀 [Azure Active Directory](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) \r\n🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) \r\n🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) \r\n"
+ "json": "
\r\n## Microsoft Portals Government\r\n🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) \r\n🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) \r\n🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) \r\n🔀 [Azure Arc](https://portal.azure.us/#view/Microsoft_Azure_HybridCompute/AzureArcCenterBlade/~/overview)\r\n"
},
"customWidth": "33",
"name": "text - 6"
@@ -5611,7 +5625,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [What is Windows Update for Business?](https://learn.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb) \r\n💡 [Update rings for Windows 10 and later policy in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-10-update-rings?source=recommendations) \r\n💡 [Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure) \r\n💡 [Deploy software updates with Configuration Manager](https://learn.microsoft.com/en-us/mem/configmgr/sum/deploy-use/deploy-software-updates) \r\n💡 [Use Intune to remediate vulnerabilities identified by Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/mem/intune/protect/atp-manage-vulnerabilities) \r\n💡 [Remediate vulnerabilities (Defender for Endpoint)](https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-remediation?view=o365-worldwide) \r\n💡 [Choose how to deliver updates for the Microsoft 365 Apps](https://learn.microsoft.com/en-us/deployoffice/fieldnotes/choose-how-to-deliver-updates) \r\n💡 [Windows Release Health](https://learn.microsoft.com/en-us/windows/release-health/) \r\n💡 [Manage updates and patches for your VMs](https://learn.microsoft.com/en-us/azure/automation/update-management/manage-updates-for-vm) \r\n💡 [Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) \r\n"
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [What is Windows Update for Business?](https://learn.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb) \r\n💡 [Microsoft Configuration Manager MECEM](https://learn.microsoft.com/en-us/mem/configmgr/core/understand/introduction) \r\n💡 [Update rings for Windows 10 and later policy in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-10-update-rings?source=recommendations) \r\n💡 [Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure) \r\n💡 [Deploy software updates with Configuration Manager](https://learn.microsoft.com/en-us/mem/configmgr/sum/deploy-use/deploy-software-updates) \r\n💡 [Use Intune to remediate vulnerabilities identified by Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/mem/intune/protect/atp-manage-vulnerabilities) \r\n💡 [Remediate vulnerabilities (Defender for Endpoint)](https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-remediation?view=o365-worldwide) \r\n💡 [Choose how to deliver updates for the Microsoft 365 Apps](https://learn.microsoft.com/en-us/deployoffice/fieldnotes/choose-how-to-deliver-updates) \r\n💡 [Windows Release Health](https://learn.microsoft.com/en-us/windows/release-health/) \r\n💡 [Manage updates and patches for your VMs](https://learn.microsoft.com/en-us/azure/automation/update-management/manage-updates-for-vm) \r\n💡 [Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) \r\n"
},
"customWidth": "33",
"name": "text - 6"
@@ -5722,6 +5736,7 @@
"groupType": "editable",
"title": "2.6 Activities",
"expandable": true,
+ "expanded": true,
"items": [
{
"type": 12,
@@ -5732,7 +5747,7 @@
{
"type": 1,
"content": {
- "json": "# 2.6 Unified Endpoint Management & Mobile Patch Management\r\n\r\n## Microsoft Portals Department of Defense\r\n🔀 [Azure Active Directory](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) \r\n🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) \r\n🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) "
+ "json": "# 2.6 Unified Endpoint Management & Mobile Patch Management\r\n\r\n## Microsoft Portals Department of Defense\r\n🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) \r\n🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) \r\n🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) \r\n🔀 [Azure Arc](https://portal.azure.us/#view/Microsoft_Azure_HybridCompute/AzureArcCenterBlade/~/overview)"
},
"name": "LT-1"
}
@@ -5744,7 +5759,7 @@
{
"type": 1,
"content": {
- "json": "
\r\n## Microsoft Portals Government\r\n🔀 [Azure Active Directory](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) \r\n🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) \r\n🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) "
+ "json": "
\r\n## Microsoft Portals Government\r\n🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) \r\n🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) \r\n🔀 [Logic Apps](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Logic%2Fworkflows) \r\n🔀 [Azure Active Directory](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) \r\n🔀 [Azure Automation](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/d2175af3-6958-4008-83ac-ac2b81eafac7/appId/fc75330b-179d-49af-87dd-3b1acf6827fa) \r\n"
+ "json": "
\r\n## Microsoft Portals Government\r\n🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) \r\n🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) \r\n🔀 [Logic Apps](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Logic%2Fworkflows) \r\n🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) \r\n🔀 [Azure Automation](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/d2175af3-6958-4008-83ac-ac2b81eafac7/appId/fc75330b-179d-49af-87dd-3b1acf6827fa) \r\n🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) \r\n🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) \r\n"
},
"customWidth": "33",
"name": "LT-1 - Copy"
@@ -15575,7 +15616,7 @@
{
"type": 1,
"content": {
- "json": "## Microsoft Defender for Cloud Security Continous Posture Monitoring & Manangement "
+ "json": "## Microsoft Defender for Cloud Security Continuous Posture Monitoring & Manangement "
},
"name": "text - 2"
},
@@ -15591,7 +15632,7 @@
"type": 4,
"isRequired": true,
"value": {
- "durationMs": 2592000000
+ "durationMs": 7776000000
},
"typeSettings": {
"selectableValues": [
@@ -15710,30 +15751,6 @@
"linkLabel": "Azure Security Center",
"subTarget": "ASC",
"style": "link"
- },
- {
- "id": "797538b2-ca75-48ad-85b2-e12d9d59fb08",
- "cellValue": "Tab",
- "linkTarget": "parameter",
- "linkLabel": "Microsoft 365",
- "subTarget": "M365",
- "style": "link"
- },
- {
- "id": "d4f75516-6286-4660-8294-395da6b9c29a",
- "cellValue": "Tab",
- "linkTarget": "parameter",
- "linkLabel": "Defender for Endpoint",
- "subTarget": "D4E",
- "style": "link"
- },
- {
- "id": "96141225-a0ad-43ca-bf96-e701c64318ce",
- "cellValue": "Tab",
- "linkTarget": "parameter",
- "linkLabel": "Microsoft Cloud App Security",
- "subTarget": "MCAS",
- "style": "link"
}
]
},
@@ -15814,7 +15831,8 @@
"columnMatch": "maxscore",
"formatter": 1
}
- ]
+ ],
+ "filter": true
}
},
"name": "query - 1"
@@ -15881,7 +15899,8 @@
]
}
}
- ]
+ ],
+ "filter": true
}
},
"name": "query - 2"
@@ -15905,7 +15924,7 @@
"crossComponentResources": [
"{Subscription}"
],
- "value": "Microsoft-cloud-security-benchmark",
+ "value": "DOD-IL5",
"typeSettings": {
"additionalResourceOptions": [
"value::1"
@@ -15929,7 +15948,7 @@
"crossComponentResources": [
"{Subscription}"
],
- "value": "Passed",
+ "value": "Failed",
"typeSettings": {
"additionalResourceOptions": [
"value::1"
@@ -16000,7 +16019,9 @@
]
}
}
- ]
+ ],
+ "rowLimit": 1000,
+ "filter": true
}
},
"name": "query - 3"
@@ -19383,7 +19404,7 @@
{
"type": 1,
"content": {
- "json": "## Microsoft to DoD CIO Zero Trust Capability Alignment\r\n\r\n#### In an effort to support our DoD customers, we have provided the following as a general overview of how Microsoft products/capabilities align with the latest DoD CIO Zero Trust Strategy. The following document correlates specific Microsoft solution(s) to each of the 45 main capabilities contained in the latest version from November of 2022.\r\n\r\n \r\n\r\n| DoD Zero Trust Pillar | DoD Zero Trust Capability | Recommended Microsoft Solution(s) | Recommended Resources |\r\n|--------------------------------|------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\r\n| User 1.x | | | |\r\n| | 1.1 User Inventory | Entra ID Microsoft Sentinel UEBA Microsoft Defender for Cloud (MDfC) | 💡 [Microsoft Identity Platform Entra (formerly AAD)](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-overview) 💡 [Microsoft Hybrid Identity with Entra/AAD/AD](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/) 💡 [Using the Inventory in Secure Score - Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory) 💡 [Identity Decision Guide](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/decision-guides/identity/) 💡 [Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/en-us/download/details.aspx?id=54431) 💡 [Identity Security Monitoring](https://github.com/Cloud-Architekt/AzureAD-Attack-Defense/blob/main/IdentitySecurityMonitoring.md#identity-security-monitoring-in-a-hybrid-environment) 💡 [Collect Azure Active Directory (Azure AD) Logs](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics#send-logs-to-azure-monitor) 💡 [Enable User Entity Behavorial Analytics](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics#how-to-enable-user-and-entity-behavior-analytics) 💡 [Deploy Microsoft Defender for Identity](https://learn.microsoft.com/en-us/defender-for-identity/deploy-defender-identity) 💡 [Secure with Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/secure-with-azure-ad-introduction) 💡 [AAD Hybrid Identity](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/plan-hybrid-identity-design-considerations-overview?WT.mc_id=DT-MVP-5001664) 💡 [Azure AD Reports](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/overview-reports?WT.mc_id=DT-MVP-5001664) 💡 [B2B Collaboration](https://learn.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b?WT.mc_id=DT-MVP-5001664) |\r\n| | 1.2 Conditional User Access | Entra ID Conditional Access (CA) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel Microsoft 365 Defender Microsoft Intune | 💡 [What is Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview) 💡 [Conditional Access Learning Path](https://learn.microsoft.com/en-us/training/modules/plan-implement-administer-conditional-access/) 💡 [Conditional Access Licensing- Need at least AADP1](https://www.microsoft.com/en-us/security/business/identity-access/azure-active-directory-pricing?rtc=1) 💡 [Conditional Access Design Principles](https://learn.microsoft.com/en-us/azure/architecture/guide/security/conditional-access-design) 💡 [Templates -Secure Foundation & Work Toward ZT](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common) 💡 [Conditional Access Trends and Changes](https://github.com/Cyberlorians/Workbooks/blob/main/ConditionalAccessTrendsandChanges.json) 💡 [Implement Authentication Strengths](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/authentication-strength-choose-the-right-auth-method-for-your/ba-p/2365674) 💡 [Intune Conditional Access](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) 💡 [Using Locations in Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition) |\r\n| | 1.3 Multi-Factor Authentication (MFA) | Entra ID Entra ID - Certificate Based Authorization (CBA) | 💡 [How MFA Works](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks) 💡 [Setup Multifactor Authenication for Users M365](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) 💡 [Configure the MFA Azure Active Directrory Registration Policies](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) 💡 [Deploy Passwordless Solution](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-deployment) 💡 [Configure Azure AD CBA](https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-certificate-based-authentication) 💡 [Conditional Access Policy - MFA](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy?WT.mc_id=DT-MVP-5001664) 💡 [Plan AAD MFA](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted?WT.mc_id=DT-MVP-5001664) |\r\n| | 1.4 Privileged Access Management (PAM) | Entra ID Entra ID - Privileged Identity Management (PIM) | 💡 [Plan a Privileged Identity Management Deployment](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-deployment-plan) 💡 [Privileged Identity Management - Why use it with Defender for O365?](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/use-privileged-identity-management-in-defender-for-office-365?view=o365-worldwide) 💡 [Implementing PIM - Micrsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started) 💡 [Secure Roadmap - PIM](https://learn.microsoft.com/en-us/azure/active-directory/roles/security-planning#use-azure-ad-privileged-identity-management) 💡 [PIM for Groups](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/concept-pim-for-groups) 💡 [PIM Compliancy with Sentinel](https://learnsentinel.blog/2021/07/26/enforce-pim-compliance-with-azure-sentinel-and-playbooks/) 💡 [Configure Approve or Deny Request for AD Roles in PIM](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-approval-workflow) 💡 [Azure Security Benchmark Defender for Identity](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/defender-for-identity-security-baseline) |\r\n| | 1.5 Identity Federation & User Credentialing | Entra ID - Certificate-Based Authorization (CBA) Entra ID - Guest Access | 💡 [Azure Governement - Planning Identity for Azure Government Apps](https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-plan-identity) 💡 [Federated Identity Credentials](https://learn.microsoft.com/en-us/graph/api/resources/federatedidentitycredentials-overview?view=graph-rest-1.0) 💡 [What is Hybrid Identity](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-hybrid-identity) 💡 [Azure AD Certificate Based Authentication](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-certificate-based-authentication) 💡 [Azure AD SCIM](https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups) 💡 [Provisioning with Google Cloud](https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on) 💡 [Provisioning with Amazon Cloud](https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/aws-single-sign-on-provisioning-tutorial) 💡 [Azure AD Application Roles](https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps) 💡 [What is Identity Governace?](https://learn.microsoft.com/en-us/azure/active-directory/governance/identity-governance-overview) |\r\n| | 1.6 Behavioral, Contextual ID, and Biometrics | Microsoft Sentinel UEBA Entra ID - Identity Protection | 💡 [User Entity Behavorial Analytics - What is it?](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [Windows Hello Biometrics](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise) 💡 [Identify Advanced Threats with UEBA](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [UEBA Reference](https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference?WT.mc_id=AZ-MVP-5004810#ueba-enrichments) 💡 [UEBA Sentinel Content Hub](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/ueba-essentials-solution-now-available-in-content-hub/ba-p/3651074) 💡 [Guided UEBA Investigation Scenarios](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/guided-ueba-investigation-scenarios-to-empower-your-soc/ba-p/1857100) 💡 [Combatting Risky Sign-ins in Azure Active Directory](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/combatting-risky-sign-ins-in-azure-active-directory/ba-p/3724786) 💡 [Securing Workload Identities](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-workload-identity-risk) 💡 [Reprise99 UEBA](https://github.com/reprise99/Sentinel-Queries/tree/main/UEBA) |\r\n| | 1.7 Least Privileged Access | Entra ID - Permissions Azure Policy Entra ID - Privileged Identity Management (PIM) | 💡 [Implementing Least-Privileged Administrative Models](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models) 💡 [Enhance Application Security with Lease Privilege Access Controls](https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-least-privileged-access) 💡 [Identity Protection](https://techcommunity.microsoft.com/t5/itops-talk-blog/what-s-the-difference-between-azure-active-directory-identity/ba-p/1320887?WT.mc_id=itopstalk-newsletter-abartolo) 💡 [Continuous Access Evaluation Monitoring](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-continuous-access-evaluation-troubleshoot#continuous-access-evaluation-sign-in-reporting) |\r\n| | 1.8 Continuous Authentication | Entra ID - Continuous Access Evaluation (CAE) Entra ID - Privileged Identity Management (PIM) Entra ID - Identity Protection | 💡 [Implement Continuous Access Evaluation Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation) 💡 [Implementing Primary Refresh Token](https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token) 💡 [Privileged Identity Management Insights](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-security-wizard#discovery-and-insights-preview) 💡 [Entra Permissions Managment](https://learn.microsoft.com/en-us/azure/active-directory/cloud-infrastructure-entitlement-management/permissions-management-trial-user-guide) 💡 [Session Management with Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime) |\r\n| | 1.9 Integrated ICAM Platform | Entra Entitlement Management Entra ID Certificate Based Authentication (CBA) | 💡 [Microsoft Integrated Identity Platform Entra](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-overview) 💡 [Implement Passwordless Auth with Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/auth-passwordless) 💡 [Configure Passwordless Key with Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-security-key) 💡 [Entra Certificate Based Authorization](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-certificate-based-authentication) |\r\n| Device 2.x | | | |\r\n| | 2.1 Device Inventory | Microsft Entra ID Microsft Entra ID Conditional Access (CA) Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Defender for Identity (MDI) Microsoft Intune | 💡 [M365 Defender Device inventory](https://learn.microsoft.com/en-us/graph/api/resources/intune-graph-overview?view=graph-rest-1.0%22%20%EF%BF%BDHYPERLINK%20%22https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machines-view-overview?view=o365-worldwide) 💡 [What is a device identity (Azure Active Directory)?](https://learn.microsoft.com/en-us/azure/active-directory/devices/overview) 💡 [Manage device identities by using the Azure portal](https://learn.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal) 💡 [Manage your devices and control features with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-devices) 💡 [Hybrid Azure AD joined devices](https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-join-hybrid) 💡 [Conditional Access policy: Device Compliancy](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡 [ZT Guide: Endpoint Zero Trust Deployment Objectives](https://learn.microsoft.com/en-us/security/zero-trust/deploy/endpoints#endpoint-zero-trust-deployment-objectives) 💡 [Intune Reporting](https://learn.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor) ** not yet availble in DoD cloud 💡 [Provide Additional Intune Reporting](https://www.linkedin.com/pulse/provide-additional-intune-reporting-data-wmi-iren%C3%A4us-becker/) 💡 [Working with Intune in Microsoft Graph](https://learn.microsoft.com/en-us/graph/api/resources/intune-graph-overview?view=graph-rest-1.0) |\r\n| | 2.2 Device Detection and Compliance | Entra ID Conditional Access (CA) Microsoft Defender for Endpoint (MDE) Microsoft Intune | 💡 [Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) 💡 [Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) 💡 [Configure Conditional Access in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) 💡 [Scenarios for using Conditional Access with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access-intune-common-ways-use?source=recommendations) |\r\n| | 2.3 Device Authorization w/ Real Time Inspection | Microsft Entra ID Microsoft Intune Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 💡 [Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) 💡 [Device discovery overview](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-discovery?view=o365-worldwide) 💡 [Learn about Conditional Access and Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) 💡 [Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) 💡 [Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance) 💡 [Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡 [Conditional Access insights and reporting workbook - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-insights-reporting) 💡 [Plan an Azure Active Directory Conditional Access deployment - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access) 💡 [Azure Samples for Conditional Access (PowerShell) - GitHub](https://github.com/Azure-Samples/azure-ad-conditional-access-apis/tree/main/01-configure/powershell)
Additional References: 💡 [Track changes to system files and registry keys](https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview) 💡 [Connect Microsoft Defender for Cloud alerts to Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-defender-for-cloud) 💡 [Deploying and Managing Microsoft Defender for Cloud as Code](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/deploying-and-managing-microsoft-defender-for-cloud-as-code/ba-p/3649653) 💡 [Collect data in custom log formats to Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-custom-logs?tabs=DCG) 💡 [Azure Monitor Agent overview - Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview) 💡 [Use entity behavior analytics to detect advanced threats](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics) |\r\n| | 2.4 Remote Access | Microsft Entra ID Microsft Entra ID Conditional Access (CA) Microsoft Intune Microsoft Defender for Endpoint (MDE) | 💡 [Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡 [Conditional Access APIs and PowerShell - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-apis) 💡 [Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) 💡 [Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance) 💡 [Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) 💡 [Configure Conditional Access in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) 💡 [Enhance security with the principle of least privilege](https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-least-privileged-access) 💡 [Best practices for Azure AD roles](https://learn.microsoft.com/en-us/azure/active-directory/roles/best-practices) 💡 [Least privileged roles by task in Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/roles/delegate-by-task) |\r\n| | 2.5 Partially & Fully Automated Asset, Vulnerability and Patch | Microsoft Intune Microsoft Endpoint Configuration Manager (MECM) Mircosoft Defender for Endpoint (MDE) Threat & Vulnerability Management (TVM) Azure Arc-enabled Servers Azure Automation | 💡 [What is Windows Update for Business?](https://learn.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb) 💡 [Update rings for Windows 10 and later policy in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-10-update-rings?source=recommendations) 💡 [Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure) 💡 [Deploy software updates with Configuration Manager](https://learn.microsoft.com/en-us/mem/configmgr/sum/deploy-use/deploy-software-updates) 💡 [Use Intune to remediate vulnerabilities identified by Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/mem/intune/protect/atp-manage-vulnerabilities) 💡 [Remediate vulnerabilities (Defender for Endpoint)](https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-remediation?view=o365-worldwide) 💡 [Choose how to deliver updates for the Microsoft 365 Apps](https://learn.microsoft.com/en-us/deployoffice/fieldnotes/choose-how-to-deliver-updates) 💡 [Windows Release Health](https://learn.microsoft.com/en-us/windows/release-health/) 💡 [Manage updates and patches for your VMs](https://learn.microsoft.com/en-us/azure/automation/update-management/manage-updates-for-vm) 💡 [Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) |\r\n| | 2.6 Unified Endpoint Management (UEM) & Mobile Device Management (MDM) | Microsoft Intune Azure Arc-enabled Servers Azure Autiomation | 💡 [What is Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/what-is-intune) 💡 [Manage your devices and control device features in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-devices) 💡 [Zero Trust with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/zero-trust-with-microsoft-intune) 💡 [Supported operating systems and browsers in Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/supported-devices-browsers) 💡 [Enrollment guide: Microsoft Intune enrollment](https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment) 💡 [Manage iOS/iPadOS software update policies in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-ios) 💡 [Manage macOS software update policies in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-macos) 💡 [Microsoft Intune How-To Guides](https://learn.microsoft.com/en-us/mem/intune/#how-to-guides) 💡 [What is Azure Arc-enabled servers?](https://learn.microsoft.com/en-us/azure/azure-arc/servers/overview) 💡 [Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) |\r\n| | 2.7 Endpoint & Extended Detection & Response (EDR & XDR) | Microsoft 365 Defender Microsoft Defender for Endpoint (MDE) Microsoft Defednder for Identity (MDI) Microsoft Defender for Office 365 (MDO) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 💡 [What is Microsoft Defender for Endpoint?](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide) 💡 [Zero Trust with Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/zero-trust-with-microsoft-defender-endpoint?view=o365-worldwide) 💡 [What is Microsoft 365 Defender?](https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender?view=o365-worldwide) 💡 [Zero Trust with Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/zero-trust-with-microsoft-365-defender?view=o365-worldwide) 💡 [Overview of endpoint detection and response (EDR) with Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response?view=o365-worldwide) 💡 [Implement Microsoft Sentinel and Microsoft 365 Defender for Zero Trust](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) 💡 [Manage endpoint detection and response (EDR) policy for endpoint security in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-edr-policy) 💡 [Set up your XDR tools](https://learn.microsoft.com/en-us/security/operations/setup-xdr-tools) 💡 [Architect your Microsoft Sentinel workspace](https://learn.microsoft.com/en-us/security/operations/siem-workspace) 💡 [Ingest data sources and configure incident detection in Sentinel](https://learn.microsoft.com/en-us/security/operations/ingest-data-sources) 💡 [Respond to an incident using Microsoft Sentinel and Microsoft 365 Defender](https://learn.microsoft.com/en-us/security/operations/respond-incident) |\r\n| Application & Workload 3.x | | | |\r\n| | 3.1 Application Inventory | Entra ID Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) Microsoft Intune | 💡 [Cloud Discovery Setup](https://learn.microsoft.com/en-us/defender-cloud-apps/set-up-cloud-discovery) 💡 [Deploy Intune Softare inventory & Security Policies](https://learn.microsoft.com/en-us/answers/questions/67892/can-we-use-intune-to-inventory-software-on-devices) 💡 [Configure Blocking Unwanted or Unapproved Applications](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus?view=o365-worldwide) 💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) 💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) 💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) 💡 [Active Directory Federation Services Health](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-health-adfs) 💡 [Azure Active Directory Application Audit](https://github.com/jsa2/AADAppAudit#azure-ad-application-analytics-solution) 💡 [Azure Active Directory Application Proxy](https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/what-is-application-proxy) 💡 [Using Microsoft Defender for Cloud Asset Inventory](https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory) 💡 [Working with Discovered Apps](https://learn.microsoft.com/en-us/defender-cloud-apps/discovered-apps) 💡 [Software Inventory](https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-software-inventory?view=o365-worldwide) |\r\n| | 3.2 Secure Software Development & Integration | Azure Policy Microsoft Defender for Cloud (MDfC) Microsoft Defender for Endpoint (MDE) | 💡 [DoD CIO DevSecOps with IaC & Microsoft](https://dodcio.defense.gov/Portals/0/Documents/Library/DoDRefDesignCloudGithub.pdf?ver=zXJ_uO5LfouVaysHo5Ejsw%3d%3d) 💡 [Microsoft Secure DevSecOps](https://www.microsoft.com/en-us/securityengineering/sdl/) 💡 [Application Security & DevSecOps Security](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/organize/cloud-security-application-security-devsecops?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=eb8cd3d8eb27486d87bbb4d96d996220) 💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) 💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) 💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) 💡 [Azure AI Content Moderator API Security](https://learn.microsoft.com/en-us/azure/ai-services/content-moderator/overview) |\r\n| | 3.3 Software Risk Management | Microsoft Defender for Cloud Apps (MDA) Mircosoft Defender for Endpoint (MDE) Threat & Vulnerability Management (TVM) Microsoft Intune | 💡 [Manage and Secure Apps In Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-apps) 💡 [App Protection Policies in Intune](https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy) 💡 [Microsoft Container Registry](https://mcr.microsoft.com/) 💡 [GitHub Actaion For Vulnerability Scanning](https://github.com/marketplace/actions/anchore-container-scan) 💡 [Code Scanning with CodeQL](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql) 💡 [Keeping your supply chain secure with Dependabot](https://docs.github.com/en/code-security/dependabot) 💡 [Secure Supply Chain Consumption Framework](https://www.microsoft.com/en-us/securityengineering/opensource/osssscframeworkguide) 💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) 💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) 💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) |\r\n| | 3.4 Resource Authorization & Integration | Entra ID Conditional Access (CA) Entra ID Application Proxy Azure Policy Entra ID Privilleged Identity Management (PIM) Microsoft 365 Defender Microsoft Intune Microsoft Defender for Cloud (MDfC) | 💡 [Deploy Microsoft Defender for Cloud - Enterprise Cloud Application Protection](https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction) 💡 [Configure Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/en-us/download/details.aspx?id=54431) 💡 [Deploying Application & Authorization Azure App Services](https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization) 💡 [How to create and deploy a custome Authorization Manager](https://learn.microsoft.com/en-us/dotnet/framework/wcf/extending/how-to-create-a-custom-authorization-manager-for-a-service) 💡 [Configure with Entra Identity Platform](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow) 💡 [How-to Manage Apps Remove User Access with Entra](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/methods-for-removing-user-access) 💡 [Setup Protecting Apps w. Entra Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps) 💡 [Role Based Access Control Configuration with Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control) |\r\n| | 3.5 Continuous Monitoring and Ongoing Authorizations | Entra ID - Conditional Access (CA) Microsoft Defender for Cloud Apps (MDA) Microsoft Senitnel Playbooks Entra ID - Privileged Identity Management (PIM) | 💡 [How-to-Build a Successful App Security Program](https://www.microsoft.com/en-us/security/blog/2021/03/29/how-to-build-a-successful-application-security-program/) 💡 [Setting up Hybrid Continuous Monitoring with Sentinel](https://learn.microsoft.com/en-us/azure/architecture/hybrid/hybrid-security-monitoring) 💡 [Deploy Adaptive Appliation Conrols Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls) 💡 [Configure Azure Security Management & Monitoring](https://learn.microsoft.com/en-us/azure/security/fundamentals/management-monitoring-overview) 💡 [Leverage Security Baselines for M365 Apps Enterprise](https://learn.microsoft.com/en-us/deployoffice/security/security-baseline) 💡 [Utilize Application Control for Windows](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/wdac) |\r\n| Data 4.x | | | |\r\n| | 4.1 Data Catalog Risk Alignment | Purview Data Catalog Purview Data Map Microsoft Sentinel | 💡 [Create a Azrure Data Catalog](https://learn.microsoft.com/en-us/azure/data-catalog/data-catalog-get-started) 💡 [Use the Service Catalog](https://learn.microsoft.com/en-us/system-center/scsm/service-catalog?view=sc-sm-2022) 💡 [Azure Data Catalog FAQ](https://learn.microsoft.com/en-us/azure/data-catalog/data-catalog-frequently-asked-questions) 💡 [Establishing Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) 💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) 💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Set up Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) 💡 [Discover Data & Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) |\r\n| | 4.2 DoD Enterprise Data Governance | Purview Data Governance Purview Data Estate Insights Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 💡 [Implement Microsoft Purview - IRM & Compliance - DoD Deployments](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) 💡 [Implement a Data Governance Maturity Model Framework](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) 💡 [Deploy Azure Data Governance](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) 💡 [Leverage Microsoft Defender for For Cloud Goverance Rules](https://learn.microsoft.com/en-us/azure/defender-for-cloud/governance-rules) 💡 [Implement Purview Data Governance](https://learn.microsoft.com/en-us/purview/?view=o365-worldwide) 💡 [Purview Data Lineage Machine Learning](https://learn.microsoft.com/en-us/samples/microsoft/purview-machine-learning-lineage-solution-accelerator/purview-machine-learning-lineage-solution-accelerator/) 💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Azure Collaboration Governance](https://learn.microsoft.com/en-us/microsoft-365/solutions/collaboration-governance-overview?view=o365-worldwide) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) 💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/en-us/azure/azure-sql/database/sql-insights-overview?view=azuresql) 💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) |\r\n| | 4.3 Data Labeling and Tagging | Purview Information Protection | 💡 [Create Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) 💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) 💡 [Deploy with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Utilize Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) 💡 [Use the Service Catalog](https://learn.microsoft.com/en-us/system-center/scsm/service-catalog?view=sc-sm-2022) |\r\n| | 4.4 Data Monitoring and Sensing | Purview Data Loss Protection (DLP) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) Microsoft Sentinel | 💡 [Leverage Data Monitoring & Self Healing](https://learn.microsoft.com/en-us/compliance/assurance/assurance-monitoring-and-self-healing) 💡 [Deploy Microsoft 365 Monitorning](https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-monitoring?view=o365-worldwide) 💡 [Senitnel Data Collection Best Practices](https://learn.microsoft.com/en-us/azure/sentinel/best-practices-data) 💡 [Deploy Microsoft Purview](https://learn.microsoft.com/en-us/purview/purview) 💡 [Utilze Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Configure Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) 💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/en-us/azure/azure-sql/database/sql-insights-overview?view=azuresql) |\r\n| | 4.5 Data Encryption & Rights Management | Purview Data Loss Protection (DLP) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) | 💡 [Utilize Azure Encrption](https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview) 💡 [Deploy Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Deploy Purview Information Protection](https://learn.microsoft.com/en-us/purview/information-protection) 💡 [Configure Dynamic Key & Encrption Delivery](https://learn.microsoft.com/en-us/azure/media-services/latest/drm-content-protection-concept) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) |\r\n| | 4.6 Data Loss Prevention (DLP) | Purview Data Loss Protection (DLP) Purview Information Protection | 💡 [Implement Data Loss & Prevention (DLP)](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp) 💡 [Informaiton Protection & Data Loss and Prevention- GITHUB LAB](https://microsoft.github.io/ComplianceCxE/dag/mip-dlp/) 💡 [Deploy Adaptive Protection- Data Loss & Protections](https://learn.microsoft.com/en-us/purview/dlp-adaptive-protection-learn) 💡 [Apply Rules for DLP Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/data-loss-prevention/dlp-rule-application) 💡 [Utilize Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) |\r\n| | 4.7 Data Access Control | Microsoft Defender for Cloud Apps (MDA) Entra ID Conditional Access (CA) Purview Insider Risk Management Purview Information Protection Purview Data Loss Prevention (DLP) Microsoft Intune | 💡 [Configure Conditional Access in Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview) 💡 [Use Conditional Access Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) 💡 [Use Conditional Access APIs](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-apis) 💡 [Deploy Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access#deploy-conditional-access-policies) 💡 [Use Conditional Access With Data Explorer](https://learn.microsoft.com/en-us/azure/data-explorer/security-conditional-access) 💡 [Deploy Common Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common?tabs=secure-foundation) 💡 [Build Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policies) |\r\n| Network & Environment 5.x | | | |\r\n| | 5.1 Data Flow Mapping | Azure Monitor Net Insights Network Watcher Microsoft Defender for Endpoint (MDE) | 💡 [Use Data Flow Mapping Power Platform](https://learn.microsoft.com/en-us/power-query/dataflows/create-use) 💡 [User Azure Network Traffic Analytics](https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics) 💡 [Azure Blue Print ](https://learn.microsoft.com/en-us/azure/governance/blueprints/overview) 💡 [Leverage Azure Data Visualization with Data Explorer](https://learn.microsoft.com/en-us/azure/data-explorer/viz-overview) 💡 [Use Power Automate for Event Tagging](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-microsoft-flow?view=o365-worldwide) 💡 [Secure & Govern Workloads with Network-level Segmentation](https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/network-level-segmentation) 💡 [Deploy Software Defined Netoworking](https://learn.microsoft.com/en-us/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) 💡 [Manage Software Defined Netoworking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/manage-sdn) 💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) |\r\n| | 5.2 Software Defined Networking (SDN) | Secure Access Service Edge (SASE) Microsoft Network Secuirty Groups (NSG) Entra ID App Proxy | 💡 [Use Secure Access Service Edge SASE - Software Defined Networking Zero Trust](https://www.microsoft.com/en-us/security/business/security-101/what-is-sase) 💡 [Software Defined Network Monitoring using Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/software-defined-monitoring-using-automated-notebooks-and-azure/ba-p/2587775) 💡 [Plan Software Defined Netoworking](https://learn.microsoft.com/en-us/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) 💡 [Implementing Software Defined Networking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/) 💡 [Manage Software Detined Netoworking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/manage-sdn) 💡 [Deploy Software Defined Networking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/deploy/deploy-a-software-defined-network-infrastructure-using-scripts) 💡 [Secure the Network Controller](https://learn.microsoft.com/en-us/azure-stack/hci/manage/nc-security) 💡 [SDN for Win Server 2019 and 2022](https://learn.microsoft.com/en-us/windows-server/networking/sdn/sdn-whats-new) 💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) 💡 [IPV6 Config Interface](https://learn.microsoft.com/en-us/javascript/api/%40azure/arm-databoxedge-profile-2020-09-01-hybrid/ipv6config?view=azure-node-latest&wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Leverage IPV6 for Azure Virtual Networks](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Segementation Security Strategies](https://learn.microsoft.com/en-us/azure/well-architected/security/design-segmentation) 💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) 💡 [Utilize Microsoft Packet Monitor](https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon) |\r\n| | 5.3 Macro Segmentation | Azure Subscription Azure VNet(s) Azure VNet Manager Network Security Groups (NSG) Azure Firewall | 💡 [Impletment Network Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) 💡 [Azure Features for Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation#azure-features-for-segmentation) 💡 [Segementation Security Strategies](https://learn.microsoft.com/en-us/azure/well-architected/security/design-segmentation) 💡 [Network Service Designs](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.HybridNetwork%2Fpublishers%2Fnetworkservicedesigngroups) 💡 [Network Watcher](https://portal.azure.com/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) |\r\n| | 5.4 Micro Segmentation | Azure Security Groups (ASG) Entra ID App Proxy Microsoft Tunnel | 💡 [Enabling JIT Access Controls](https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Conditional Access Block Access by Location](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-location?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Secure Networks with Zero Trust](https://learn.microsoft.com/en-us/security/zero-trust/deploy/networks) 💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation?wtmc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Microsoft Packet Monitor](https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon) |\r\n| Automation & Orchestration 6.x | | | |\r\n| | 6.1 Policy Decision Point (PDP) & Policy Orchestration | Entra ID Conditional Access (CA) Azure Policy Azure Automation Azure ML Azure Firewall Microsoft Sentinel | 💡 [Visibility,Automation and Orchestration with Zero Trust](https://learn.microsoft.com/en-us/) 💡 [Azure Orchestration for Azure Security Policy](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/azure-policy-security-baseline) 💡 [Configuration Analyzer for Security Policies](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies?view=o365-worldwide) 💡 [Azure Automation Overview](https://learn.microsoft.com/en-us/azure/automation/overview) 💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/automation-security-baseline) 💡 [Azure Policy](https://learn.microsoft.com/en-us/azure/governance/policy/overview) 💡 [What is Azure Firewall?](https://learn.microsoft.com/en-us/azure/firewall/overview) 💡 [Apply Zero Trust principles to a hub virtual network in Azure](https://learn.microsoft.com/en-us/security/zero-trust/azure-infrastructure-networking) 💡 [Management of Role Permissions and Automation](https://learn.microsoft.com/en-us/azure/automation/automation-role-based-access-control) 💡 [Using Azure Machine Learning to assign roles](https://learn.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler) 💡 [Azure AD Seccurity Groups ML](https://learn.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler#use-azure-ad-security-groups-to-manage-workspace-access) |\r\n| | 6.2 Critical Process Automation | Microsoft Power Automate Azure Logic Apps Microsoft Sentinel Playbooks Microsoft 365 Defender Automated Investigation & Response | 💡 [Azure Automation Overview](https://learn.microsoft.com/en-us/azure/automation/overview) 💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/automation-security-baseline) 💡 [Visibility, Automation, and Orchestration with Zero Trust](https://learn.microsoft.com/en-us/) 💡 [Automation in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automation) 💡 [Automate Threat Response with Playbooks](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) 💡 [Automated Investigation & Response M365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) 💡 [Power Automate U.S Government](https://learn.microsoft.com/en-us/power-automate/us-govt) |\r\n| | 6.3 Machine Learning | Microsoft Sentinel Fusion ML Microsoft Sentinel Bring Your Own Machine Learning (BYOML) Microsoft Defender for Cloud (MDfC) Azure ML | 💡 [Advanced multistage attack detection in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/fusion) 💡 [Bring your own Machine Learning (ML) into Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/bring-your-own-ml) 💡 [Azure Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/?view=azureml-api-2) 💡 [Enterprise Security & Governance w. Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/concept-enterprise-security?view=azureml-api-2) 💡 [Azure Government Isolaiton Guidelines using AI & ML](https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-impact-level-5) 💡 [Quick Start Azure Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/tutorial-azure-ml-in-a-day?view=azureml-api-2) 💡 [Azure security baseline for Azure Machine Learning](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/machine-learning-security-baseline) |\r\n| | 6.4 Artificial Intelligence | Microsoft Sentinel Fusion ML Microsoft Sentinel Tailored AI Azure ML | 💡 [AI Security Services](https://learn.microsoft.com/en-us/azure/ai-services/security-features) 💡 [Senintel Automation](https://learn.microsoft.com/en-us/azure/sentinel/automation) 💡 [AI ID & Access Risk Based Controls](https://azure.microsoft.com/en-us/products/category/identity/) 💡 [Implement Sentinel & M365 Defender for XDR - AI Driven Zero Trust ](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) 💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) |\r\n| | 6.5 Security Orchestration, Automation & Response (SOAR) | Microsoft 365 Defender Automated investigation and response Microsoft Sentinel Playbooks Microsoft Defender for Cloud (MDfC) Azure Logic Apps | 💡 [Security Ochestration, Automation & Response (SOAR) In Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automation) 💡 [Sentinel SOAR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/how-to-use-azure-sentinel-for-incident-response-orchestration/ba-p/2242397) 💡 [Microsoft Sentinel SOAR Content Catalog](https://learn.microsoft.com/en-us/azure/sentinel/sentinel-soar-content) 💡 [Automate Threat Response with Playbooks in Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) 💡 [Automated investigation and response in Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) 💡 [Workflow Automation in Microsoft Defender for Cloud](https://www.bing.com/ck/a?!&&p=9150006d50b58362JmltdHM9MTY5MDg0ODAwMCZpZ3VpZD0yMTRiYTU0My05MDAzLTY2ODAtMjJhMS1iNjFjOTQwMzYwYjYmaW5zaWQ9NTI5Mw&ptn=3&hsh=3&fclid=214ba543-9003-6680-22a1-b61c940360b6&psq=Microsoft+SOAR+Logic+Apps&u=a1aHR0cHM6Ly9sZWFybi5taWNyb3NvZnQuY29tL2VuLXVzL2F6dXJlL2RlZmVuZGVyLWZvci1jbG91ZC93b3JrZmxvdy1hdXRvbWF0aW9u&ntb=1) 💡 [SOAR Best Practices](https://www.microsoft.com/en-us/security/business/security-101/what-is-soar#SOARbestpractices) 💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) |\r\n| | 6.6 API Standardization | Azure API Management Azure Monitor Log Analytics Azure Logic Apps Azure Policy | 💡 [Microsft API Management & Security](https://azure.microsoft.com/en-us/products/api-management/) 💡 [Mitigate OWASP Top 10 Security Threats Using Microsoft API Management](https://learn.microsoft.com/en-us/azure/api-management/mitigate-owasp-api-threats) 💡 [Security Baselines for API Management](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/api-management-security-baseline) 💡 [Secure and Compliant APIs for a Hybrid and Multi Cloud World](https://azure.microsoft.com/en-us/blog/secure-and-compliant-apis-for-a-hybrid-and-multi-cloud-world/) 💡 [Web API Design Best Practice](https://learn.microsoft.com/en-us/azure/architecture/best-practices/api-design) 💡 [Monitor & Protect Your APIs](https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-use-azure-monitor) |\r\n| | 6.7 Security Operations Center (SOC) & Incident Response (IR) | Microsoft Sentinel Microsoft 365 Defender | 💡 [Security Operations In Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-security-operations) 💡 [Microsoft SOC Best Practices Landing Page](https://www.microsoft.com/en-us/security/business/security-101/what-is-a-security-operations-center-soc?ef_id=_k_ce7dcd6e8f2d1919667ca9a72f733870_k_&OCID=AIDcmmdamuj0pc_SEM__k_ce7dcd6e8f2d1919667ca9a72f733870_k_&msclkid=ce7dcd6e8f2d1919667ca9a72f733870) 💡 [Playbook for Modernizing Security Operations Centers](https://www.microsoft.com/en-us/security/blog/2021/02/11/a-playbook-for-modernizing-security-operations/) 💡 [CISO Series Lessons Learned from Microsoft's SOC](https://www.microsoft.com/en-us/security/blog/2019/10/07/ciso-series-lessons-learned-from-the-microsoft-soc-part-3a-choosing-soc-tools/) 💡 [Integrating Microsoft 365 Defender into your security operations](https://learn.microsoft.com/en-us/microsoft-365/security/defender/integrate-microsoft-365-defender-secops?view=o365-worldwide) |\r\n| Visibility & Analytics 7.x | | | |\r\n| | 7.1 Log All Traffic (Network, Data, Apps, Users) | Azure Monitor Log Analytics Microsoft Sentinel | 💡 [Azure Log Analytics](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-overview) 💡 [Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/overview) 💡 [Audit Logging and Monitoring](https://learn.microsoft.com/en-us/compliance/assurance/assurance-audit-logging) 💡 [Maturity Model for Log Management M2131](https://techcommunity.microsoft.com/t5/public-sector-blog/microsoft-sentinel-maturity-model-for-event-log-management-m-21/ba-p/3074336) 💡 [Device Log Capture - Intune](https://learn.microsoft.com/en-us/mem/intune/remote-actions/collect-diagnostics) 💡 [Application Logging](https://learn.microsoft.com/en-us/sql/relational-databases/performance/view-the-windows-application-log-windows-10?view=sql-server-ver16) 💡 [User Access Logging](https://learn.microsoft.com/en-us/windows-server/administration/user-access-logging/get-started-with-user-access-logging) 💡 [Azure Infrastructure Logs](https://learn.microsoft.com/en-us/azure/well-architected/scalability/monitor-infrastructure) 💡 [Network Logging](https://learn.microsoft.com/en-us/azure/azure-web-pubsub/howto-troubleshoot-network-trace) 💡 [Supported Logs for Network](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/supported-logs/microsoft-network-networkmanagers-logs) |\r\n| | 7.2 Security Information and Event Management (SIEM) | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) Microsoft 365 Defender | 💡 [Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/overview) 💡 [Implement Sentinel & M365](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) 💡 [Unified SIEM & XDR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-unified-microsoft-siem-and-xdr-github-community/ba-p/3249533) 💡 [Stream Alerts Defender for Cloud to SIEM](https://learn.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem#stream-alerts-to-azure-sentinel) 💡 [Azure Sentinel Github Repo](https://github.com/Azure/Azure-Sentinel) 💡 [Sentinel & SOC Analysis Process](https://learn.microsoft.com/en-us/azure/sentinel/migration-security-operations-center-processes) 💡 [Microsoft Sentinel Skill Up Training](https://learn.microsoft.com/en-us/azure/sentinel/skill-up-resources) |\r\n| | 7.3 Common Security and Risk Analytics | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) | 💡 [Microsoft Security Response Center Security Updates Guide](https://msrc.microsoft.com/update-guide) 💡 [Explore Risks to Sensitive Data Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/data-security-review-risks) 💡 [Identify & Analyze Risks Across Your Environment](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-attack-path) 💡 [Cloud Security Posture Management](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management) 💡 [Microsoft Cloud Security Benchmark](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-regulatory-compliance) |\r\n| | 7.4 User and Entity Behavior Analytics | Microsoft Sentinel UEBA Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Identity (MDI) Entra ID Conditional Access (CA) Purview Insider Risk Management | 💡 [ID Threats with User and Entity Behavior Analytics](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [Enable Entity Behavior Analytics to Detect Threats](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics) 💡 [Microsoft Sentinel UEBA Reference](https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference) 💡 [Investigate Incidents with UEBA](https://learn.microsoft.com/en-us/azure/sentinel/investigate-with-ueba) 💡 [Discover and Protect Sensitive Information in your Organization](https://learn.microsoft.com/en-us/defender-cloud-apps/tutorial-dlp) 💡 [Purview Insider Risk Management](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) |\r\n| | 7.5 Threat Intelligence Integration | Microsoft Sentinel Threat Intelligence (TI) Microsoft Graph Security Indicators Microsoft Defender Threat Intelligence (MDTI) | 💡 [Microsoft Threat Intelligence](https://learn.microsoft.com/en-us/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti) 💡 [Microsoft Security Graph API](https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview?view=graph-rest-beta) 💡 [Create Threat Intelligence Indicators](https://learn.microsoft.com/en-us/graph/api/tiindicators-post?view=graph-rest-beta&tabs=http) 💡 [Threat intelligence integration in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/threat-intelligence-integration) 💡 [Bring Your Own Threat Intelligence Feeds](https://learn.microsoft.com/en-us/defender-cloud-apps/additional-integrations) 💡 [Accessing the Threat Intelligence Portal](https://learn.microsoft.com/en-us/defender/threat-intelligence/learn-how-to-access-microsoft-defender-threat-intelligence-and-make-customizations-in-your-portal) |\r\n| | 7.6 Automated Dynamic Policies | Entra ID Protection Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel Fusion ML Microsoft Sentinel Bring Your Own Machine Learning (BYOML) Microsoft Sentinel Playbooks Microsoft Intune Azure Automation Purview Insider Risk Management | 💡 [Automate Threat Response with Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) 💡 [Adaptive Protection - Microsoft Purview](https://www.microsoft.com/en-us/security/blog/2023/02/06/introducing-adaptive-protection-in-microsoft-purview-people-centric-data-protection-for-a-multiplatform-world/#:~:text=With%20Adaptive%20Protection%2C%20DLP%20policies%20become%20dynamic%2C%20ensuring,efficient%20and%20empowered%20to%20do%20more%20with%20less.) 💡 [Adaptive Policy Scopes M365](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/using-adaptive-policy-scopes-to-apply-m365-retention-to-shared/ba-p/3053641#:~:text=Back%20in%20October,in%20Microsoft%20365.) 💡 [Adaptive Application Controls](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls) 💡 [AI-Driven Adaptive Device Controls Microsoft Defender for Endpoint](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/ai-driven-adaptive-protection-in-microsoft-defender-for-endpoint/ba-p/2966491) 💡 [AI-Driven Adaptive Protection Against Human Operated Ransomeware](https://www.microsoft.com/en-us/security/blog/2021/11/15/ai-driven-adaptive-protection-against-human-operated-ransomware/) 💡 [Microsoft Defender for Cloud Automated Security Posture Management](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management) 💡 [Improve your network security posture with adaptive network hardening](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-network-hardening) 💡 [What is Microsoft Entra ID Protection?](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection) 💡 [Azure Automation update management](https://learn.microsoft.com/en-us/azure/architecture/hybrid/azure-update-mgmt) 💡 [Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure) |"
+ "json": "| DoD Zero Trust Pillar | DoD Zero Trust Capability | Recommended Microsoft Solution(s) | Recommended DoD Portal(s) | Recommended Resources |\r\n|--------------------------------|------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\r\n| User 1.x | | | | |\r\n| | 1.1 User Inventory | Entra ID Microsoft Sentinel UEBA Microsoft Defender for Cloud (MDfC) | 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Microsoft Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Microsoft Identity Platform Entra (formerly AAD)](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-overview) 💡 [Microsoft Hybrid Identity with Entra/AAD/AD](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/) 💡 [Using the Inventory in Secure Score - Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory) 💡 [Identity Decision Guide](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/decision-guides/identity/) 💡 [Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/en-us/download/details.aspx?id=54431) 💡 [Identity Security Monitoring](https://github.com/Cloud-Architekt/AzureAD-Attack-Defense/blob/main/IdentitySecurityMonitoring.md#identity-security-monitoring-in-a-hybrid-environment) 💡 [Collect Azure Active Directory (Azure AD) Logs](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics#send-logs-to-azure-monitor) 💡 [Enable User Entity Behavorial Analytics](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics#how-to-enable-user-and-entity-behavior-analytics) 💡 [Deploy Microsoft Defender for Identity](https://learn.microsoft.com/en-us/defender-for-identity/deploy-defender-identity) 💡 [Secure with Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/secure-with-azure-ad-introduction) 💡 [AAD Hybrid Identity](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/plan-hybrid-identity-design-considerations-overview?WT.mc_id=DT-MVP-5001664) 💡 [Azure AD Reports](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/overview-reports?WT.mc_id=DT-MVP-5001664) 💡 [B2B Collaboration](https://learn.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b?WT.mc_id=DT-MVP-5001664) |\r\n| | 1.2 Conditional User Access | Entra ID Conditional Access (CA) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel Microsoft 365 Defender Microsoft Intune | 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) 🔀 [Conditional Access Policy Templates](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Microsoft Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [What is Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview) 💡 [Conditional Access Learning Path](https://learn.microsoft.com/en-us/training/modules/plan-implement-administer-conditional-access/) 💡 [Conditional Access Licensing- Need at least AADP1](https://www.microsoft.com/en-us/security/business/identity-access/azure-active-directory-pricing?rtc=1) 💡 [Conditional Access Design Principles](https://learn.microsoft.com/en-us/azure/architecture/guide/security/conditional-access-design) 💡 [Templates -Secure Foundation & Work Toward ZT](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common) 💡 [Conditional Access Trends and Changes](https://github.com/Cyberlorians/Workbooks/blob/main/ConditionalAccessTrendsandChanges.json) 💡 [Implement Authentication Strengths](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/authentication-strength-choose-the-right-auth-method-for-your/ba-p/2365674) 💡 [Intune Conditional Access](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) 💡 [Using Locations in Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition) |\r\n| | 1.3 Multi-Factor Authentication (MFA) | Entra ID Entra ID - Certificate Based Authorization (CBA) | 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Entra ID - AuthN Methods Activity](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthMethodsActivity/menuId/AuthMethodsActivity) 🔀 [Entra ID - AuthN Methods Policies](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods) 🔀 [Entra ID - AuthN Strengths](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthStrengths) 🔀 [Defender for Cloud Recommendations](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_Security/SecurityMenuBlade/~/5) | 💡 [How MFA Works](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks) 💡 [Setup Multifactor Authenication for Users M365](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) 💡 [Configure the MFA Azure Active Directrory Registration Policies](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) 💡 [Deploy Passwordless Solution](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-deployment) 💡 [Configure Azure AD CBA](https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-certificate-based-authentication) 💡 [Conditional Access Policy - MFA](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy?WT.mc_id=DT-MVP-5001664) 💡 [Plan AAD MFA](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted?WT.mc_id=DT-MVP-5001664) |\r\n| | 1.4 Privileged Access Management (PAM) | Entra ID Entra ID - Privileged Identity Management (PIM) | 🔀 [Entra ID DiagnosticSettings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Entra ID - PIM](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_PIMCommon/CommonMenuBlade/~/quickStart) 🔀 [AAD PIM - Audit History](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_PIMCommon/MyAuditsMenuBlade/~/aadmigratedroles) | 💡 [Plan a Privileged Identity Management Deployment](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-deployment-plan) 💡 [Privileged Identity Management - Why use it with Defender for O365?](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/use-privileged-identity-management-in-defender-for-office-365?view=o365-worldwide) 💡 [Implementing PIM - Micrsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started) 💡 [Secure Roadmap - PIM](https://learn.microsoft.com/en-us/azure/active-directory/roles/security-planning#use-azure-ad-privileged-identity-management) 💡 [PIM for Groups](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/concept-pim-for-groups) 💡 [PIM Compliancy with Sentinel](https://learnsentinel.blog/2021/07/26/enforce-pim-compliance-with-azure-sentinel-and-playbooks/) 💡 [Configure Approve or Deny Request for AD Roles in PIM](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-approval-workflow) 💡 [Azure Security Benchmark Defender for Identity](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/defender-for-identity-security-baseline) |\r\n| | 1.5 Identity Federation & User Credentialing | Entra ID - Certificate-Based Authorization (CBA) Entra ID - Guest Access | 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Entra ID - AAD Connect](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/GetStarted) 🔀 [Entra ID - Enterprise Apps](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null) 🔀 [Entra ID - Identity Governance](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_ERM/DashboardBlade/~/GettingStarted) | 💡 [Azure Governement - Planning Identity for Azure Government Apps](https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-plan-identity) 💡 [Federated Identity Credentials](https://learn.microsoft.com/en-us/graph/api/resources/federatedidentitycredentials-overview?view=graph-rest-1.0) 💡 [What is Hybrid Identity](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-hybrid-identity) 💡 [Azure AD Certificate Based Authentication](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-certificate-based-authentication) 💡 [Azure AD SCIM](https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups) 💡 [Provisioning with Google Cloud](https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on) 💡 [Provisioning with Amazon Cloud](https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/aws-single-sign-on-provisioning-tutorial) 💡 [Azure AD Application Roles](https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps) 💡 [What is Identity Governace?](https://learn.microsoft.com/en-us/azure/active-directory/governance/identity-governance-overview) |\r\n| | 1.6 Behavioral, Contextual ID, and Biometrics | Microsoft Sentinel UEBA Entra ID - Identity Protection | 🔀 [Azure Face APIs](https://portal.azure.us/#view/Microsoft_Azure_ProjectOxford/CognitiveServicesHub/~/Face) 🔀 [Sentinel - UEBA](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Verified ID](https://portal.azure.us/#view/Microsoft_AAD_DecentralizedIdentity/InitialMenuBlade/~/setupBlade) | 💡 [User Entity Behavorial Analytics - What is it?](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [Windows Hello Biometrics](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise) 💡 [Identify Advanced Threats with UEBA](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [UEBA Reference](https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference?WT.mc_id=AZ-MVP-5004810#ueba-enrichments) 💡 [UEBA Sentinel Content Hub](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/ueba-essentials-solution-now-available-in-content-hub/ba-p/3651074) 💡 [Guided UEBA Investigation Scenarios](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/guided-ueba-investigation-scenarios-to-empower-your-soc/ba-p/1857100) 💡 [Combatting Risky Sign-ins in Azure Active Directory](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/combatting-risky-sign-ins-in-azure-active-directory/ba-p/3724786) 💡 [Securing Workload Identities](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-workload-identity-risk) 💡 [Reprise99 UEBA](https://github.com/reprise99/Sentinel-Queries/tree/main/UEBA) |\r\n| | 1.7 Least Privileged Access | Entra ID - Permissions Azure Policy Entra ID - Privileged Identity Management (PIM) | 🔀 [Entra ID - Enterprise Apps](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null) 🔀 [Entra ID - Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) 🔀 [Entra ID - Identity Protection](https://portal.azure.us/#view/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/~/Overview) 🔀 [Microsoft Defender for Cloud Apps](https://security.microsoft.us/cloudapps/) 🔀 [Application Security Groupss](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FapplicationSecurityGroups) | 💡 [Implementing Least-Privileged Administrative Models](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models) 💡 [Enhance Application Security with Lease Privilege Access Controls](https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-least-privileged-access) 💡 [Identity Protection](https://techcommunity.microsoft.com/t5/itops-talk-blog/what-s-the-difference-between-azure-active-directory-identity/ba-p/1320887?WT.mc_id=itopstalk-newsletter-abartolo) 💡 [Continuous Access Evaluation Monitoring](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-continuous-access-evaluation-troubleshoot#continuous-access-evaluation-sign-in-reporting) |\r\n| | 1.8 Continuous Authentication | Entra ID - Continuous Access Evaluation (CAE) Entra ID - Privileged Identity Management (PIM) Entra ID - Identity Protection | 🔀 [Entra ID - Device Inventory](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Entra ID - Connect Sync (Hybrid Join)](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/ConnectSync) 🔀 [Entra ID - Enterprise Apps](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null) 🔀 [Entra ID - Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) 🔀 [Entra ID - Identity Governance](https://portal.azure.us/#view/Microsoft_AAD_ERM/DashboardBlade/~/GettingStarted) 🔀 [Entra ID - PIM Insights](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/aaddiscovery/resourceId//resourceType/tenant/provider/aadroles) | 💡 [Implement Continuous Access Evaluation Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation) 💡 [Implementing Primary Refresh Token](https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token) 💡 [Privileged Identity Management Insights](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-security-wizard#discovery-and-insights-preview) 💡 [Entra Permissions Managment](https://learn.microsoft.com/en-us/azure/active-directory/cloud-infrastructure-entitlement-management/permissions-management-trial-user-guide) 💡 [Session Management with Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime) |\r\n| | 1.9 Integrated ICAM Platform | Entra Entitlement Management Entra ID Certificate Based Authentication (CBA) | 🔀 [Entra ID - AuthN Methods](https://portal.azure.us/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods) 🔀 [Entra ID - AuthN Strengths](https://portal.azure.us/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthStrengths) 🔀 [Entra ID - AuthN Insights](https://portal.azure.us/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthMethodsActivity) 🔀 [Entra ID - Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) | 💡 [Microsoft Integrated Identity Platform Entra](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-overview) 💡 [Implement Passwordless Auth with Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/auth-passwordless) 💡 [Configure Passwordless Key with Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-security-key) 💡 [Entra Certificate Based Authorization](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-certificate-based-authentication) |\r\n| Device 2.x | | | | |\r\n| | 2.1 Device Inventory | Microsft Entra ID Microsft Entra ID Conditional Access (CA) Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Defender for Identity (MDI) Microsoft Intune | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_DeviceSettings/DevicesMenu/~/overview) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡[M365 Defender Device inventory](https://learn.microsoft.com/en-us/graph/api/resources/intune-graph-overview?view=graph-rest-1.0%22%20%EF%BF%BDHYPERLINK%20%22https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machines-view-overview?view=o365-worldwide) 💡[What is a device identity (Azure Active Directory)?](https://learn.microsoft.com/en-us/azure/active-directory/devices/overview) 💡[Manage device identities by using the Azure portal](https://learn.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal) 💡[Manage your devices and control features with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-devices) 💡[Hybrid Azure AD joined devices](https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-join-hybrid) 💡[Conditional Access policy: Device Compliancy](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡[ZT Guide: Endpoint Zero Trust Deployment Objectives](https://learn.microsoft.com/en-us/security/zero-trust/deploy/endpoints#endpoint-zero-trust-deployment-objectives) 💡[Intune Reporting](https://learn.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor) ** not yet availble in DoD cloud 💡[Provide Additional Intune Reporting](https://www.linkedin.com/pulse/provide-additional-intune-reporting-data-wmi-iren%C3%A4us-becker/) 💡[Working with Intune in Microsoft Graph](https://learn.microsoft.com/en-us/graph/api/resources/intune-graph-overview?view=graph-rest-1.0) |\r\n| | 2.2 Device Detection and Compliance | Entra ID Conditional Access (CA) Microsoft Defender for Endpoint (MDE) Microsoft Intune | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) | 💡[Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) 💡[Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) 💡[Configure Conditional Access in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) 💡[Scenarios for using Conditional Access with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access-intune-common-ways-use?source=recommendations) |\r\n| | 2.3 Device Authorization w/ Real Time Inspection | Microsft Entra ID Microsoft Intune Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡[Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) 💡[Device discovery overview](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-discovery?view=o365-worldwide) 💡[Learn about Conditional Access and Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) 💡[Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) 💡[Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance) 💡[Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡[Conditional Access insights and reporting workbook - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-insights-reporting) 💡[Plan an Azure Active Directory Conditional Access deployment - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access) 💡[Azure Samples for Conditional Access (PowerShell) - GitHub](https://github.com/Azure-Samples/azure-ad-conditional-access-apis/tree/main/01-configure/powershell)
\r\n## Microsoft Portals Government\r\n🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) \r\n🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) \r\n🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) \r\n🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) \r\n🔀 [M365 Defender Portal](https://security.microsoft.us/)\r\n"
},
"customWidth": "33",
"name": "LT-1 - Copy"
@@ -19404,7 +19404,7 @@
{
"type": 1,
"content": {
- "json": "| DoD Zero Trust Pillar | DoD Zero Trust Capability | Recommended Microsoft Solution(s) | Recommended DoD Portal(s) | Recommended Resources |\r\n|--------------------------------|------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\r\n| User 1.x | | | | |\r\n| | 1.1 User Inventory | Entra ID Microsoft Sentinel UEBA Microsoft Defender for Cloud (MDfC) | 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Microsoft Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Microsoft Identity Platform Entra (formerly AAD)](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-overview) 💡 [Microsoft Hybrid Identity with Entra/AAD/AD](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/) 💡 [Using the Inventory in Secure Score - Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory) 💡 [Identity Decision Guide](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/decision-guides/identity/) 💡 [Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/en-us/download/details.aspx?id=54431) 💡 [Identity Security Monitoring](https://github.com/Cloud-Architekt/AzureAD-Attack-Defense/blob/main/IdentitySecurityMonitoring.md#identity-security-monitoring-in-a-hybrid-environment) 💡 [Collect Azure Active Directory (Azure AD) Logs](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics#send-logs-to-azure-monitor) 💡 [Enable User Entity Behavorial Analytics](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics#how-to-enable-user-and-entity-behavior-analytics) 💡 [Deploy Microsoft Defender for Identity](https://learn.microsoft.com/en-us/defender-for-identity/deploy-defender-identity) 💡 [Secure with Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/secure-with-azure-ad-introduction) 💡 [AAD Hybrid Identity](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/plan-hybrid-identity-design-considerations-overview?WT.mc_id=DT-MVP-5001664) 💡 [Azure AD Reports](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/overview-reports?WT.mc_id=DT-MVP-5001664) 💡 [B2B Collaboration](https://learn.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b?WT.mc_id=DT-MVP-5001664) |\r\n| | 1.2 Conditional User Access | Entra ID Conditional Access (CA) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel Microsoft 365 Defender Microsoft Intune | 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) 🔀 [Conditional Access Policy Templates](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Microsoft Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [What is Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview) 💡 [Conditional Access Learning Path](https://learn.microsoft.com/en-us/training/modules/plan-implement-administer-conditional-access/) 💡 [Conditional Access Licensing- Need at least AADP1](https://www.microsoft.com/en-us/security/business/identity-access/azure-active-directory-pricing?rtc=1) 💡 [Conditional Access Design Principles](https://learn.microsoft.com/en-us/azure/architecture/guide/security/conditional-access-design) 💡 [Templates -Secure Foundation & Work Toward ZT](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common) 💡 [Conditional Access Trends and Changes](https://github.com/Cyberlorians/Workbooks/blob/main/ConditionalAccessTrendsandChanges.json) 💡 [Implement Authentication Strengths](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/authentication-strength-choose-the-right-auth-method-for-your/ba-p/2365674) 💡 [Intune Conditional Access](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) 💡 [Using Locations in Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition) |\r\n| | 1.3 Multi-Factor Authentication (MFA) | Entra ID Entra ID - Certificate Based Authorization (CBA) | 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Entra ID - AuthN Methods Activity](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthMethodsActivity/menuId/AuthMethodsActivity) 🔀 [Entra ID - AuthN Methods Policies](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods) 🔀 [Entra ID - AuthN Strengths](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthStrengths) 🔀 [Defender for Cloud Recommendations](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_Security/SecurityMenuBlade/~/5) | 💡 [How MFA Works](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks) 💡 [Setup Multifactor Authenication for Users M365](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) 💡 [Configure the MFA Azure Active Directrory Registration Policies](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) 💡 [Deploy Passwordless Solution](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-deployment) 💡 [Configure Azure AD CBA](https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-certificate-based-authentication) 💡 [Conditional Access Policy - MFA](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy?WT.mc_id=DT-MVP-5001664) 💡 [Plan AAD MFA](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted?WT.mc_id=DT-MVP-5001664) |\r\n| | 1.4 Privileged Access Management (PAM) | Entra ID Entra ID - Privileged Identity Management (PIM) | 🔀 [Entra ID DiagnosticSettings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Entra ID - PIM](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_PIMCommon/CommonMenuBlade/~/quickStart) 🔀 [AAD PIM - Audit History](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_PIMCommon/MyAuditsMenuBlade/~/aadmigratedroles) | 💡 [Plan a Privileged Identity Management Deployment](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-deployment-plan) 💡 [Privileged Identity Management - Why use it with Defender for O365?](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/use-privileged-identity-management-in-defender-for-office-365?view=o365-worldwide) 💡 [Implementing PIM - Micrsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started) 💡 [Secure Roadmap - PIM](https://learn.microsoft.com/en-us/azure/active-directory/roles/security-planning#use-azure-ad-privileged-identity-management) 💡 [PIM for Groups](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/concept-pim-for-groups) 💡 [PIM Compliancy with Sentinel](https://learnsentinel.blog/2021/07/26/enforce-pim-compliance-with-azure-sentinel-and-playbooks/) 💡 [Configure Approve or Deny Request for AD Roles in PIM](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-approval-workflow) 💡 [Azure Security Benchmark Defender for Identity](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/defender-for-identity-security-baseline) |\r\n| | 1.5 Identity Federation & User Credentialing | Entra ID - Certificate-Based Authorization (CBA) Entra ID - Guest Access | 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Entra ID - AAD Connect](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/GetStarted) 🔀 [Entra ID - Enterprise Apps](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null) 🔀 [Entra ID - Identity Governance](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_ERM/DashboardBlade/~/GettingStarted) | 💡 [Azure Governement - Planning Identity for Azure Government Apps](https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-plan-identity) 💡 [Federated Identity Credentials](https://learn.microsoft.com/en-us/graph/api/resources/federatedidentitycredentials-overview?view=graph-rest-1.0) 💡 [What is Hybrid Identity](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-hybrid-identity) 💡 [Azure AD Certificate Based Authentication](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-certificate-based-authentication) 💡 [Azure AD SCIM](https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups) 💡 [Provisioning with Google Cloud](https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on) 💡 [Provisioning with Amazon Cloud](https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/aws-single-sign-on-provisioning-tutorial) 💡 [Azure AD Application Roles](https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps) 💡 [What is Identity Governace?](https://learn.microsoft.com/en-us/azure/active-directory/governance/identity-governance-overview) |\r\n| | 1.6 Behavioral, Contextual ID, and Biometrics | Microsoft Sentinel UEBA Entra ID - Identity Protection | 🔀 [Azure Face APIs](https://portal.azure.us/#view/Microsoft_Azure_ProjectOxford/CognitiveServicesHub/~/Face) 🔀 [Sentinel - UEBA](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Verified ID](https://portal.azure.us/#view/Microsoft_AAD_DecentralizedIdentity/InitialMenuBlade/~/setupBlade) | 💡 [User Entity Behavorial Analytics - What is it?](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [Windows Hello Biometrics](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise) 💡 [Identify Advanced Threats with UEBA](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [UEBA Reference](https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference?WT.mc_id=AZ-MVP-5004810#ueba-enrichments) 💡 [UEBA Sentinel Content Hub](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/ueba-essentials-solution-now-available-in-content-hub/ba-p/3651074) 💡 [Guided UEBA Investigation Scenarios](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/guided-ueba-investigation-scenarios-to-empower-your-soc/ba-p/1857100) 💡 [Combatting Risky Sign-ins in Azure Active Directory](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/combatting-risky-sign-ins-in-azure-active-directory/ba-p/3724786) 💡 [Securing Workload Identities](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-workload-identity-risk) 💡 [Reprise99 UEBA](https://github.com/reprise99/Sentinel-Queries/tree/main/UEBA) |\r\n| | 1.7 Least Privileged Access | Entra ID - Permissions Azure Policy Entra ID - Privileged Identity Management (PIM) | 🔀 [Entra ID - Enterprise Apps](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null) 🔀 [Entra ID - Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) 🔀 [Entra ID - Identity Protection](https://portal.azure.us/#view/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/~/Overview) 🔀 [Microsoft Defender for Cloud Apps](https://security.microsoft.us/cloudapps/) 🔀 [Application Security Groupss](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FapplicationSecurityGroups) | 💡 [Implementing Least-Privileged Administrative Models](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models) 💡 [Enhance Application Security with Lease Privilege Access Controls](https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-least-privileged-access) 💡 [Identity Protection](https://techcommunity.microsoft.com/t5/itops-talk-blog/what-s-the-difference-between-azure-active-directory-identity/ba-p/1320887?WT.mc_id=itopstalk-newsletter-abartolo) 💡 [Continuous Access Evaluation Monitoring](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-continuous-access-evaluation-troubleshoot#continuous-access-evaluation-sign-in-reporting) |\r\n| | 1.8 Continuous Authentication | Entra ID - Continuous Access Evaluation (CAE) Entra ID - Privileged Identity Management (PIM) Entra ID - Identity Protection | 🔀 [Entra ID - Device Inventory](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Entra ID - Connect Sync (Hybrid Join)](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/ConnectSync) 🔀 [Entra ID - Enterprise Apps](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null) 🔀 [Entra ID - Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) 🔀 [Entra ID - Identity Governance](https://portal.azure.us/#view/Microsoft_AAD_ERM/DashboardBlade/~/GettingStarted) 🔀 [Entra ID - PIM Insights](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/aaddiscovery/resourceId//resourceType/tenant/provider/aadroles) | 💡 [Implement Continuous Access Evaluation Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation) 💡 [Implementing Primary Refresh Token](https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token) 💡 [Privileged Identity Management Insights](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-security-wizard#discovery-and-insights-preview) 💡 [Entra Permissions Managment](https://learn.microsoft.com/en-us/azure/active-directory/cloud-infrastructure-entitlement-management/permissions-management-trial-user-guide) 💡 [Session Management with Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime) |\r\n| | 1.9 Integrated ICAM Platform | Entra Entitlement Management Entra ID Certificate Based Authentication (CBA) | 🔀 [Entra ID - AuthN Methods](https://portal.azure.us/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods) 🔀 [Entra ID - AuthN Strengths](https://portal.azure.us/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthStrengths) 🔀 [Entra ID - AuthN Insights](https://portal.azure.us/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthMethodsActivity) 🔀 [Entra ID - Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) | 💡 [Microsoft Integrated Identity Platform Entra](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-overview) 💡 [Implement Passwordless Auth with Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/auth-passwordless) 💡 [Configure Passwordless Key with Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-security-key) 💡 [Entra Certificate Based Authorization](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-certificate-based-authentication) |\r\n| Device 2.x | | | | |\r\n| | 2.1 Device Inventory | Microsft Entra ID Microsft Entra ID Conditional Access (CA) Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Defender for Identity (MDI) Microsoft Intune | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_DeviceSettings/DevicesMenu/~/overview) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡[M365 Defender Device inventory](https://learn.microsoft.com/en-us/graph/api/resources/intune-graph-overview?view=graph-rest-1.0%22%20%EF%BF%BDHYPERLINK%20%22https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machines-view-overview?view=o365-worldwide) 💡[What is a device identity (Azure Active Directory)?](https://learn.microsoft.com/en-us/azure/active-directory/devices/overview) 💡[Manage device identities by using the Azure portal](https://learn.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal) 💡[Manage your devices and control features with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-devices) 💡[Hybrid Azure AD joined devices](https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-join-hybrid) 💡[Conditional Access policy: Device Compliancy](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡[ZT Guide: Endpoint Zero Trust Deployment Objectives](https://learn.microsoft.com/en-us/security/zero-trust/deploy/endpoints#endpoint-zero-trust-deployment-objectives) 💡[Intune Reporting](https://learn.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor) ** not yet availble in DoD cloud 💡[Provide Additional Intune Reporting](https://www.linkedin.com/pulse/provide-additional-intune-reporting-data-wmi-iren%C3%A4us-becker/) 💡[Working with Intune in Microsoft Graph](https://learn.microsoft.com/en-us/graph/api/resources/intune-graph-overview?view=graph-rest-1.0) |\r\n| | 2.2 Device Detection and Compliance | Entra ID Conditional Access (CA) Microsoft Defender for Endpoint (MDE) Microsoft Intune | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) | 💡[Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) 💡[Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) 💡[Configure Conditional Access in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) 💡[Scenarios for using Conditional Access with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access-intune-common-ways-use?source=recommendations) |\r\n| | 2.3 Device Authorization w/ Real Time Inspection | Microsft Entra ID Microsoft Intune Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡[Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) 💡[Device discovery overview](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-discovery?view=o365-worldwide) 💡[Learn about Conditional Access and Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) 💡[Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) 💡[Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance) 💡[Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡[Conditional Access insights and reporting workbook - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-insights-reporting) 💡[Plan an Azure Active Directory Conditional Access deployment - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access) 💡[Azure Samples for Conditional Access (PowerShell) - GitHub](https://github.com/Azure-Samples/azure-ad-conditional-access-apis/tree/main/01-configure/powershell)
Additional References: 💡[Track changes to system files and registry keys](https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview) 💡[Connect Microsoft Defender for Cloud alerts to Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-defender-for-cloud) 💡[Deploying and Managing Microsoft Defender for Cloud as Code](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/deploying-and-managing-microsoft-defender-for-cloud-as-code/ba-p/3649653) 💡[Collect data in custom log formats to Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-custom-logs?tabs=DCG) 💡[Azure Monitor Agent overview - Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview) 💡[Use entity behavior analytics to detect advanced threats](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics) |\r\n| | 2.4 Remote Access | Microsft Entra ID Microsft Entra ID Conditional Access (CA) Microsoft Intune Microsoft Defender for Endpoint (MDE) | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) | 💡[Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡[Conditional Access APIs and PowerShell - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-apis) 💡[Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) 💡[Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance) 💡[Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) 💡[Configure Conditional Access in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) 💡[Enhance security with the principle of least privilege](https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-least-privileged-access) 💡[Best practices for Azure AD roles](https://learn.microsoft.com/en-us/azure/active-directory/roles/best-practices) 💡[Least privileged roles by task in Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/roles/delegate-by-task) |\r\n| | 2.5 Partially & Fully Automated Asset, Vulnerability and Patch | Microsoft Intune Microsoft Endpoint Configuration Manager (MECM) Mircosoft Defender for Endpoint (MDE) Threat & Vulnerability Management (TVM) Azure Arc-enabled Servers Azure Automation | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Azure Arc](https://portal.azure.us/#view/Microsoft_Azure_HybridCompute/AzureArcCenterBlade/~/overview) | 💡 [What is Windows Update for Business?](https://learn.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb) 💡 [Microsoft Configuration Manager MECEM](https://learn.microsoft.com/en-us/mem/configmgr/core/understand/introduction) 💡 [Update rings for Windows 10 and later policy in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-10-update-rings?source=recommendations) 💡 [Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure) 💡 [Deploy software updates with Configuration Manager](https://learn.microsoft.com/en-us/mem/configmgr/sum/deploy-use/deploy-software-updates) 💡 [Use Intune to remediate vulnerabilities identified by Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/mem/intune/protect/atp-manage-vulnerabilities) 💡 [Remediate vulnerabilities (Defender for Endpoint)](https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-remediation?view=o365-worldwide) 💡 [Choose how to deliver updates for the Microsoft 365 Apps](https://learn.microsoft.com/en-us/deployoffice/fieldnotes/choose-how-to-deliver-updates) 💡 [Windows Release Health](https://learn.microsoft.com/en-us/windows/release-health/) 💡 [Manage updates and patches for your VMs](https://learn.microsoft.com/en-us/azure/automation/update-management/manage-updates-for-vm) 💡 [Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) |\r\n| | 2.6 Unified Endpoint Management (UEM) & Mobile Device Management (MDM) | Microsoft Intune Azure Arc-enabled Servers Azure Autiomation | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Azure Arc](https://portal.azure.us/#view/Microsoft_Azure_HybridCompute/AzureArcCenterBlade/~/overview) | 💡[What is Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/what-is-intune) 💡[Manage your devices and control device features in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-devices) 💡[Zero Trust with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/zero-trust-with-microsoft-intune) 💡[Supported operating systems and browsers in Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/supported-devices-browsers) 💡[Enrollment guide: Microsoft Intune enrollment](https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment) 💡[Manage iOS/iPadOS software update policies in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-ios) 💡[Manage macOS software update policies in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-macos) 💡[Microsoft Intune How-To Guides](https://learn.microsoft.com/en-us/mem/intune/#how-to-guides) 💡[What is Azure Arc-enabled servers?](https://learn.microsoft.com/en-us/azure/azure-arc/servers/overview) 💡[Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) |\r\n| | 2.7 Endpoint & Extended Detection & Response (EDR & XDR) | Microsoft 365 Defender Microsoft Defender for Endpoint (MDE) Microsoft Defednder for Identity (MDI) Microsoft Defender for Office 365 (MDO) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us) | 💡[What is Microsoft Defender for Endpoint?](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide) 💡[Zero Trust with Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/zero-trust-with-microsoft-defender-endpoint?view=o365-worldwide) 💡[What is Microsoft 365 Defender?](https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender?view=o365-worldwide) 💡[Zero Trust with Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/zero-trust-with-microsoft-365-defender?view=o365-worldwide) 💡[Overview of endpoint detection and response (EDR) with Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response?view=o365-worldwide) 💡[Implement Microsoft Sentinel and Microsoft 365 Defender for Zero Trust](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) 💡[Manage endpoint detection and response (EDR) policy for endpoint security in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-edr-policy) 💡[Set up your XDR tools](https://learn.microsoft.com/en-us/security/operations/setup-xdr-tools) 💡[Architect your Microsoft Sentinel workspace](https://learn.microsoft.com/en-us/security/operations/siem-workspace) 💡[Ingest data sources and configure incident detection in Sentinel](https://learn.microsoft.com/en-us/security/operations/ingest-data-sources) 💡[Respond to an incident using Microsoft Sentinel and Microsoft 365 Defender](https://learn.microsoft.com/en-us/security/operations/respond-incident) |\r\n| Application & Workload 3.x | | | | |\r\n| | 3.1 Application Inventory | Entra ID Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) Microsoft Intune | 🔀 [Entra ID Applications - Useage & Insights](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/EnterpriseApplicationsInsightsMenuBlade/~/ApplicationActivity) 🔀 [Application Security Groups](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FapplicationSecurityGroups) 🔀 [Microsoft Defender for Cloud Apps - Discovery](https://security.microsoft.us/cloudapps/discovery) 🔀 [Virtual Network Gateways](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FvirtualNetworkGateways) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Cloud Discovery Setup](https://learn.microsoft.com/en-us/defender-cloud-apps/set-up-cloud-discovery) 💡 [Deploy Intune Softare inventory & Security Policies](https://learn.microsoft.com/en-us/answers/questions/67892/can-we-use-intune-to-inventory-software-on-devices) 💡 [Configure Blocking Unwanted or Unapproved Applications](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus?view=o365-worldwide) 💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) 💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) 💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) 💡 [Active Directory Federation Services Health](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-health-adfs) 💡 [Azure Active Directory Application Audit](https://github.com/jsa2/AADAppAudit#azure-ad-application-analytics-solution) 💡 [Azure Active Directory Application Proxy](https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/what-is-application-proxy) 💡 [Using Microsoft Defender for Cloud Asset Inventory](https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory) 💡 [Working with Discovered Apps](https://learn.microsoft.com/en-us/defender-cloud-apps/discovered-apps) 💡 [Software Inventory](https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-software-inventory?view=o365-worldwide) |\r\n| | 3.2 Secure Software Development & Integration | Azure Policy Microsoft Defender for Cloud (MDfC) Microsoft Defender for Endpoint (MDE) | 🔀 [Azure DevOps](https://portal.azure.us/#view/AzureTfsExtension/OrganizationsTemplateBlade) 🔀 [Azure Dev Test Center](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.DevTestLab%2Flabs) 🔀 [Azure DevTest Lab](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.DevTestLab%2Flabs) 🔀 [Intune App Security](https://endpoint.microsoft.us) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | |\r\n| | 3.3 Software Risk Management | Microsoft Defender for Cloud Apps (MDA) Mircosoft Defender for Endpoint (MDE) Threat & Vulnerability Management (TVM) Microsoft Intune | 🔀 [Azure Enterprise Apps Portal](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview) 🔀 [Intune Application Security](https://endpoint.microsoft.us/#view/Microsoft_Intune_DeviceSettings/AppsMenu/~/overview) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Manage and Secure Apps In Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-apps) 💡 [App Protection Policies in Intune](https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy) 💡 [Microsoft Container Registry](https://mcr.microsoft.com/) 💡 [GitHub Actaion For Vulnerability Scanning](https://github.com/marketplace/actions/anchore-container-scan) 💡 [Code Scanning with CodeQL](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql) 💡 [Keeping your supply chain secure with Dependabot](https://docs.github.com/en/code-security/dependabot) 💡 [Secure Supply Chain Consumption Framework](https://www.microsoft.com/en-us/securityengineering/opensource/osssscframeworkguide) 💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) 💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) 💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) |\r\n| | 3.4 Resource Authorization & Integration | Entra ID Conditional Access (CA) Entra ID Application Proxy Azure Policy Entra ID Privilleged Identity Management (PIM) Microsoft 365 Defender Microsoft Intune Microsoft Defender for Cloud (MDfC) | 🔀 [Azure Identity Governance](https://portal.azure.us/#blade/Microsoft_AAD_ERM/DashboardBlade) 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Azure Application Proxy](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppProxy) 🔀 [Managed Service Identity](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/6f3afa5d-4b81-4f10-8806-fb75689672da/appId/c75517e9-05c9-49e9-9990-94f68b04ffc4) 🔀 [Intune Application Security](https://endpoint.microsoft.us/#view/Microsoft_Intune_DeviceSettings/AppsMenu/~/overview) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Deploy Microsoft Defender for Cloud - Enterprise Cloud Application Protection](https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction) 💡 [Configure Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/en-us/download/details.aspx?id=54431) 💡 [Deploying Application & Authorization Azure App Services](https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization) 💡 [How to create and deploy a custome Authorization Manager](https://learn.microsoft.com/en-us/dotnet/framework/wcf/extending/how-to-create-a-custom-authorization-manager-for-a-service) 💡 [Configure with Entra Identity Platform](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow) 💡 [How-to Manage Apps Remove User Access with Entra](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/methods-for-removing-user-access) 💡 [Setup Protecting Apps w. Entra Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps) 💡 [Role Based Access Control Configuration with Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control) |\r\n| | 3.5 Continuous Monitoring and Ongoing Authorizations | Entra ID - Conditional Access (CA) Microsoft Defender for Cloud Apps (MDA) Microsoft Senitnel Playbooks Entra ID - Privileged Identity Management (PIM) | 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [Application Insights](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.insights%2Fcomponents) 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Application Security Groups Portal](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FapplicationSecurityGroups) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) | 💡 [How-to-Build a Successful App Security Program](https://www.microsoft.com/en-us/security/blog/2021/03/29/how-to-build-a-successful-application-security-program/) 💡 [Setting up Hybrid Continuous Monitoring with Sentinel](https://learn.microsoft.com/en-us/azure/architecture/hybrid/hybrid-security-monitoring) 💡 [Deploy Adaptive Appliation Conrols Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls) 💡 [Configure Azure Security Management & Monitoring](https://learn.microsoft.com/en-us/azure/security/fundamentals/management-monitoring-overview) 💡 [Leverage Security Baselines for M365 Apps Enterprise](https://learn.microsoft.com/en-us/deployoffice/security/security-baseline) 💡 [Utilize Application Control for Windows](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/wdac) |\r\n| Data 4.x | | | | |\r\n| | 4.1 Data Catalog Risk Alignment | Purview Data Catalog Purview Data Map Microsoft Sentinel | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Azure Data Classification Service](https://portal.azure.us/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/30ea52ed-e5a7-4e51-a4ea-6c3b96a8be36/appId/7c99d979-3b9c-4342-97dd-3239678fb300) | 💡 [Create a Azrure Data Catalog](https://learn.microsoft.com/en-us/azure/data-catalog/data-catalog-get-started) 💡 [Use the Service Catalog](https://learn.microsoft.com/en-us/system-center/scsm/service-catalog?view=sc-sm-2022) 💡 [Azure Data Catalog FAQ](https://learn.microsoft.com/en-us/azure/data-catalog/data-catalog-frequently-asked-questions) 💡 [Establishing Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) 💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) 💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Set up Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) 💡 [Discover Data & Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) |\r\n| | 4.2 DoD Enterprise Data Governance | Purview Data Governance Purview Data Estate Insights Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Implement Microsoft Purview - IRM & Compliance - DoD Deployments](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) 💡 [Implement a Data Governance Maturity Model Framework](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) 💡 [Deploy Azure Data Governance](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) 💡 [Leverage Microsoft Defender for For Cloud Goverance Rules](https://learn.microsoft.com/en-us/azure/defender-for-cloud/governance-rules) 💡 [Implement Purview Data Governance](https://learn.microsoft.com/en-us/purview/?view=o365-worldwide) 💡 [Purview Data Lineage Machine Learning](https://learn.microsoft.com/en-us/samples/microsoft/purview-machine-learning-lineage-solution-accelerator/purview-machine-learning-lineage-solution-accelerator/) 💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Azure Collaboration Governance](https://learn.microsoft.com/en-us/microsoft-365/solutions/collaboration-governance-overview?view=o365-worldwide) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) 💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/en-us/azure/azure-sql/database/sql-insights-overview?view=azuresql) 💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) |\r\n| | 4.3 Data Labeling and Tagging | Purview Information Protection | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Create Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) 💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) 💡 [Deploy with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Utilize Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) 💡 [Use the Service Catalog](https://learn.microsoft.com/en-us/system-center/scsm/service-catalog?view=sc-sm-2022) |\r\n| | 4.4 Data Monitoring and Sensing | Purview Data Loss Protection (DLP) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) Microsoft Sentinel | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Azure Monitor Control Service](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/512ba5b8-8ced-42b9-8a94-c93befaf66a1/appId/e933bd07-d2ee-4f1d-933c-3752b819567b) | 💡 [Leverage Data Monitoring & Self Healing](https://learn.microsoft.com/en-us/compliance/assurance/assurance-monitoring-and-self-healing) 💡 [Deploy Microsoft 365 Monitorning](https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-monitoring?view=o365-worldwide) 💡 [Senitnel Data Collection Best Practices](https://learn.microsoft.com/en-us/azure/sentinel/best-practices-data) 💡 [Deploy Microsoft Purview](https://learn.microsoft.com/en-us/purview/purview) 💡 [Utilze Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Configure Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) 💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/en-us/azure/azure-sql/database/sql-insights-overview?view=azuresql) |\r\n| | 4.5 Data Encryption & Rights Management | Purview Data Loss Protection (DLP) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) | 🔀 [Azure Encryption](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/21426118-88fd-4b5e-b106-3bd5f098f31a/appId/dbc36ae1-c097-4df9-8d94-343c3d091a76) 🔀 [Azure Rights Management Service](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/5f0c1df8-5bab-4fb3-b1a5-19bdba46c704/appId/00000012-0000-0000-c000-000000000000) 🔀 [M365 Data At Rest Encryption](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/882ab41e-90f7-4f4e-8b24-3503495a83e6/appId/c066d759-24ae-40e7-a56f-027002b5d3e4) 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Utilize Azure Encrption](https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview) 💡 [Deploy Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Deploy Purview Information Protection](https://learn.microsoft.com/en-us/purview/information-protection) 💡 [Configure Dynamic Key & Encrption Delivery](https://learn.microsoft.com/en-us/azure/media-services/latest/drm-content-protection-concept) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) |\r\n| | 4.6 Data Loss Prevention (DLP) | Purview Data Loss Protection (DLP) Purview Information Protection | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Endpoint DLP](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/780e77f3-df11-4525-b201-973a1b691cab/appId/c98e5057-edde-4666-b301-186a01b4dc58) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Implement Data Loss & Prevention (DLP)](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp) 💡 [Informaiton Protection & Data Loss and Prevention- GITHUB LAB](https://microsoft.github.io/ComplianceCxE/dag/mip-dlp/) 💡 [Deploy Adaptive Protection- Data Loss & Protections](https://learn.microsoft.com/en-us/purview/dlp-adaptive-protection-learn) 💡 [Apply Rules for DLP Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/data-loss-prevention/dlp-rule-application) 💡 [Utilize Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) |\r\n| | 4.7 Data Access Control | Microsoft Defender for Cloud Apps (MDA) Entra ID Conditional Access (CA) Purview Insider Risk Management Purview Information Protection Purview Data Loss Prevention (DLP) Microsoft Intune | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Entra ID Privileged Identity Management](https://portal.azure.us/#blade/Microsoft_Azure_PIMCommon/CommonMenuBlade) 🔀 [Entra ID Conditional Access](https://portal.azure.us/#blade/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade) 🔀 [Azure Internal Access Scope Portal](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/a0779651-4c07-4392-a11f-a1694cb497b1/appId/c29427db-9ecc-4750-ad93-d256863f2e37) 🔀 [Virtual Network Terminal Access Points](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.network%2Fvirtualnetworktaps) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Azure Data Explorer](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Kusto%2Fclusters) | 💡 [Configure Conditional Access in Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview) 💡 [Use Conditional Access Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) 💡 [Use Conditional Access APIs](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-apis) 💡 [Deploy Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access#deploy-conditional-access-policies) 💡 [Use Conditional Access With Data Explorer](https://learn.microsoft.com/en-us/azure/data-explorer/security-conditional-access) 💡 [Deploy Common Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common?tabs=secure-foundation) 💡 [Build Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policies) |\r\n| Network & Environment 5.x | | | | |\r\n| | 5.1 Data Flow Mapping | Azure Monitor Net Insights Network Watcher Microsoft Defender for Endpoint (MDE) | 🔀 [Network Security Perimeters](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FnetworkSecurityPerimeters) 🔀 [Network Interfaces](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2Fnetworkinterfaces) 🔀 [Azure Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) 🔀 [Azure Firewall](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FazureFirewalls) 🔀 [Web Application Firewall](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FFrontDoorWebApplicationFirewallPolicies) 🔀 [DDoS Protection Plans](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FddosProtectionPlans) 🔀 [Firewall Manager](https://portal.azure.us/#view/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/~/firewallManagerOverview) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Use Data Flow Mapping Power Platform](https://learn.microsoft.com/en-us/power-query/dataflows/create-use) 💡 [User Azure Network Traffic Analytics](https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics) 💡 [Azure Blue Print ](https://learn.microsoft.com/en-us/azure/governance/blueprints/overview) 💡 [Leverage Azure Data Visualization with Data Explorer](https://learn.microsoft.com/en-us/azure/data-explorer/viz-overview) 💡 [Use Power Automate for Event Tagging](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-microsoft-flow?view=o365-worldwide) 💡 [Secure & Govern Workloads with Network-level Segmentation](https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/network-level-segmentation) 💡 [Deploy Software Defined Netoworking](https://learn.microsoft.com/en-us/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) 💡 [Manage Software Defined Netoworking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/manage-sdn) 💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) |\r\n| | 5.2 Software Defined Networking (SDN) | Secure Access Service Edge (SASE) Microsoft Network Secuirty Groups (NSG) Entra ID App Proxy | 🔀 [Manage Virtual Network](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks) 🔀 [Network Security Groups](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FNetworkSecurityGroups) 🔀 [Network Managers](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FnetworkManagers) 🔀 [Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) 🔀 [Network Security Perimeters](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FnetworkSecurityPerimeters) 🔀 [Entra App Proxy](https://portal.azure.us/#view/Microsoft_AAD_IAM/AppProxyOverviewBlade) | 💡 [Use Secure Access Service Edge SASE - Software Defined Networking Zero Trust](https://www.microsoft.com/en-us/security/business/security-101/what-is-sase) 💡 [Software Defined Network Monitoring using Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/software-defined-monitoring-using-automated-notebooks-and-azure/ba-p/2587775) 💡 [Plan Software Defined Netoworking](https://learn.microsoft.com/en-us/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) 💡 [Implementing Software Defined Networking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/) 💡 [Manage Software Detined Netoworking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/manage-sdn) 💡 [Deploy Software Defined Networking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/deploy/deploy-a-software-defined-network-infrastructure-using-scripts) 💡 [Secure the Network Controller](https://learn.microsoft.com/en-us/azure-stack/hci/manage/nc-security) 💡 [SDN for Win Server 2019 and 2022](https://learn.microsoft.com/en-us/windows-server/networking/sdn/sdn-whats-new) 💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) 💡 [IPV6 Config Interface](https://learn.microsoft.com/en-us/javascript/api/%40azure/arm-databoxedge-profile-2020-09-01-hybrid/ipv6config?view=azure-node-latest&wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Leverage IPV6 for Azure Virtual Networks](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Segementation Security Strategies](https://learn.microsoft.com/en-us/azure/well-architected/security/design-segmentation) 💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) 💡 [Utilize Microsoft Packet Monitor](https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon) |\r\n| | 5.3 Macro Segmentation | Azure Subscription Azure VNet(s) Azure VNet Manager Network Security Groups (NSG) Azure Firewall | 🔀 [Impletment Network Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) 🔀 [Azure Features for Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation#azure-features-for-segmentation) 🔀 [Network Service](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.HybridNetwork%2Fpublishers%2Fnetworkservicedesigngroups) 🔀 [Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) | 💡 [Impletment Network Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) 💡 [Azure Features for Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation#azure-features-for-segmentation) 💡 [Segementation Security Strategies](https://learn.microsoft.com/en-us/azure/well-architected/security/design-segmentation) 💡 [Network Service Designs](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.HybridNetwork%2Fpublishers%2Fnetworkservicedesigngroups) 💡 [Network Watcher](https://portal.azure.com/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) |\r\n| | 5.4 Micro Segmentation | Azure Security Groups (ASG) Entra ID App Proxy Microsoft Tunnel | 🔀 [Virtual Networks Termal Access Points](https://portal.azure.us/#view/HubsExtension/BrowseResourceBlade/resourceType/microsoft.network%2Fvirtualnetworktaps) 🔀 [Conditional Access](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Overview) 🔀 [Cloud Access Routers](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Orbital%2FcloudAccessRouters) 🔀 [Entra ID Conditional Access](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Overview) 🔀 [Azure Monitor Networks](https://portal.azure.us/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/networkInsights) 🔀 [Azure Connection Monitor](https://portal.azure.us/#view/Microsoft_Azure_FlowLog/ConnectionMonitorV2ViewModel) 🔀 [Azure Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview/menuId~/%7B%22target%22%3A%7B%7D%7D) | 💡 [Enabling JIT Access Controls](https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Conditional Access Block Access by Location](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-location?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Secure Networks with Zero Trust](https://learn.microsoft.com/en-us/security/zero-trust/deploy/networks) 💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation?wtmc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Microsoft Packet Monitor](https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon) |\r\n| Automation & Orchestration 6.x | | | | |\r\n| | 6.1 Policy Decision Point (PDP) & Policy Orchestration | Entra ID Conditional Access (CA) Azure Policy Azure Automation Azure ML Azure Firewall Microsoft Sentinel | 🔀 [Azure Automation](https://portal.azure.us/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/d2175af3-6958-4008-83ac-ac2b81eafac7/appId/fc75330b-179d-49af-87dd-3b1acf6827fa) 🔀 [Azure Machine Learning](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.MachineLearningServices%2Fworkspaces) 🔀 [Azure Policy](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyMenuBlade) 🔀 [Azure Virtual Desktop](https://portal.azure.us/#view/Microsoft_Azure_WVD/WvdManagerMenuBlade/~/overview) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) | 💡 [Visibility,Automation and Orchestration with Zero Trust](https://learn.microsoft.com/en-us/) 💡 [Azure Orchestration for Azure Security Policy](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/azure-policy-security-baseline) 💡 [Configuration Analyzer for Security Policies](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies?view=o365-worldwide) 💡 [Azure Automation Overview](https://learn.microsoft.com/en-us/azure/automation/overview) 💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/automation-security-baseline) 💡 [Azure Policy](https://learn.microsoft.com/en-us/azure/governance/policy/overview) 💡 [What is Azure Firewall?](https://learn.microsoft.com/en-us/azure/firewall/overview) 💡 [Apply Zero Trust principles to a hub virtual network in Azure](https://learn.microsoft.com/en-us/security/zero-trust/azure-infrastructure-networking) 💡 [Management of Role Permissions and Automation](https://learn.microsoft.com/en-us/azure/automation/automation-role-based-access-control) 💡 [Using Azure Machine Learning to assign roles](https://learn.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler) 💡 [Azure AD Seccurity Groups ML](https://learn.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler#use-azure-ad-security-groups-to-manage-workspace-access) |\r\n| | 6.2 Critical Process Automation | Microsoft Power Automate Azure Logic Apps Microsoft Sentinel Playbooks Microsoft 365 Defender Automated Investigation & Response | 🔀 [Azure Automation](https://portal.azure.us/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/d2175af3-6958-4008-83ac-ac2b81eafac7/appId/fc75330b-179d-49af-87dd-3b1acf6827fa) 🔀 [Microsoft Sentinel Automation Blade](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_Security_Insights/MainMenuBlade/~/Automationl) 🔀 [Azure Logic Apps Blade](https://portal.azure.us/?feature.msaljs=true#view/HubsExtension/BrowseResource/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Azure Automation Overview](https://learn.microsoft.com/en-us/azure/automation/overview) 💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/automation-security-baseline) 💡 [Visibility, Automation, and Orchestration with Zero Trust](https://learn.microsoft.com/en-us/) 💡 [Automation in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automation) 💡 [Automate Threat Response with Playbooks](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) 💡 [Automated Investigation & Response M365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) 💡 [Power Automate U.S Government](https://learn.microsoft.com/en-us/power-automate/us-govt) |\r\n| | 6.3 Machine Learning | Microsoft Sentinel Fusion ML Microsoft Sentinel Bring Your Own Machine Learning (BYOML) Microsoft Defender for Cloud (MDfC) Azure ML | 🔀 [Azure Machine Learning](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.MachineLearningServices%2Fworkspaces) 🔀 [Power Automate](https://make.gov.powerautomate.us/) 🔀 [Power Platform Admin Center](https://admin.appsplatform.us/) 🔀 [Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Defender for Cloud](https://portal.azure.us/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0) | 💡 [Advanced multistage attack detection in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/fusion) 💡 [Bring your own Machine Learning (ML) into Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/bring-your-own-ml) 💡 [Azure Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/?view=azureml-api-2) 💡 [Enterprise Security & Governance w. Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/concept-enterprise-security?view=azureml-api-2) 💡 [Azure Government Isolaiton Guidelines using AI & ML](https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-impact-level-5) 💡 [Quick Start Azure Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/tutorial-azure-ml-in-a-day?view=azureml-api-2) 💡 [Azure security baseline for Azure Machine Learning](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/machine-learning-security-baseline) |\r\n| | 6.4 Artificial Intelligence | Microsoft Sentinel Fusion ML Microsoft Sentinel Tailored AI Azure ML | 🔀 [Azure AI Services](https://portal.azure.us/#blade/Microsoft_Azure_ProjectOxford/CognitiveServicesHub) 🔀 [Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Defender for Cloud](https://portal.azure.us/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0) | 💡 [AI Security Services](https://learn.microsoft.com/en-us/azure/ai-services/security-features) 💡 [Senintel Automation](https://learn.microsoft.com/en-us/azure/sentinel/automation) 💡 [AI ID & Access Risk Based Controls](https://azure.microsoft.com/en-us/products/category/identity/) 💡 [Implement Sentinel & M365 Defender for XDR - AI Driven Zero Trust ](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) 💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) |\r\n| | 6.5 Security Orchestration, Automation & Response (SOAR) | Microsoft 365 Defender Automated investigation and response Microsoft Sentinel Playbooks Microsoft Defender for Cloud (MDfC) Azure Logic Apps | 🔀 [Sentinel SIEM-SOAR](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Logic Apps](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [Microsoft Defender for Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) | 💡 [Security Ochestration, Automation & Response (SOAR) In Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automation) 💡 [Sentinel SOAR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/how-to-use-azure-sentinel-for-incident-response-orchestration/ba-p/2242397) 💡 [Microsoft Sentinel SOAR Content Catalog](https://learn.microsoft.com/en-us/azure/sentinel/sentinel-soar-content) 💡 [Automate Threat Response with Playbooks in Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) 💡 [Automated investigation and response in Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) 💡 [Workflow Automation in Microsoft Defender for Cloud](https://www.bing.com/ck/a?!&&p=9150006d50b58362JmltdHM9MTY5MDg0ODAwMCZpZ3VpZD0yMTRiYTU0My05MDAzLTY2ODAtMjJhMS1iNjFjOTQwMzYwYjYmaW5zaWQ9NTI5Mw&ptn=3&hsh=3&fclid=214ba543-9003-6680-22a1-b61c940360b6&psq=Microsoft+SOAR+Logic+Apps&u=a1aHR0cHM6Ly9sZWFybi5taWNyb3NvZnQuY29tL2VuLXVzL2F6dXJlL2RlZmVuZGVyLWZvci1jbG91ZC93b3JrZmxvdy1hdXRvbWF0aW9u&ntb=1) 💡 [SOAR Best Practices](https://www.microsoft.com/en-us/security/business/security-101/what-is-soar#SOARbestpractices) 💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) |\r\n| | 6.6 API Standardization | Azure API Management Azure Monitor Log Analytics Azure Logic Apps Azure Policy | 🔀 [API Management Services](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.ApiManagement%2Fservice) 🔀 [API Connections](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Web%2Fconnections) 🔀 [API Playground](https://portal.azure.us/#blade/Microsoft_Azure_Resources/ArmPlayground) 🔀 [Azure Logic Apps](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Logic%2Fworkflows) | 💡 [Microsft API Management & Security](https://azure.microsoft.com/en-us/products/api-management/) 💡 [Mitigate OWASP Top 10 Security Threats Using Microsoft API Management](https://learn.microsoft.com/en-us/azure/api-management/mitigate-owasp-api-threats) 💡 [Security Baselines for API Management](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/api-management-security-baseline) 💡 [Secure and Compliant APIs for a Hybrid and Multi Cloud World](https://azure.microsoft.com/en-us/blog/secure-and-compliant-apis-for-a-hybrid-and-multi-cloud-world/) 💡 [Web API Design Best Practice](https://learn.microsoft.com/en-us/azure/architecture/best-practices/api-design) 💡 [Monitor & Protect Your APIs](https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-use-azure-monitor) |\r\n| | 6.7 Security Operations Center (SOC) & Incident Response (IR) | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) Microsoft 365 Defender | 🔀 [Sentinel SIEM-SOAR](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Logic Apps](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [Microsoft Defender for Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Security Operations In Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-security-operations) 💡 [Microsoft SOC Best Practices Landing Page](https://www.microsoft.com/en-us/security/business/security-101/what-is-a-security-operations-center-soc?ef_id=_k_ce7dcd6e8f2d1919667ca9a72f733870_k_&OCID=AIDcmmdamuj0pc_SEM__k_ce7dcd6e8f2d1919667ca9a72f733870_k_&msclkid=ce7dcd6e8f2d1919667ca9a72f733870) 💡 [Playbook for Modernizing Security Operations Centers](https://www.microsoft.com/en-us/security/blog/2021/02/11/a-playbook-for-modernizing-security-operations/) 💡 [CISO Series Lessons Learned from Microsoft's SOC](https://www.microsoft.com/en-us/security/blog/2019/10/07/ciso-series-lessons-learned-from-the-microsoft-soc-part-3a-choosing-soc-tools/) 💡 [Integrating Microsoft 365 Defender into your security operations](https://learn.microsoft.com/en-us/microsoft-365/security/defender/integrate-microsoft-365-defender-secops?view=o365-worldwide) |\r\n| Visibility & Analytics 7.x | | | | |\r\n| | 7.1 Log All Traffic (Network, Data, Apps, Users) | Azure Monitor Log Analytics Microsoft Sentinel | 🔀 [Log Analytics Workspace](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.OperationalInsights%2Fworkspaces) 🔀 [Log Query Packs](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.OperationalInsights%2Fquerypacks) 🔀 [Sign-in Activity Logs](https://portal.azure.us/#blade/Microsoft_AAD_IAM/SignInEventsV3Blade) 🔀 [Activity Logs](https://portal.azure.us/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/activityLog) 🔀 [Audit Log](https://portal.azure.us/#blade/Microsoft_AAD_IAM/AuditEventsV2PillsBlade) 🔀 [Operation Log](https://portal.azure.us/#blade/Microsoft_Azure_Resources/OperationLogsBlade) 🔀 [Microsoft Azure Log Search Alerts](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/c134d63b-957f-4cf7-8a34-d744aa8804df/appId/f6b60513-f290-450e-a2f3-9930de61c5e7) | 💡 [Azure Log Analytics](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-overview) 💡 [Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/overview) 💡 [Audit Logging and Monitoring](https://learn.microsoft.com/en-us/compliance/assurance/assurance-audit-logging) 💡 [Maturity Model for Log Management M2131](https://techcommunity.microsoft.com/t5/public-sector-blog/microsoft-sentinel-maturity-model-for-event-log-management-m-21/ba-p/3074336) 💡 [Device Log Capture - Intune](https://learn.microsoft.com/en-us/mem/intune/remote-actions/collect-diagnostics) 💡 [Application Logging](https://learn.microsoft.com/en-us/sql/relational-databases/performance/view-the-windows-application-log-windows-10?view=sql-server-ver16) 💡 [User Access Logging](https://learn.microsoft.com/en-us/windows-server/administration/user-access-logging/get-started-with-user-access-logging) 💡 [Azure Infrastructure Logs](https://learn.microsoft.com/en-us/azure/well-architected/scalability/monitor-infrastructure) 💡 [Network Logging](https://learn.microsoft.com/en-us/azure/azure-web-pubsub/howto-troubleshoot-network-trace) 💡 [Supported Logs for Network](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/supported-logs/microsoft-network-networkmanagers-logs) |\r\n| | 7.2 Security Information and Event Management (SIEM) | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) Microsoft 365 Defender | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Microsoft Defender for Cloud](https://portal.azure.us/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0) | 💡[Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/overview) 💡[Implement Sentinel & M365](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) 💡[Unified SIEM & XDR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-unified-microsoft-siem-and-xdr-github-community/ba-p/3249533) 💡[Stream Alerts Defender for Cloud to SIEM](https://learn.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem#stream-alerts-to-azure-sentinel) 💡[Azure Sentinel Github Repo](https://github.com/Azure/Azure-Sentinel) 💡[Sentinel & SOC Analysis Process](https://learn.microsoft.com/en-us/azure/sentinel/migration-security-operations-center-processes) 💡[Microsoft Sentinel Skill Up Training](https://learn.microsoft.com/en-us/azure/sentinel/skill-up-resources) |\r\n| | 7.3 Common Security and Risk Analytics | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Security Baselines](https://endpoint.microsoft.us/#home) | 💡[Microsoft Security Response Center Security Updates Guide](https://msrc.microsoft.com/update-guide) 💡[Explore Risks to Sensitive Data Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/data-security-review-risks) 💡[Identify & Analyze Risks Across Your Environment](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-attack-path) 💡[Cloud Security Posture Management](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management) 💡[Microsoft Cloud Security Benchmark](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-regulatory-compliance) |\r\n| | 7.4 User and Entity Behavior Analytics | Microsoft Sentinel UEBA Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Identity (MDI) Entra ID Conditional Access (CA) Purview Insider Risk Management | 🔀 [Behavior Analytics Insights](https://portal.azure.us/#@jubradfogov.onmicrosoft.us/asset/Microsoft_OperationsManagementSuite_Workspace/Solution/subscriptions/3ab4869f-acc9-49ec-a399-12efd162502f/resourceGroups/fedlogana/providers/Microsoft.OperationsManagement/solutions/BehaviorAnalyticsInsights(loganalytics) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [ID Threats with User and Entity Behavior Analytics](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [Enable Entity Behavior Analytics to Detect Threats](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics) 💡 [Microsoft Sentinel UEBA Reference](https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference) 💡 [Investigate Incidents with UEBA](https://learn.microsoft.com/en-us/azure/sentinel/investigate-with-ueba) 💡 [Discover and Protect Sensitive Information in your Organization](https://learn.microsoft.com/en-us/defender-cloud-apps/tutorial-dlp) 💡 [Purview Insider Risk Management](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) |\r\n| | 7.5 Threat Intelligence Integration | Microsoft Sentinel Threat Intelligence (TI) Microsoft Graph Security Indicators Microsoft Defender Threat Intelligence (MDTI) | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Microsoft Threat Intelligence Portal](https://ti.defender.microsoft.com/) | 💡[Microsoft Threat Intelligence](https://learn.microsoft.com/en-us/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti) 💡[Microsoft Security Graph API](https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview?view=graph-rest-beta) 💡[Create Threat Intelligence Indicators](https://learn.microsoft.com/en-us/graph/api/tiindicators-post?view=graph-rest-beta&tabs=http) 💡[Threat intelligence integration in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/threat-intelligence-integration) 💡[Bring Your Own Threat Intelligence Feeds](https://learn.microsoft.com/en-us/defender-cloud-apps/additional-integrations) 💡[Accessing the Threat Intelligence Portal](https://learn.microsoft.com/en-us/defender/threat-intelligence/learn-how-to-access-microsoft-defender-threat-intelligence-and-make-customizations-in-your-portal) |\r\n| | 7.6 Automated Dynamic Policies | Entra ID Protection Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel Fusion ML Microsoft Sentinel Bring Your Own Machine Learning (BYOML) Microsoft Sentinel Playbooks Microsoft Intune Azure Automation Purview Insider Risk Management | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Logic Apps](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Azure Automation](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/d2175af3-6958-4008-83ac-ac2b81eafac7/appId/fc75330b-179d-49af-87dd-3b1acf6827fa) 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) | 💡[Automate Threat Response with Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) 💡[Adaptive Protection - Microsoft Purview](https://www.microsoft.com/en-us/security/blog/2023/02/06/introducing-adaptive-protection-in-microsoft-purview-people-centric-data-protection-for-a-multiplatform-world/#:~:text=With%20Adaptive%20Protection%2C%20DLP%20policies%20become%20dynamic%2C%20ensuring,efficient%20and%20empowered%20to%20do%20more%20with%20less.) 💡[Adaptive Policy Scopes M365](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/using-adaptive-policy-scopes-to-apply-m365-retention-to-shared/ba-p/3053641#:~:text=Back%20in%20October,in%20Microsoft%20365.) 💡[Adaptive Application Controls](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls) 💡[AI-Driven Adaptive Device Controls Microsoft Defender for Endpoint](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/ai-driven-adaptive-protection-in-microsoft-defender-for-endpoint/ba-p/2966491) 💡[AI-Driven Adaptive Protection Against Human Operated Ransomeware](https://www.microsoft.com/en-us/security/blog/2021/11/15/ai-driven-adaptive-protection-against-human-operated-ransomware/) 💡[Microsoft Defender for Cloud Automated Security Posture Management](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management) 💡[Improve your network security posture with adaptive network hardening](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-network-hardening) 💡[What is Microsoft Entra ID Protection?](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection) 💡[Azure Automation update management](https://learn.microsoft.com/en-us/azure/architecture/hybrid/azure-update-mgmt) 💡[Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure) |"
+ "json": "| DoD Zero Trust Pillar | DoD Zero Trust Capability | Recommended Microsoft Solution(s) | Recommended DoD Portal(s) | Recommended Resources |\r\n|--------------------------------|------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\r\n| User 1.x | | | | |\r\n| | 1.1 User Inventory | Entra ID Microsoft Sentinel UEBA Microsoft Defender for Cloud (MDfC) | 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Microsoft Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Microsoft Identity Platform Entra (formerly AAD)](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-overview) 💡 [Microsoft Hybrid Identity with Entra/AAD/AD](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/) 💡 [Using the Inventory in Secure Score - Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory) 💡 [Identity Decision Guide](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/decision-guides/identity/) 💡 [Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/en-us/download/details.aspx?id=54431) 💡 [Identity Security Monitoring](https://github.com/Cloud-Architekt/AzureAD-Attack-Defense/blob/main/IdentitySecurityMonitoring.md#identity-security-monitoring-in-a-hybrid-environment) 💡 [Collect Azure Active Directory (Azure AD) Logs](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics#send-logs-to-azure-monitor) 💡 [Enable User Entity Behavorial Analytics](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics#how-to-enable-user-and-entity-behavior-analytics) 💡 [Deploy Microsoft Defender for Identity](https://learn.microsoft.com/en-us/defender-for-identity/deploy-defender-identity) 💡 [Secure with Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/secure-with-azure-ad-introduction) 💡 [AAD Hybrid Identity](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/plan-hybrid-identity-design-considerations-overview?WT.mc_id=DT-MVP-5001664) 💡 [Azure AD Reports](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/overview-reports?WT.mc_id=DT-MVP-5001664) 💡 [B2B Collaboration](https://learn.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b?WT.mc_id=DT-MVP-5001664) |\r\n| | 1.2 Conditional User Access | Entra ID Conditional Access (CA) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel Microsoft 365 Defender Microsoft Intune | 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) 🔀 [Conditional Access Policy Templates](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Microsoft Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [What is Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview) 💡 [Conditional Access Learning Path](https://learn.microsoft.com/en-us/training/modules/plan-implement-administer-conditional-access/) 💡 [Conditional Access Licensing- Need at least AADP1](https://www.microsoft.com/en-us/security/business/identity-access/azure-active-directory-pricing?rtc=1) 💡 [Conditional Access Design Principles](https://learn.microsoft.com/en-us/azure/architecture/guide/security/conditional-access-design) 💡 [Templates -Secure Foundation & Work Toward ZT](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common) 💡 [Conditional Access Trends and Changes](https://github.com/Cyberlorians/Workbooks/blob/main/ConditionalAccessTrendsandChanges.json) 💡 [Implement Authentication Strengths](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/authentication-strength-choose-the-right-auth-method-for-your/ba-p/2365674) 💡 [Intune Conditional Access](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) 💡 [Using Locations in Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition) |\r\n| | 1.3 Multi-Factor Authentication (MFA) | Entra ID Entra ID - Certificate Based Authorization (CBA) | 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Entra ID - AuthN Methods Activity](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthMethodsActivity/menuId/AuthMethodsActivity) 🔀 [Entra ID - AuthN Methods Policies](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods) 🔀 [Entra ID - AuthN Strengths](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthStrengths) 🔀 [Defender for Cloud Recommendations](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_Security/SecurityMenuBlade/~/5) | 💡 [How MFA Works](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks) 💡 [Setup Multifactor Authenication for Users M365](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) 💡 [Configure the MFA Azure Active Directrory Registration Policies](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) 💡 [Deploy Passwordless Solution](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-deployment) 💡 [Configure Azure AD CBA](https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-certificate-based-authentication) 💡 [Conditional Access Policy - MFA](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy?WT.mc_id=DT-MVP-5001664) 💡 [Plan AAD MFA](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted?WT.mc_id=DT-MVP-5001664) |\r\n| | 1.4 Privileged Access Management (PAM) | Entra ID Entra ID - Privileged Identity Management (PIM) | 🔀 [Entra ID DiagnosticSettings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Entra ID - PIM](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_PIMCommon/CommonMenuBlade/~/quickStart) 🔀 [AAD PIM - Audit History](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_PIMCommon/MyAuditsMenuBlade/~/aadmigratedroles) | 💡 [Plan a Privileged Identity Management Deployment](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-deployment-plan) 💡 [Privileged Identity Management - Why use it with Defender for O365?](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/use-privileged-identity-management-in-defender-for-office-365?view=o365-worldwide) 💡 [Implementing PIM - Micrsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started) 💡 [Secure Roadmap - PIM](https://learn.microsoft.com/en-us/azure/active-directory/roles/security-planning#use-azure-ad-privileged-identity-management) 💡 [PIM for Groups](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/concept-pim-for-groups) 💡 [Configure Approve or Deny Request for AD Roles in PIM](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-approval-workflow) 💡 [Azure Security Benchmark Defender for Identity](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/defender-for-identity-security-baseline) |\r\n| | 1.5 Identity Federation & User Credentialing | Entra ID - Certificate-Based Authorization (CBA) Entra ID - Guest Access | 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Entra ID - AAD Connect](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/GetStarted) 🔀 [Entra ID - Enterprise Apps](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null) 🔀 [Entra ID - Identity Governance](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_ERM/DashboardBlade/~/GettingStarted) | 💡 [Azure Governement - Planning Identity for Azure Government Apps](https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-plan-identity) 💡 [Federated Identity Credentials](https://learn.microsoft.com/en-us/graph/api/resources/federatedidentitycredentials-overview?view=graph-rest-1.0) 💡 [What is Hybrid Identity](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-hybrid-identity) 💡 [Azure AD Certificate Based Authentication](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-certificate-based-authentication) 💡 [Azure AD SCIM](https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups) 💡 [Provisioning with Google Cloud](https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on) 💡 [Provisioning with Amazon Cloud](https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/aws-single-sign-on-provisioning-tutorial) 💡 [Azure AD Application Roles](https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps) 💡 [What is Identity Governace?](https://learn.microsoft.com/en-us/azure/active-directory/governance/identity-governance-overview) |\r\n| | 1.6 Behavioral, Contextual ID, and Biometrics | Microsoft Sentinel UEBA Entra ID - Identity Protection | 🔀 [Azure Face APIs](https://portal.azure.us/#view/Microsoft_Azure_ProjectOxford/CognitiveServicesHub/~/Face) 🔀 [Sentinel - UEBA](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Verified ID](https://portal.azure.us/#view/Microsoft_AAD_DecentralizedIdentity/InitialMenuBlade/~/setupBlade) | 💡 [User Entity Behavorial Analytics - What is it?](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [Windows Hello Biometrics](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise) 💡 [Identify Advanced Threats with UEBA](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [UEBA Reference](https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference?WT.mc_id=AZ-MVP-5004810#ueba-enrichments) 💡 [UEBA Sentinel Content Hub](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/ueba-essentials-solution-now-available-in-content-hub/ba-p/3651074) 💡 [Guided UEBA Investigation Scenarios](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/guided-ueba-investigation-scenarios-to-empower-your-soc/ba-p/1857100) 💡 [Combatting Risky Sign-ins in Azure Active Directory](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/combatting-risky-sign-ins-in-azure-active-directory/ba-p/3724786) 💡 [Securing Workload Identities](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-workload-identity-risk) 💡 [Reprise99 UEBA](https://github.com/reprise99/Sentinel-Queries/tree/main/UEBA) |\r\n| | 1.7 Least Privileged Access | Entra ID - Permissions Azure Policy Entra ID - Privileged Identity Management (PIM) | 🔀 [Entra ID - Enterprise Apps](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null) 🔀 [Entra ID - Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) 🔀 [Entra ID - Identity Protection](https://portal.azure.us/#view/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/~/Overview) 🔀 [Microsoft Defender for Cloud Apps](https://security.microsoft.us/cloudapps/) 🔀 [Application Security Groupss](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FapplicationSecurityGroups) | 💡 [Implementing Least-Privileged Administrative Models](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models) 💡 [Enhance Application Security with Lease Privilege Access Controls](https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-least-privileged-access) 💡 [Identity Protection](https://techcommunity.microsoft.com/t5/itops-talk-blog/what-s-the-difference-between-azure-active-directory-identity/ba-p/1320887?WT.mc_id=itopstalk-newsletter-abartolo) 💡 [Continuous Access Evaluation Monitoring](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-continuous-access-evaluation-troubleshoot#continuous-access-evaluation-sign-in-reporting) |\r\n| | 1.8 Continuous Authentication | Entra ID - Continuous Access Evaluation (CAE) Entra ID - Privileged Identity Management (PIM) Entra ID - Identity Protection | 🔀 [Entra ID - Device Inventory](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Entra ID - Connect Sync (Hybrid Join)](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/ConnectSync) 🔀 [Entra ID - Enterprise Apps](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null) 🔀 [Entra ID - Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) 🔀 [Entra ID - Identity Governance](https://portal.azure.us/#view/Microsoft_AAD_ERM/DashboardBlade/~/GettingStarted) 🔀 [Entra ID - PIM Insights](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/aaddiscovery/resourceId//resourceType/tenant/provider/aadroles) | 💡 [Implement Continuous Access Evaluation Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation) 💡 [Implementing Primary Refresh Token](https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token) 💡 [Privileged Identity Management Insights](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-security-wizard#discovery-and-insights-preview) 💡 [Entra Permissions Managment](https://learn.microsoft.com/en-us/azure/active-directory/cloud-infrastructure-entitlement-management/permissions-management-trial-user-guide) 💡 [Session Management with Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime) |\r\n| | 1.9 Integrated ICAM Platform | Entra Entitlement Management Entra ID Certificate Based Authentication (CBA) | 🔀 [Entra ID - AuthN Methods](https://portal.azure.us/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods) 🔀 [Entra ID - AuthN Strengths](https://portal.azure.us/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthStrengths) 🔀 [Entra ID - AuthN Insights](https://portal.azure.us/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthMethodsActivity) 🔀 [Entra ID - Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) | 💡 [Microsoft Integrated Identity Platform Entra](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-overview) 💡 [Implement Passwordless Auth with Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/auth-passwordless) 💡 [Configure Passwordless Key with Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-security-key) 💡 [Entra Certificate Based Authorization](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-certificate-based-authentication) |\r\n| Device 2.x | | | | |\r\n| | 2.1 Device Inventory | Microsft Entra ID Microsft Entra ID Conditional Access (CA) Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Defender for Identity (MDI) Microsoft Intune | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_DeviceSettings/DevicesMenu/~/overview) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡[M365 Defender Device inventory](https://learn.microsoft.com/en-us/graph/api/resources/intune-graph-overview?view=graph-rest-1.0%22%20%EF%BF%BDHYPERLINK%20%22https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machines-view-overview?view=o365-worldwide) 💡[What is a device identity (Azure Active Directory)?](https://learn.microsoft.com/en-us/azure/active-directory/devices/overview) 💡[Manage device identities by using the Azure portal](https://learn.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal) 💡[Manage your devices and control features with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-devices) 💡[Hybrid Azure AD joined devices](https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-join-hybrid) 💡[Conditional Access policy: Device Compliancy](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡[ZT Guide: Endpoint Zero Trust Deployment Objectives](https://learn.microsoft.com/en-us/security/zero-trust/deploy/endpoints#endpoint-zero-trust-deployment-objectives) 💡[Intune Reporting](https://learn.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor) ** not yet availble in DoD cloud 💡[Provide Additional Intune Reporting](https://www.linkedin.com/pulse/provide-additional-intune-reporting-data-wmi-iren%C3%A4us-becker/) 💡[Working with Intune in Microsoft Graph](https://learn.microsoft.com/en-us/graph/api/resources/intune-graph-overview?view=graph-rest-1.0) |\r\n| | 2.2 Device Detection and Compliance | Entra ID Conditional Access (CA) Microsoft Defender for Endpoint (MDE) Microsoft Intune | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) | 💡[Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) 💡[Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) 💡[Configure Conditional Access in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) 💡[Scenarios for using Conditional Access with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access-intune-common-ways-use?source=recommendations) |\r\n| | 2.3 Device Authorization w/ Real Time Inspection | Microsft Entra ID Microsoft Intune Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡[Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) 💡[Device discovery overview](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-discovery?view=o365-worldwide) 💡[Learn about Conditional Access and Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) 💡[Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) 💡[Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance) 💡[Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡[Conditional Access insights and reporting workbook - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-insights-reporting) 💡[Plan an Azure Active Directory Conditional Access deployment - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access) 💡[Azure Samples for Conditional Access (PowerShell) - GitHub](https://github.com/Azure-Samples/azure-ad-conditional-access-apis/tree/main/01-configure/powershell)
Additional References: 💡[Track changes to system files and registry keys](https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview) 💡[Connect Microsoft Defender for Cloud alerts to Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-defender-for-cloud) 💡[Deploying and Managing Microsoft Defender for Cloud as Code](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/deploying-and-managing-microsoft-defender-for-cloud-as-code/ba-p/3649653) 💡[Collect data in custom log formats to Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-custom-logs?tabs=DCG) 💡[Azure Monitor Agent overview - Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview) 💡[Use entity behavior analytics to detect advanced threats](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics) |\r\n| | 2.4 Remote Access | Microsft Entra ID Microsft Entra ID Conditional Access (CA) Microsoft Intune Microsoft Defender for Endpoint (MDE) | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) | 💡[Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡[Conditional Access APIs and PowerShell - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-apis) 💡[Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) 💡[Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance) 💡[Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) 💡[Configure Conditional Access in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) 💡[Enhance security with the principle of least privilege](https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-least-privileged-access) 💡[Best practices for Azure AD roles](https://learn.microsoft.com/en-us/azure/active-directory/roles/best-practices) 💡[Least privileged roles by task in Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/roles/delegate-by-task) |\r\n| | 2.5 Partially & Fully Automated Asset, Vulnerability and Patch | Microsoft Intune Microsoft Endpoint Configuration Manager (MECM) Mircosoft Defender for Endpoint (MDE) Threat & Vulnerability Management (TVM) Azure Arc-enabled Servers Azure Automation | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Azure Arc](https://portal.azure.us/#view/Microsoft_Azure_HybridCompute/AzureArcCenterBlade/~/overview) | 💡 [What is Windows Update for Business?](https://learn.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb) 💡 [Microsoft Configuration Manager MECEM](https://learn.microsoft.com/en-us/mem/configmgr/core/understand/introduction) 💡 [Update rings for Windows 10 and later policy in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-10-update-rings?source=recommendations) 💡 [Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure) 💡 [Deploy software updates with Configuration Manager](https://learn.microsoft.com/en-us/mem/configmgr/sum/deploy-use/deploy-software-updates) 💡 [Use Intune to remediate vulnerabilities identified by Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/mem/intune/protect/atp-manage-vulnerabilities) 💡 [Remediate vulnerabilities (Defender for Endpoint)](https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-remediation?view=o365-worldwide) 💡 [Choose how to deliver updates for the Microsoft 365 Apps](https://learn.microsoft.com/en-us/deployoffice/fieldnotes/choose-how-to-deliver-updates) 💡 [Windows Release Health](https://learn.microsoft.com/en-us/windows/release-health/) 💡 [Manage updates and patches for your VMs](https://learn.microsoft.com/en-us/azure/automation/update-management/manage-updates-for-vm) 💡 [Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) |\r\n| | 2.6 Unified Endpoint Management (UEM) & Mobile Device Management (MDM) | Microsoft Intune Azure Arc-enabled Servers Azure Autiomation | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Azure Arc](https://portal.azure.us/#view/Microsoft_Azure_HybridCompute/AzureArcCenterBlade/~/overview) | 💡[What is Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/what-is-intune) 💡[Manage your devices and control device features in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-devices) 💡[Zero Trust with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/zero-trust-with-microsoft-intune) 💡[Supported operating systems and browsers in Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/supported-devices-browsers) 💡[Enrollment guide: Microsoft Intune enrollment](https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment) 💡[Manage iOS/iPadOS software update policies in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-ios) 💡[Manage macOS software update policies in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-macos) 💡[Microsoft Intune How-To Guides](https://learn.microsoft.com/en-us/mem/intune/#how-to-guides) 💡[What is Azure Arc-enabled servers?](https://learn.microsoft.com/en-us/azure/azure-arc/servers/overview) 💡[Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) |\r\n| | 2.7 Endpoint & Extended Detection & Response (EDR & XDR) | Microsoft 365 Defender Microsoft Defender for Endpoint (MDE) Microsoft Defednder for Identity (MDI) Microsoft Defender for Office 365 (MDO) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us) | 💡[What is Microsoft Defender for Endpoint?](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide) 💡[Zero Trust with Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/zero-trust-with-microsoft-defender-endpoint?view=o365-worldwide) 💡[What is Microsoft 365 Defender?](https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender?view=o365-worldwide) 💡[Zero Trust with Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/zero-trust-with-microsoft-365-defender?view=o365-worldwide) 💡[Overview of endpoint detection and response (EDR) with Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response?view=o365-worldwide) 💡[Implement Microsoft Sentinel and Microsoft 365 Defender for Zero Trust](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) 💡[Manage endpoint detection and response (EDR) policy for endpoint security in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-edr-policy) 💡[Set up your XDR tools](https://learn.microsoft.com/en-us/security/operations/setup-xdr-tools) 💡[Architect your Microsoft Sentinel workspace](https://learn.microsoft.com/en-us/security/operations/siem-workspace) 💡[Ingest data sources and configure incident detection in Sentinel](https://learn.microsoft.com/en-us/security/operations/ingest-data-sources) 💡[Respond to an incident using Microsoft Sentinel and Microsoft 365 Defender](https://learn.microsoft.com/en-us/security/operations/respond-incident) |\r\n| Application & Workload 3.x | | | | |\r\n| | 3.1 Application Inventory | Entra ID Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) Microsoft Intune | 🔀 [Entra ID Applications - Useage & Insights](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/EnterpriseApplicationsInsightsMenuBlade/~/ApplicationActivity) 🔀 [Application Security Groups](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FapplicationSecurityGroups) 🔀 [Microsoft Defender for Cloud Apps - Discovery](https://security.microsoft.us/cloudapps/discovery) 🔀 [Virtual Network Gateways](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FvirtualNetworkGateways) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Cloud Discovery Setup](https://learn.microsoft.com/en-us/defender-cloud-apps/set-up-cloud-discovery) 💡 [Deploy Intune Softare inventory & Security Policies](https://learn.microsoft.com/en-us/answers/questions/67892/can-we-use-intune-to-inventory-software-on-devices) 💡 [Configure Blocking Unwanted or Unapproved Applications](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus?view=o365-worldwide) 💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) 💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) 💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) 💡 [Active Directory Federation Services Health](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-health-adfs) 💡 [Azure Active Directory Application Audit](https://github.com/jsa2/AADAppAudit#azure-ad-application-analytics-solution) 💡 [Azure Active Directory Application Proxy](https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/what-is-application-proxy) 💡 [Using Microsoft Defender for Cloud Asset Inventory](https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory) 💡 [Working with Discovered Apps](https://learn.microsoft.com/en-us/defender-cloud-apps/discovered-apps) 💡 [Software Inventory](https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-software-inventory?view=o365-worldwide) |\r\n| | 3.2 Secure Software Development & Integration | Azure Policy Microsoft Defender for Cloud (MDfC) Microsoft Defender for Endpoint (MDE) | 🔀 [Azure DevOps](https://portal.azure.us/#view/AzureTfsExtension/OrganizationsTemplateBlade) 🔀 [Azure Dev Test Center](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.DevTestLab%2Flabs) 🔀 [Azure DevTest Lab](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.DevTestLab%2Flabs) 🔀 [Intune App Security](https://endpoint.microsoft.us) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | |\r\n| | 3.3 Software Risk Management | Microsoft Defender for Cloud Apps (MDA) Mircosoft Defender for Endpoint (MDE) Threat & Vulnerability Management (TVM) Microsoft Intune | 🔀 [Azure Enterprise Apps Portal](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview) 🔀 [Intune Application Security](https://endpoint.microsoft.us/#view/Microsoft_Intune_DeviceSettings/AppsMenu/~/overview) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Manage and Secure Apps In Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-apps) 💡 [App Protection Policies in Intune](https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy) 💡 [Microsoft Container Registry](https://mcr.microsoft.com/) 💡 [GitHub Actaion For Vulnerability Scanning](https://github.com/marketplace/actions/anchore-container-scan) 💡 [Code Scanning with CodeQL](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql) 💡 [Keeping your supply chain secure with Dependabot](https://docs.github.com/en/code-security/dependabot) 💡 [Secure Supply Chain Consumption Framework](https://www.microsoft.com/en-us/securityengineering/opensource/osssscframeworkguide) 💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) 💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) 💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) |\r\n| | 3.4 Resource Authorization & Integration | Entra ID Conditional Access (CA) Entra ID Application Proxy Azure Policy Entra ID Privilleged Identity Management (PIM) Microsoft 365 Defender Microsoft Intune Microsoft Defender for Cloud (MDfC) | 🔀 [Azure Identity Governance](https://portal.azure.us/#blade/Microsoft_AAD_ERM/DashboardBlade) 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Azure Application Proxy](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppProxy) 🔀 [Managed Service Identity](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/6f3afa5d-4b81-4f10-8806-fb75689672da/appId/c75517e9-05c9-49e9-9990-94f68b04ffc4) 🔀 [Intune Application Security](https://endpoint.microsoft.us/#view/Microsoft_Intune_DeviceSettings/AppsMenu/~/overview) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Deploy Microsoft Defender for Cloud - Enterprise Cloud Application Protection](https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction) 💡 [Configure Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/en-us/download/details.aspx?id=54431) 💡 [Deploying Application & Authorization Azure App Services](https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization) 💡 [How to create and deploy a custome Authorization Manager](https://learn.microsoft.com/en-us/dotnet/framework/wcf/extending/how-to-create-a-custom-authorization-manager-for-a-service) 💡 [Configure with Entra Identity Platform](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow) 💡 [How-to Manage Apps Remove User Access with Entra](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/methods-for-removing-user-access) 💡 [Setup Protecting Apps w. Entra Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps) 💡 [Role Based Access Control Configuration with Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control) |\r\n| | 3.5 Continuous Monitoring and Ongoing Authorizations | Entra ID - Conditional Access (CA) Microsoft Defender for Cloud Apps (MDA) Microsoft Senitnel Playbooks Entra ID - Privileged Identity Management (PIM) | 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [Application Insights](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.insights%2Fcomponents) 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Application Security Groups Portal](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FapplicationSecurityGroups) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) | 💡 [How-to-Build a Successful App Security Program](https://www.microsoft.com/en-us/security/blog/2021/03/29/how-to-build-a-successful-application-security-program/) 💡 [Setting up Hybrid Continuous Monitoring with Sentinel](https://learn.microsoft.com/en-us/azure/architecture/hybrid/hybrid-security-monitoring) 💡 [Deploy Adaptive Appliation Conrols Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls) 💡 [Configure Azure Security Management & Monitoring](https://learn.microsoft.com/en-us/azure/security/fundamentals/management-monitoring-overview) 💡 [Leverage Security Baselines for M365 Apps Enterprise](https://learn.microsoft.com/en-us/deployoffice/security/security-baseline) 💡 [Utilize Application Control for Windows](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/wdac) |\r\n| Data 4.x | | | | |\r\n| | 4.1 Data Catalog Risk Alignment | Purview Data Catalog Purview Data Map Microsoft Sentinel | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Azure Data Classification Service](https://portal.azure.us/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/30ea52ed-e5a7-4e51-a4ea-6c3b96a8be36/appId/7c99d979-3b9c-4342-97dd-3239678fb300) | 💡 [Create a Azrure Data Catalog](https://learn.microsoft.com/en-us/azure/data-catalog/data-catalog-get-started) 💡 [Use the Service Catalog](https://learn.microsoft.com/en-us/system-center/scsm/service-catalog?view=sc-sm-2022) 💡 [Azure Data Catalog FAQ](https://learn.microsoft.com/en-us/azure/data-catalog/data-catalog-frequently-asked-questions) 💡 [Establishing Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) 💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) 💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Set up Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) 💡 [Discover Data & Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) |\r\n| | 4.2 DoD Enterprise Data Governance | Purview Data Governance Purview Data Estate Insights Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Implement Microsoft Purview - IRM & Compliance - DoD Deployments](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) 💡 [Implement a Data Governance Maturity Model Framework](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) 💡 [Deploy Azure Data Governance](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) 💡 [Leverage Microsoft Defender for For Cloud Goverance Rules](https://learn.microsoft.com/en-us/azure/defender-for-cloud/governance-rules) 💡 [Implement Purview Data Governance](https://learn.microsoft.com/en-us/purview/?view=o365-worldwide) 💡 [Purview Data Lineage Machine Learning](https://learn.microsoft.com/en-us/samples/microsoft/purview-machine-learning-lineage-solution-accelerator/purview-machine-learning-lineage-solution-accelerator/) 💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Azure Collaboration Governance](https://learn.microsoft.com/en-us/microsoft-365/solutions/collaboration-governance-overview?view=o365-worldwide) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) 💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/en-us/azure/azure-sql/database/sql-insights-overview?view=azuresql) 💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) |\r\n| | 4.3 Data Labeling and Tagging | Purview Information Protection | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Create Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) 💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) 💡 [Deploy with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Utilize Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) 💡 [Use the Service Catalog](https://learn.microsoft.com/en-us/system-center/scsm/service-catalog?view=sc-sm-2022) |\r\n| | 4.4 Data Monitoring and Sensing | Purview Data Loss Protection (DLP) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) Microsoft Sentinel | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Azure Monitor Control Service](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/512ba5b8-8ced-42b9-8a94-c93befaf66a1/appId/e933bd07-d2ee-4f1d-933c-3752b819567b) | 💡 [Leverage Data Monitoring & Self Healing](https://learn.microsoft.com/en-us/compliance/assurance/assurance-monitoring-and-self-healing) 💡 [Deploy Microsoft 365 Monitorning](https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-monitoring?view=o365-worldwide) 💡 [Senitnel Data Collection Best Practices](https://learn.microsoft.com/en-us/azure/sentinel/best-practices-data) 💡 [Deploy Microsoft Purview](https://learn.microsoft.com/en-us/purview/purview) 💡 [Utilze Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Configure Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) 💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/en-us/azure/azure-sql/database/sql-insights-overview?view=azuresql) |\r\n| | 4.5 Data Encryption & Rights Management | Purview Data Loss Protection (DLP) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) | 🔀 [Azure Encryption](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/21426118-88fd-4b5e-b106-3bd5f098f31a/appId/dbc36ae1-c097-4df9-8d94-343c3d091a76) 🔀 [Azure Rights Management Service](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/5f0c1df8-5bab-4fb3-b1a5-19bdba46c704/appId/00000012-0000-0000-c000-000000000000) 🔀 [M365 Data At Rest Encryption](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/882ab41e-90f7-4f4e-8b24-3503495a83e6/appId/c066d759-24ae-40e7-a56f-027002b5d3e4) 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Utilize Azure Encrption](https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview) 💡 [Deploy Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Deploy Purview Information Protection](https://learn.microsoft.com/en-us/purview/information-protection) 💡 [Configure Dynamic Key & Encrption Delivery](https://learn.microsoft.com/en-us/azure/media-services/latest/drm-content-protection-concept) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) |\r\n| | 4.6 Data Loss Prevention (DLP) | Purview Data Loss Protection (DLP) Purview Information Protection | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Endpoint DLP](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/780e77f3-df11-4525-b201-973a1b691cab/appId/c98e5057-edde-4666-b301-186a01b4dc58) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Implement Data Loss & Prevention (DLP)](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp) 💡 [Informaiton Protection & Data Loss and Prevention- GITHUB LAB](https://microsoft.github.io/ComplianceCxE/dag/mip-dlp/) 💡 [Deploy Adaptive Protection- Data Loss & Protections](https://learn.microsoft.com/en-us/purview/dlp-adaptive-protection-learn) 💡 [Apply Rules for DLP Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/data-loss-prevention/dlp-rule-application) 💡 [Utilize Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) |\r\n| | 4.7 Data Access Control | Microsoft Defender for Cloud Apps (MDA) Entra ID Conditional Access (CA) Purview Insider Risk Management Purview Information Protection Purview Data Loss Prevention (DLP) Microsoft Intune | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Entra ID Privileged Identity Management](https://portal.azure.us/#blade/Microsoft_Azure_PIMCommon/CommonMenuBlade) 🔀 [Entra ID Conditional Access](https://portal.azure.us/#blade/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade) 🔀 [Azure Internal Access Scope Portal](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/a0779651-4c07-4392-a11f-a1694cb497b1/appId/c29427db-9ecc-4750-ad93-d256863f2e37) 🔀 [Virtual Network Terminal Access Points](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.network%2Fvirtualnetworktaps) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Azure Data Explorer](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Kusto%2Fclusters) | 💡 [Configure Conditional Access in Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview) 💡 [Use Conditional Access Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) 💡 [Use Conditional Access APIs](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-apis) 💡 [Deploy Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access#deploy-conditional-access-policies) 💡 [Use Conditional Access With Data Explorer](https://learn.microsoft.com/en-us/azure/data-explorer/security-conditional-access) 💡 [Deploy Common Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common?tabs=secure-foundation) 💡 [Build Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policies) |\r\n| Network & Environment 5.x | | | | |\r\n| | 5.1 Data Flow Mapping | Azure Monitor Net Insights Network Watcher Microsoft Defender for Endpoint (MDE) | 🔀 [Network Security Perimeters](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FnetworkSecurityPerimeters) 🔀 [Network Interfaces](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2Fnetworkinterfaces) 🔀 [Azure Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) 🔀 [Azure Firewall](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FazureFirewalls) 🔀 [Web Application Firewall](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FFrontDoorWebApplicationFirewallPolicies) 🔀 [DDoS Protection Plans](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FddosProtectionPlans) 🔀 [Firewall Manager](https://portal.azure.us/#view/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/~/firewallManagerOverview) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Use Data Flow Mapping Power Platform](https://learn.microsoft.com/en-us/power-query/dataflows/create-use) 💡 [User Azure Network Traffic Analytics](https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics) 💡 [Azure Blue Print ](https://learn.microsoft.com/en-us/azure/governance/blueprints/overview) 💡 [Leverage Azure Data Visualization with Data Explorer](https://learn.microsoft.com/en-us/azure/data-explorer/viz-overview) 💡 [Use Power Automate for Event Tagging](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-microsoft-flow?view=o365-worldwide) 💡 [Secure & Govern Workloads with Network-level Segmentation](https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/network-level-segmentation) 💡 [Deploy Software Defined Netoworking](https://learn.microsoft.com/en-us/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) 💡 [Manage Software Defined Netoworking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/manage-sdn) 💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) |\r\n| | 5.2 Software Defined Networking (SDN) | Secure Access Service Edge (SASE) Microsoft Network Secuirty Groups (NSG) Entra ID App Proxy | 🔀 [Manage Virtual Network](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks) 🔀 [Network Security Groups](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FNetworkSecurityGroups) 🔀 [Network Managers](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FnetworkManagers) 🔀 [Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) 🔀 [Network Security Perimeters](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FnetworkSecurityPerimeters) 🔀 [Entra App Proxy](https://portal.azure.us/#view/Microsoft_AAD_IAM/AppProxyOverviewBlade) | 💡 [Use Secure Access Service Edge SASE - Software Defined Networking Zero Trust](https://www.microsoft.com/en-us/security/business/security-101/what-is-sase) 💡 [Software Defined Network Monitoring using Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/software-defined-monitoring-using-automated-notebooks-and-azure/ba-p/2587775) 💡 [Plan Software Defined Netoworking](https://learn.microsoft.com/en-us/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) 💡 [Implementing Software Defined Networking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/) 💡 [Manage Software Detined Netoworking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/manage-sdn) 💡 [Deploy Software Defined Networking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/deploy/deploy-a-software-defined-network-infrastructure-using-scripts) 💡 [Secure the Network Controller](https://learn.microsoft.com/en-us/azure-stack/hci/manage/nc-security) 💡 [SDN for Win Server 2019 and 2022](https://learn.microsoft.com/en-us/windows-server/networking/sdn/sdn-whats-new) 💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) 💡 [IPV6 Config Interface](https://learn.microsoft.com/en-us/javascript/api/%40azure/arm-databoxedge-profile-2020-09-01-hybrid/ipv6config?view=azure-node-latest&wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Leverage IPV6 for Azure Virtual Networks](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Segementation Security Strategies](https://learn.microsoft.com/en-us/azure/well-architected/security/design-segmentation) 💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) 💡 [Utilize Microsoft Packet Monitor](https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon) |\r\n| | 5.3 Macro Segmentation | Azure Subscription Azure VNet(s) Azure VNet Manager Network Security Groups (NSG) Azure Firewall | 🔀 [Impletment Network Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) 🔀 [Azure Features for Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation#azure-features-for-segmentation) 🔀 [Network Service](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.HybridNetwork%2Fpublishers%2Fnetworkservicedesigngroups) 🔀 [Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) | 💡 [Impletment Network Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) 💡 [Azure Features for Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation#azure-features-for-segmentation) 💡 [Segementation Security Strategies](https://learn.microsoft.com/en-us/azure/well-architected/security/design-segmentation) 💡 [Network Service Designs](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.HybridNetwork%2Fpublishers%2Fnetworkservicedesigngroups) 💡 [Network Watcher](https://portal.azure.com/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) |\r\n| | 5.4 Micro Segmentation | Azure Security Groups (ASG) Entra ID App Proxy Microsoft Tunnel | 🔀 [Virtual Networks Termal Access Points](https://portal.azure.us/#view/HubsExtension/BrowseResourceBlade/resourceType/microsoft.network%2Fvirtualnetworktaps) 🔀 [Conditional Access](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Overview) 🔀 [Cloud Access Routers](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Orbital%2FcloudAccessRouters) 🔀 [Entra ID Conditional Access](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Overview) 🔀 [Azure Monitor Networks](https://portal.azure.us/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/networkInsights) 🔀 [Azure Connection Monitor](https://portal.azure.us/#view/Microsoft_Azure_FlowLog/ConnectionMonitorV2ViewModel) 🔀 [Azure Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview/menuId~/%7B%22target%22%3A%7B%7D%7D) | 💡 [Enabling JIT Access Controls](https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Conditional Access Block Access by Location](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-location?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Secure Networks with Zero Trust](https://learn.microsoft.com/en-us/security/zero-trust/deploy/networks) 💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation?wtmc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Microsoft Packet Monitor](https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon) |\r\n| Automation & Orchestration 6.x | | | | |\r\n| | 6.1 Policy Decision Point (PDP) & Policy Orchestration | Entra ID Conditional Access (CA) Azure Policy Azure Automation Azure ML Azure Firewall Microsoft Sentinel | 🔀 [Azure Automation](https://portal.azure.us/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/d2175af3-6958-4008-83ac-ac2b81eafac7/appId/fc75330b-179d-49af-87dd-3b1acf6827fa) 🔀 [Azure Machine Learning](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.MachineLearningServices%2Fworkspaces) 🔀 [Azure Policy](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyMenuBlade) 🔀 [Azure Virtual Desktop](https://portal.azure.us/#view/Microsoft_Azure_WVD/WvdManagerMenuBlade/~/overview) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) | 💡 [Visibility,Automation and Orchestration with Zero Trust](https://learn.microsoft.com/en-us/) 💡 [Azure Orchestration for Azure Security Policy](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/azure-policy-security-baseline) 💡 [Configuration Analyzer for Security Policies](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies?view=o365-worldwide) 💡 [Azure Automation Overview](https://learn.microsoft.com/en-us/azure/automation/overview) 💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/automation-security-baseline) 💡 [Azure Policy](https://learn.microsoft.com/en-us/azure/governance/policy/overview) 💡 [What is Azure Firewall?](https://learn.microsoft.com/en-us/azure/firewall/overview) 💡 [Apply Zero Trust principles to a hub virtual network in Azure](https://learn.microsoft.com/en-us/security/zero-trust/azure-infrastructure-networking) 💡 [Management of Role Permissions and Automation](https://learn.microsoft.com/en-us/azure/automation/automation-role-based-access-control) 💡 [Using Azure Machine Learning to assign roles](https://learn.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler) 💡 [Azure AD Seccurity Groups ML](https://learn.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler#use-azure-ad-security-groups-to-manage-workspace-access) |\r\n| | 6.2 Critical Process Automation | Microsoft Power Automate Azure Logic Apps Microsoft Sentinel Playbooks Microsoft 365 Defender Automated Investigation & Response | 🔀 [Azure Automation](https://portal.azure.us/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/d2175af3-6958-4008-83ac-ac2b81eafac7/appId/fc75330b-179d-49af-87dd-3b1acf6827fa) 🔀 [Microsoft Sentinel Automation Blade](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_Security_Insights/MainMenuBlade/~/Automationl) 🔀 [Azure Logic Apps Blade](https://portal.azure.us/?feature.msaljs=true#view/HubsExtension/BrowseResource/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Azure Automation Overview](https://learn.microsoft.com/en-us/azure/automation/overview) 💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/automation-security-baseline) 💡 [Visibility, Automation, and Orchestration with Zero Trust](https://learn.microsoft.com/en-us/) 💡 [Automation in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automation) 💡 [Automate Threat Response with Playbooks](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) 💡 [Automated Investigation & Response M365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) 💡 [Power Automate U.S Government](https://learn.microsoft.com/en-us/power-automate/us-govt) |\r\n| | 6.3 Machine Learning | Microsoft Sentinel Fusion ML Microsoft Sentinel Bring Your Own Machine Learning (BYOML) Microsoft Defender for Cloud (MDfC) Azure ML | 🔀 [Azure Machine Learning](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.MachineLearningServices%2Fworkspaces) 🔀 [Power Automate](https://make.gov.powerautomate.us/) 🔀 [Power Platform Admin Center](https://admin.appsplatform.us/) 🔀 [Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Defender for Cloud](https://portal.azure.us/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0) | 💡 [Advanced multistage attack detection in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/fusion) 💡 [Bring your own Machine Learning (ML) into Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/bring-your-own-ml) 💡 [Azure Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/?view=azureml-api-2) 💡 [Enterprise Security & Governance w. Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/concept-enterprise-security?view=azureml-api-2) 💡 [Azure Government Isolaiton Guidelines using AI & ML](https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-impact-level-5) 💡 [Quick Start Azure Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/tutorial-azure-ml-in-a-day?view=azureml-api-2) 💡 [Azure security baseline for Azure Machine Learning](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/machine-learning-security-baseline) |\r\n| | 6.4 Artificial Intelligence | Microsoft Sentinel Fusion ML Microsoft Sentinel Tailored AI Azure ML | 🔀 [Azure AI Services](https://portal.azure.us/#blade/Microsoft_Azure_ProjectOxford/CognitiveServicesHub) 🔀 [Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Defender for Cloud](https://portal.azure.us/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0) | 💡 [AI Security Services](https://learn.microsoft.com/en-us/azure/ai-services/security-features) 💡 [Senintel Automation](https://learn.microsoft.com/en-us/azure/sentinel/automation) 💡 [AI ID & Access Risk Based Controls](https://azure.microsoft.com/en-us/products/category/identity/) 💡 [Implement Sentinel & M365 Defender for XDR - AI Driven Zero Trust ](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) 💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) |\r\n| | 6.5 Security Orchestration, Automation & Response (SOAR) | Microsoft 365 Defender Automated investigation and response Microsoft Sentinel Playbooks Microsoft Defender for Cloud (MDfC) Azure Logic Apps | 🔀 [Sentinel SIEM-SOAR](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Logic Apps](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [Microsoft Defender for Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) | 💡 [Security Ochestration, Automation & Response (SOAR) In Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automation) 💡 [Sentinel SOAR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/how-to-use-azure-sentinel-for-incident-response-orchestration/ba-p/2242397) 💡 [Microsoft Sentinel SOAR Content Catalog](https://learn.microsoft.com/en-us/azure/sentinel/sentinel-soar-content) 💡 [Automate Threat Response with Playbooks in Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) 💡 [Automated investigation and response in Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) 💡 [Workflow Automation in Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation) 💡 [SOAR Best Practices](https://www.microsoft.com/en-us/security/business/security-101/what-is-soar#SOARbestpractices) 💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) |\r\n| | 6.6 API Standardization | Azure API Management Azure Monitor Log Analytics Azure Logic Apps Azure Policy | 🔀 [API Management Services](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.ApiManagement%2Fservice) 🔀 [API Connections](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Web%2Fconnections) 🔀 [API Playground](https://portal.azure.us/#blade/Microsoft_Azure_Resources/ArmPlayground) 🔀 [Azure Logic Apps](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Logic%2Fworkflows) | 💡 [Microsft API Management & Security](https://azure.microsoft.com/en-us/products/api-management/) 💡 [Mitigate OWASP Top 10 Security Threats Using Microsoft API Management](https://learn.microsoft.com/en-us/azure/api-management/mitigate-owasp-api-threats) 💡 [Security Baselines for API Management](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/api-management-security-baseline) 💡 [Secure and Compliant APIs for a Hybrid and Multi Cloud World](https://azure.microsoft.com/en-us/blog/secure-and-compliant-apis-for-a-hybrid-and-multi-cloud-world/) 💡 [Web API Design Best Practice](https://learn.microsoft.com/en-us/azure/architecture/best-practices/api-design) 💡 [Monitor & Protect Your APIs](https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-use-azure-monitor) |\r\n| | 6.7 Security Operations Center (SOC) & Incident Response (IR) | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) Microsoft 365 Defender | 🔀 [Sentinel SIEM-SOAR](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Logic Apps](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [Microsoft Defender for Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Security Operations In Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-security-operations) 💡 [Microsoft SOC Best Practices Landing Page](https://www.microsoft.com/en-us/security/business/security-101/what-is-a-security-operations-center-soc?ef_id=_k_ce7dcd6e8f2d1919667ca9a72f733870_k_&OCID=AIDcmmdamuj0pc_SEM__k_ce7dcd6e8f2d1919667ca9a72f733870_k_&msclkid=ce7dcd6e8f2d1919667ca9a72f733870) 💡 [Playbook for Modernizing Security Operations Centers](https://www.microsoft.com/en-us/security/blog/2021/02/11/a-playbook-for-modernizing-security-operations/) 💡 [CISO Series Lessons Learned from Microsoft's SOC](https://www.microsoft.com/en-us/security/blog/2019/10/07/ciso-series-lessons-learned-from-the-microsoft-soc-part-3a-choosing-soc-tools/) 💡 [Integrating Microsoft 365 Defender into your security operations](https://learn.microsoft.com/en-us/microsoft-365/security/defender/integrate-microsoft-365-defender-secops?view=o365-worldwide) |\r\n| Visibility & Analytics 7.x | | | | |\r\n| | 7.1 Log All Traffic (Network, Data, Apps, Users) | Azure Monitor Log Analytics Microsoft Sentinel | 🔀 [Log Analytics Workspace](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.OperationalInsights%2Fworkspaces) 🔀 [Log Query Packs](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.OperationalInsights%2Fquerypacks) 🔀 [Sign-in Activity Logs](https://portal.azure.us/#blade/Microsoft_AAD_IAM/SignInEventsV3Blade) 🔀 [Activity Logs](https://portal.azure.us/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/activityLog) 🔀 [Audit Log](https://portal.azure.us/#blade/Microsoft_AAD_IAM/AuditEventsV2PillsBlade) 🔀 [Operation Log](https://portal.azure.us/#blade/Microsoft_Azure_Resources/OperationLogsBlade) 🔀 [Microsoft Azure Log Search Alerts](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/c134d63b-957f-4cf7-8a34-d744aa8804df/appId/f6b60513-f290-450e-a2f3-9930de61c5e7) | 💡 [Azure Log Analytics](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-overview) 💡 [Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/overview) 💡 [Audit Logging and Monitoring](https://learn.microsoft.com/en-us/compliance/assurance/assurance-audit-logging) 💡 [Maturity Model for Log Management M2131](https://techcommunity.microsoft.com/t5/public-sector-blog/microsoft-sentinel-maturity-model-for-event-log-management-m-21/ba-p/3074336) 💡 [Device Log Capture - Intune](https://learn.microsoft.com/en-us/mem/intune/remote-actions/collect-diagnostics) 💡 [Application Logging](https://learn.microsoft.com/en-us/sql/relational-databases/performance/view-the-windows-application-log-windows-10?view=sql-server-ver16) 💡 [User Access Logging](https://learn.microsoft.com/en-us/windows-server/administration/user-access-logging/get-started-with-user-access-logging) 💡 [Azure Infrastructure Logs](https://learn.microsoft.com/en-us/azure/well-architected/scalability/monitor-infrastructure) 💡 [Network Logging](https://learn.microsoft.com/en-us/azure/azure-web-pubsub/howto-troubleshoot-network-trace) 💡 [Supported Logs for Network](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/supported-logs/microsoft-network-networkmanagers-logs) |\r\n| | 7.2 Security Information and Event Management (SIEM) | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) Microsoft 365 Defender | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Microsoft Defender for Cloud](https://portal.azure.us/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0) | 💡[Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/overview) 💡[Implement Sentinel & M365](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) 💡[Unified SIEM & XDR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-unified-microsoft-siem-and-xdr-github-community/ba-p/3249533) 💡[Stream Alerts Defender for Cloud to SIEM](https://learn.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem#stream-alerts-to-azure-sentinel) 💡[Azure Sentinel Github Repo](https://github.com/Azure/Azure-Sentinel) 💡[Sentinel & SOC Analysis Process](https://learn.microsoft.com/en-us/azure/sentinel/migration-security-operations-center-processes) 💡[Microsoft Sentinel Skill Up Training](https://learn.microsoft.com/en-us/azure/sentinel/skill-up-resources) |\r\n| | 7.3 Common Security and Risk Analytics | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Security Baselines](https://endpoint.microsoft.us/#home) | 💡[Microsoft Security Response Center Security Updates Guide](https://msrc.microsoft.com/update-guide) 💡[Explore Risks to Sensitive Data Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/data-security-review-risks) 💡[Identify & Analyze Risks Across Your Environment](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-attack-path) 💡[Cloud Security Posture Management](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management) 💡[Microsoft Cloud Security Benchmark](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-regulatory-compliance) |\r\n| | 7.4 User and Entity Behavior Analytics | Microsoft Sentinel UEBA Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Identity (MDI) Entra ID Conditional Access (CA) Purview Insider Risk Management | 🔀 [Behavior Analytics Insights](https://portal.azure.us/#@jubradfogov.onmicrosoft.us/asset/Microsoft_OperationsManagementSuite_Workspace/Solution/subscriptions/3ab4869f-acc9-49ec-a399-12efd162502f/resourceGroups/fedlogana/providers/Microsoft.OperationsManagement/solutions/BehaviorAnalyticsInsights(loganalytics) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [ID Threats with User and Entity Behavior Analytics](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [Enable Entity Behavior Analytics to Detect Threats](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics) 💡 [Microsoft Sentinel UEBA Reference](https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference) 💡 [Investigate Incidents with UEBA](https://learn.microsoft.com/en-us/azure/sentinel/investigate-with-ueba) 💡 [Discover and Protect Sensitive Information in your Organization](https://learn.microsoft.com/en-us/defender-cloud-apps/tutorial-dlp) 💡 [Purview Insider Risk Management](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) |\r\n| | 7.5 Threat Intelligence Integration | Microsoft Sentinel Threat Intelligence (TI) Microsoft Graph Security Indicators Microsoft Defender Threat Intelligence (MDTI) | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Microsoft Threat Intelligence Portal](https://ti.defender.microsoft.com/) | 💡[Microsoft Threat Intelligence](https://learn.microsoft.com/en-us/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti) 💡[Microsoft Security Graph API](https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview?view=graph-rest-beta) 💡[Create Threat Intelligence Indicators](https://learn.microsoft.com/en-us/graph/api/tiindicators-post?view=graph-rest-beta&tabs=http) 💡[Threat intelligence integration in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/threat-intelligence-integration) 💡[Bring Your Own Threat Intelligence Feeds](https://learn.microsoft.com/en-us/defender-cloud-apps/additional-integrations) 💡[Accessing the Threat Intelligence Portal](https://learn.microsoft.com/en-us/defender/threat-intelligence/learn-how-to-access-microsoft-defender-threat-intelligence-and-make-customizations-in-your-portal) |\r\n| | 7.6 Automated Dynamic Policies | Entra ID Protection Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel Fusion ML Microsoft Sentinel Bring Your Own Machine Learning (BYOML) Microsoft Sentinel Playbooks Microsoft Intune Azure Automation Purview Insider Risk Management | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Logic Apps](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Azure Automation](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/d2175af3-6958-4008-83ac-ac2b81eafac7/appId/fc75330b-179d-49af-87dd-3b1acf6827fa) 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) | 💡[Automate Threat Response with Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) 💡[Adaptive Protection - Microsoft Purview](https://www.microsoft.com/en-us/security/blog/2023/02/06/introducing-adaptive-protection-in-microsoft-purview-people-centric-data-protection-for-a-multiplatform-world/#:~:text=With%20Adaptive%20Protection%2C%20DLP%20policies%20become%20dynamic%2C%20ensuring,efficient%20and%20empowered%20to%20do%20more%20with%20less.) 💡[Adaptive Policy Scopes M365](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/using-adaptive-policy-scopes-to-apply-m365-retention-to-shared/ba-p/3053641#:~:text=Back%20in%20October,in%20Microsoft%20365.) 💡[Adaptive Application Controls](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls) 💡[AI-Driven Adaptive Device Controls Microsoft Defender for Endpoint](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/ai-driven-adaptive-protection-in-microsoft-defender-for-endpoint/ba-p/2966491) 💡[AI-Driven Adaptive Protection Against Human Operated Ransomeware](https://www.microsoft.com/en-us/security/blog/2021/11/15/ai-driven-adaptive-protection-against-human-operated-ransomware/) 💡[Microsoft Defender for Cloud Automated Security Posture Management](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management) 💡[Improve your network security posture with adaptive network hardening](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-network-hardening) 💡[What is Microsoft Entra ID Protection?](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection) 💡[Azure Automation update management](https://learn.microsoft.com/en-us/azure/architecture/hybrid/azure-update-mgmt) 💡[Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure) |"
},
"conditionalVisibility": {
"parameterName": "isess3Visible",
From a196fd345905f735a8fbbb53f99fc066add77951 Mon Sep 17 00:00:00 2001
From: "Chhorn Lim (MSFT)" <50709199+ChhornGLim@users.noreply.github.com>
Date: Fri, 15 Sep 2023 11:35:28 -0500
Subject: [PATCH 07/12] Removed remaining subscription-specific URL/link
---
Workbooks/DoDZeroTrustWorkbook.json | 100 ++++++++++++++--------------
1 file changed, 50 insertions(+), 50 deletions(-)
diff --git a/Workbooks/DoDZeroTrustWorkbook.json b/Workbooks/DoDZeroTrustWorkbook.json
index f4634ad5fc0..aee7b21a178 100644
--- a/Workbooks/DoDZeroTrustWorkbook.json
+++ b/Workbooks/DoDZeroTrustWorkbook.json
@@ -189,7 +189,7 @@
},
{
"id": "2b573101-8841-45a7-ac7a-7139c7d321a5",
- "cellValue": "https://www.microsoft.com/en-us/security/blog/2022/11/22/microsoft-supports-the-dods-zero-trust-strategy/",
+ "cellValue": "https://www.microsoft.com/security/blog/2022/11/22/microsoft-supports-the-dods-zero-trust-strategy/",
"linkTarget": "Url",
"linkLabel": "Microsoft supports the DoD’s Zero Trust strategy",
"style": "link"
@@ -1464,7 +1464,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [Microsoft Identity Platform Entra (formerly AAD)](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-overview) \r\n💡 [Microsoft Hybrid Identity with Entra/AAD/AD](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/) \r\n💡 [Using the Inventory in Secure Score - Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory) \r\n💡 [Identity Decision Guide](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/decision-guides/identity/) \r\n💡 [Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/en-us/download/details.aspx?id=54431) \r\n💡 [Identity Security Monitoring](https://github.com/Cloud-Architekt/AzureAD-Attack-Defense/blob/main/IdentitySecurityMonitoring.md#identity-security-monitoring-in-a-hybrid-environment) \r\n💡 [Collect Azure Active Directory (Azure AD) Logs](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics#send-logs-to-azure-monitor) \r\n💡 [Enable User Entity Behavorial Analytics](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics#how-to-enable-user-and-entity-behavior-analytics) \r\n💡 [Deploy Microsoft Defender for Identity](https://learn.microsoft.com/en-us/defender-for-identity/deploy-defender-identity) \r\n💡 [Secure with Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/secure-with-azure-ad-introduction) \r\n💡 [AAD Hybrid Identity](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/plan-hybrid-identity-design-considerations-overview?WT.mc_id=DT-MVP-5001664) \r\n💡 [Azure AD Reports](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/overview-reports?WT.mc_id=DT-MVP-5001664) \r\n💡 [B2B Collaboration](https://learn.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b?WT.mc_id=DT-MVP-5001664) \r\n\r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n💡 [Microsoft Identity Platform Entra (formerly AAD)](https://learn.microsoft.com/azure/active-directory/develop/v2-overview) \r\n💡 [Microsoft Hybrid Identity with Entra/AAD/AD](https://learn.microsoft.com/azure/active-directory/hybrid/) \r\n💡 [Using the Inventory in Secure Score - Microsoft Defender for Cloud](https://learn.microsoft.com/azure/defender-for-cloud/asset-inventory) \r\n💡 [Identity Decision Guide](https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/identity/) \r\n💡 [Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/download/details.aspx?id=54431) \r\n💡 [Identity Security Monitoring](https://github.com/Cloud-Architekt/AzureAD-Attack-Defense/blob/main/IdentitySecurityMonitoring.md#identity-security-monitoring-in-a-hybrid-environment) \r\n💡 [Collect Azure Active Directory (Azure AD) Logs](https://learn.microsoft.com/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics#send-logs-to-azure-monitor) \r\n💡 [Enable User Entity Behavorial Analytics](https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics#how-to-enable-user-and-entity-behavior-analytics) \r\n💡 [Deploy Microsoft Defender for Identity](https://learn.microsoft.com/defender-for-identity/deploy-defender-identity) \r\n💡 [Secure with Azure Active Directory](https://learn.microsoft.com/azure/active-directory/fundamentals/secure-with-azure-ad-introduction) \r\n💡 [AAD Hybrid Identity](https://learn.microsoft.com/azure/active-directory/hybrid/connect/plan-hybrid-identity-design-considerations-overview?WT.mc_id=DT-MVP-5001664) \r\n💡 [Azure AD Reports](https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports?WT.mc_id=DT-MVP-5001664) \r\n💡 [B2B Collaboration](https://learn.microsoft.com/azure/active-directory/external-identities/what-is-b2b?WT.mc_id=DT-MVP-5001664) \r\n\r\n\r\n"
},
"customWidth": "33",
"name": "text - 9"
@@ -1812,7 +1812,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [What is Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview) \r\n💡 [Conditional Access Learning Path](https://learn.microsoft.com/en-us/training/modules/plan-implement-administer-conditional-access/) \r\n💡 [Conditional Access Licensing- Need at least AADP1](https://www.microsoft.com/en-us/security/business/identity-access/azure-active-directory-pricing?rtc=1) \r\n💡 [Conditional Access Design Principles](https://learn.microsoft.com/en-us/azure/architecture/guide/security/conditional-access-design) \r\n💡 [Templates -Secure Foundation & Work Toward ZT](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common) \r\n💡 [Conditional Access Trends and Changes](https://github.com/Cyberlorians/Workbooks/blob/main/ConditionalAccessTrendsandChanges.json) \r\n💡 [Implement Authentication Strengths](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/authentication-strength-choose-the-right-auth-method-for-your/ba-p/2365674) \r\n💡 [Intune Conditional Access](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) \r\n💡 [Using Locations in Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition) \r\n\r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n💡 [What is Conditional Access](https://learn.microsoft.com/azure/active-directory/conditional-access/overview) \r\n💡 [Conditional Access Learning Path](https://learn.microsoft.com/training/modules/plan-implement-administer-conditional-access/) \r\n💡 [Conditional Access Licensing- Need at least AADP1](https://www.microsoft.com/security/business/identity-access/azure-active-directory-pricing?rtc=1) \r\n💡 [Conditional Access Design Principles](https://learn.microsoft.com/azure/architecture/guide/security/conditional-access-design) \r\n💡 [Templates -Secure Foundation & Work Toward ZT](https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common) \r\n💡 [Conditional Access Trends and Changes](https://github.com/Cyberlorians/Workbooks/blob/main/ConditionalAccessTrendsandChanges.json) \r\n💡 [Implement Authentication Strengths](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/authentication-strength-choose-the-right-auth-method-for-your/ba-p/2365674) \r\n💡 [Intune Conditional Access](https://learn.microsoft.com/mem/intune/protect/conditional-access) \r\n💡 [Using Locations in Conditional Access Policies](https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition) \r\n\r\n\r\n"
},
"customWidth": "33",
"name": "text - 9"
@@ -2108,7 +2108,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [How MFA Works](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks) \r\n💡 [Setup Multifactor Authenication for Users M365](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) \r\n💡 [Configure the MFA Azure Active Directrory Registration Policies](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) \r\n💡 [Deploy Passwordless Solution](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-deployment) \r\n💡 [Configure Azure AD CBA](https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-certificate-based-authentication) \r\n💡 [Conditional Access Policy - MFA](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy?WT.mc_id=DT-MVP-5001664) \r\n💡 [Plan AAD MFA](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted?WT.mc_id=DT-MVP-5001664) "
+ "json": " \r\n \r\n## Resources\r\n💡 [How MFA Works](https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks) \r\n💡 [Setup Multifactor Authenication for Users M365](https://learn.microsoft.com/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) \r\n💡 [Configure the MFA Azure Active Directrory Registration Policies](https://learn.microsoft.com/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) \r\n💡 [Deploy Passwordless Solution](https://learn.microsoft.com/azure/active-directory/authentication/howto-authentication-passwordless-deployment) \r\n💡 [Configure Azure AD CBA](https://learn.microsoft.com/azure/active-directory/authentication/how-to-certificate-based-authentication) \r\n💡 [Conditional Access Policy - MFA](https://learn.microsoft.com/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy?WT.mc_id=DT-MVP-5001664) \r\n💡 [Plan AAD MFA](https://learn.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted?WT.mc_id=DT-MVP-5001664) "
},
"customWidth": "33",
"name": "text - 9"
@@ -2379,7 +2379,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [Plan a Privileged Identity Management Deployment](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-deployment-plan) \r\n💡 [privileged Identity Management - Why use it with Defender for O365?](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/use-privileged-identity-management-in-defender-for-office-365?view=o365-worldwide) \r\n💡 [Implementing PIM - Micrsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started) \r\n💡 [Secure Roadmap - PIM](https://learn.microsoft.com/en-us/azure/active-directory/roles/security-planning#use-azure-ad-privileged-identity-management) \r\n💡 [PIM for Groups](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/concept-pim-for-groups) \r\n💡 [PIM Compliancy with Sentinel](https://learnsentinel.blog/2021/07/26/enforce-pim-compliance-with-azure-sentinel-and-playbooks/) \r\n💡 [Configure Approve or Deny Request for AD Roles in PIM](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-approval-workflow) \r\n💡 [Azure Security Benchmark Defender for Identity](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/defender-for-identity-security-baseline) \r\n"
+ "json": " \r\n \r\n## Resources\r\n💡 [Plan a Privileged Identity Management Deployment](https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan) \r\n💡 [privileged Identity Management - Why use it with Defender for O365?](https://learn.microsoft.com/microsoft-365/security/office-365-security/use-privileged-identity-management-in-defender-for-office-365?view=o365-worldwide) \r\n💡 [Implementing PIM - Micrsoft Entra](https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-getting-started) \r\n💡 [Secure Roadmap - PIM](https://learn.microsoft.com/azure/active-directory/roles/security-planning#use-azure-ad-privileged-identity-management) \r\n💡 [PIM for Groups](https://learn.microsoft.com/azure/active-directory/privileged-identity-management/concept-pim-for-groups) \r\n💡 [PIM Compliancy with Sentinel](https://learnsentinel.blog/2021/07/26/enforce-pim-compliance-with-azure-sentinel-and-playbooks/) \r\n💡 [Configure Approve or Deny Request for AD Roles in PIM](https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-approval-workflow) \r\n💡 [Azure Security Benchmark Defender for Identity](https://learn.microsoft.com/security/benchmark/azure/baselines/defender-for-identity-security-baseline) \r\n"
},
"customWidth": "33",
"name": "text - 9"
@@ -2553,7 +2553,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [Azure Governement - Planning Identity for Azure Government Apps](https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-plan-identity) \r\n💡 [Federated Identity Credentials](https://learn.microsoft.com/en-us/graph/api/resources/federatedidentitycredentials-overview?view=graph-rest-1.0) \r\n💡 [What is Hybrid Identity](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-hybrid-identity) \r\n💡 [Azure AD Certificate Based Authentication](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-certificate-based-authentication) \r\n💡 [Azure AD SCIM](https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups) \r\n💡 [Provisioning with Google Cloud](https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on) \r\n💡 [Provisioning with Amazon Cloud](https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/aws-single-sign-on-provisioning-tutorial) \r\n💡 [Azure AD Application Roles](https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps) \r\n💡 [What is Identity Governace?](https://learn.microsoft.com/en-us/azure/active-directory/governance/identity-governance-overview) \r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n💡 [Azure Governement - Planning Identity for Azure Government Apps](https://learn.microsoft.com/azure/azure-government/documentation-government-plan-identity) \r\n💡 [Federated Identity Credentials](https://learn.microsoft.com/graph/api/resources/federatedidentitycredentials-overview?view=graph-rest-1.0) \r\n💡 [What is Hybrid Identity](https://learn.microsoft.com/azure/active-directory/hybrid/whatis-hybrid-identity) \r\n💡 [Azure AD Certificate Based Authentication](https://learn.microsoft.com/azure/active-directory/authentication/concept-certificate-based-authentication) \r\n💡 [Azure AD SCIM](https://learn.microsoft.com/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups) \r\n💡 [Provisioning with Google Cloud](https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on) \r\n💡 [Provisioning with Amazon Cloud](https://learn.microsoft.com/azure/active-directory/saas-apps/aws-single-sign-on-provisioning-tutorial) \r\n💡 [Azure AD Application Roles](https://learn.microsoft.com/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps) \r\n💡 [What is Identity Governace?](https://learn.microsoft.com/azure/active-directory/governance/identity-governance-overview) \r\n\r\n"
},
"customWidth": "33",
"name": "text - 9"
@@ -2853,7 +2853,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [User Entity Behavorial Analytics - What is it?](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) \r\n💡 [Windows Hello Biometrics](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise) \r\n💡 [Identify Advanced Threats with UEBA](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) \r\n💡 [UEBA Reference](https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference?WT.mc_id=AZ-MVP-5004810#ueba-enrichments) \r\n💡 [UEBA Sentinel Content Hub](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/ueba-essentials-solution-now-available-in-content-hub/ba-p/3651074) \r\n💡 [Guided UEBA Investigation Scenarios](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/guided-ueba-investigation-scenarios-to-empower-your-soc/ba-p/1857100) \r\n💡 [Combatting Risky Sign-ins in Azure Active Directory](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/combatting-risky-sign-ins-in-azure-active-directory/ba-p/3724786) \r\n💡 [Securing Workload Identities](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-workload-identity-risk) \r\n💡 [Reprise99 UEBA](https://github.com/reprise99/Sentinel-Queries/tree/main/UEBA) \r\n"
+ "json": " \r\n \r\n## Resources\r\n💡 [User Entity Behavorial Analytics - What is it?](https://learn.microsoft.com/azure/sentinel/identify-threats-with-entity-behavior-analytics) \r\n💡 [Windows Hello Biometrics](https://learn.microsoft.com/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise) \r\n💡 [Identify Advanced Threats with UEBA](https://learn.microsoft.com/azure/sentinel/identify-threats-with-entity-behavior-analytics) \r\n💡 [UEBA Reference](https://learn.microsoft.com/azure/sentinel/ueba-reference?WT.mc_id=AZ-MVP-5004810#ueba-enrichments) \r\n💡 [UEBA Sentinel Content Hub](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/ueba-essentials-solution-now-available-in-content-hub/ba-p/3651074) \r\n💡 [Guided UEBA Investigation Scenarios](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/guided-ueba-investigation-scenarios-to-empower-your-soc/ba-p/1857100) \r\n💡 [Combatting Risky Sign-ins in Azure Active Directory](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/combatting-risky-sign-ins-in-azure-active-directory/ba-p/3724786) \r\n💡 [Securing Workload Identities](https://learn.microsoft.com/azure/active-directory/identity-protection/concept-workload-identity-risk) \r\n💡 [Reprise99 UEBA](https://github.com/reprise99/Sentinel-Queries/tree/main/UEBA) \r\n"
},
"customWidth": "33",
"name": "text - 9"
@@ -3281,7 +3281,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [Implementing Least-privileged Administrative Models](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models) \r\n💡 [enhance Application Security with Lease Privilege Access Controls](https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-least-privileged-access) \r\n💡 [Identity Protection](https://techcommunity.microsoft.com/t5/itops-talk-blog/what-s-the-difference-between-azure-active-directory-identity/ba-p/1320887?WT.mc_id=itopstalk-newsletter-abartolo) \r\n💡 [Continuous Access Evaluation Monitoring](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-continuous-access-evaluation-troubleshoot#continuous-access-evaluation-sign-in-reporting) \r\n"
+ "json": " \r\n \r\n## Resources\r\n💡 [Implementing Least-privileged Administrative Models](https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models) \r\n💡 [enhance Application Security with Lease Privilege Access Controls](https://learn.microsoft.com/azure/active-directory/develop/secure-least-privileged-access) \r\n💡 [Identity Protection](https://techcommunity.microsoft.com/t5/itops-talk-blog/what-s-the-difference-between-azure-active-directory-identity/ba-p/1320887?WT.mc_id=itopstalk-newsletter-abartolo) \r\n💡 [Continuous Access Evaluation Monitoring](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-continuous-access-evaluation-troubleshoot#continuous-access-evaluation-sign-in-reporting) \r\n"
},
"customWidth": "33",
"name": "text - 9"
@@ -3552,7 +3552,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [Implement Continuous Access Evaluation Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation) \r\n💡 [Implementing Primary Refresh Token](https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token) \r\n💡 [Privileged Identity Management Insights](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-security-wizard#discovery-and-insights-preview) \r\n💡 [Entra Permissions Managment](https://learn.microsoft.com/en-us/azure/active-directory/cloud-infrastructure-entitlement-management/permissions-management-trial-user-guide) \r\n💡 [Session Management with Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime) \r\n"
+ "json": " \r\n \r\n## Resources\r\n💡 [Implement Continuous Access Evaluation Microsoft Entra](https://learn.microsoft.com/azure/active-directory/conditional-access/concept-continuous-access-evaluation) \r\n💡 [Implementing Primary Refresh Token](https://learn.microsoft.com/azure/active-directory/devices/concept-primary-refresh-token) \r\n💡 [Privileged Identity Management Insights](https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-security-wizard#discovery-and-insights-preview) \r\n💡 [Entra Permissions Managment](https://learn.microsoft.com/azure/active-directory/cloud-infrastructure-entitlement-management/permissions-management-trial-user-guide) \r\n💡 [Session Management with Conditional Access](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime) \r\n"
},
"customWidth": "33",
"name": "text - 9"
@@ -3755,7 +3755,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [Microsoft Integrated Identity Platform Entra](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-overview) \r\n💡 [Implement Passwordless Auth with Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/auth-passwordless) \r\n💡 [Configure Passwordless Key with Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-security-key) \r\n💡 [Entra Certificate Based Authorization](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-certificate-based-authentication) \r\n"
+ "json": " \r\n \r\n## Resources\r\n💡 [Microsoft Integrated Identity Platform Entra](https://learn.microsoft.com/azure/active-directory/develop/v2-overview) \r\n💡 [Implement Passwordless Auth with Microsoft Entra](https://learn.microsoft.com/azure/active-directory/fundamentals/auth-passwordless) \r\n💡 [Configure Passwordless Key with Microsoft Entra](https://learn.microsoft.com/azure/active-directory/authentication/howto-authentication-passwordless-security-key) \r\n💡 [Entra Certificate Based Authorization](https://learn.microsoft.com/azure/active-directory/authentication/concept-certificate-based-authentication) \r\n"
},
"customWidth": "33",
"name": "text - 9"
@@ -4823,7 +4823,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [M365 Defender Device inventory](https://learn.microsoft.com/en-us/graph/api/resources/intune-graph-overview?view=graph-rest-1.0%22%20%EF%BF%BDHYPERLINK%20%22https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machines-view-overview?view=o365-worldwide) \r\n💡 [What is a device identity (Azure Active Directory)?](https://learn.microsoft.com/en-us/azure/active-directory/devices/overview) \r\n💡 [Manage device identities by using the Azure portal](https://learn.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal) \r\n💡 [Manage your devices and control features with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-devices) \r\n💡 [Hybrid Azure AD joined devices](https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-join-hybrid) \r\n💡 [Conditional Access policy: Device Compliancy](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) \r\n💡 [ZT Guide: Endpoint Zero Trust Deployment Objectives](https://learn.microsoft.com/en-us/security/zero-trust/deploy/endpoints#endpoint-zero-trust-deployment-objectives) \r\n💡 [Intune Reporting](https://learn.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor) ** not yet availble in DoD cloud \r\n💡 [Provide Additional Intune Reporting](https://www.linkedin.com/pulse/provide-additional-intune-reporting-data-wmi-iren%C3%A4us-becker/) \r\n💡 [Working with Intune in Microsoft Graph](https://learn.microsoft.com/en-us/graph/api/resources/intune-graph-overview?view=graph-rest-1.0) \r\n"
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [M365 Defender Device inventory](https://learn.microsoft.com/graph/api/resources/intune-graph-overview?view=graph-rest-1.0%22%20%EF%BF%BDHYPERLINK%20%22https://learn.microsoft.com/microsoft-365/security/defender-endpoint/machines-view-overview?view=o365-worldwide) \r\n💡 [What is a device identity (Azure Active Directory)?](https://learn.microsoft.com/azure/active-directory/devices/overview) \r\n💡 [Manage device identities by using the Azure portal](https://learn.microsoft.com/azure/active-directory/devices/device-management-azure-portal) \r\n💡 [Manage your devices and control features with Microsoft Intune](https://learn.microsoft.com/mem/intune/fundamentals/manage-devices) \r\n💡 [Hybrid Azure AD joined devices](https://learn.microsoft.com/azure/active-directory/devices/concept-azure-ad-join-hybrid) \r\n💡 [Conditional Access policy: Device Compliancy](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) \r\n💡 [ZT Guide: Endpoint Zero Trust Deployment Objectives](https://learn.microsoft.com/security/zero-trust/deploy/endpoints#endpoint-zero-trust-deployment-objectives) \r\n💡 [Intune Reporting](https://learn.microsoft.com/mem/intune/fundamentals/review-logs-using-azure-monitor) ** not yet availble in DoD cloud \r\n💡 [Provide Additional Intune Reporting](https://www.linkedin.com/pulse/provide-additional-intune-reporting-data-wmi-iren%C3%A4us-becker/) \r\n💡 [Working with Intune in Microsoft Graph](https://learn.microsoft.com/graph/api/resources/intune-graph-overview?view=graph-rest-1.0) \r\n"
},
"customWidth": "33",
"name": "text - 6"
@@ -5123,7 +5123,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Device compliance policies in Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) \r\n💡 [Configure Microsoft Defender for Endpoint in Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) \r\n💡 [Configure Conditional Access in Microsoft Defender for Endpoint | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) \r\n💡 [Scenarios for using Conditional Access with Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access-intune-common-ways-use?source=recommendations)\r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Device compliance policies in Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/mem/intune/protect/device-compliance-get-started) \r\n💡 [Configure Microsoft Defender for Endpoint in Intune | Microsoft Learn](https://learn.microsoft.com/mem/intune/protect/advanced-threat-protection-configure) \r\n💡 [Configure Conditional Access in Microsoft Defender for Endpoint | Microsoft Learn](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) \r\n💡 [Scenarios for using Conditional Access with Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/mem/intune/protect/conditional-access-intune-common-ways-use?source=recommendations)\r\n\r\n"
},
"customWidth": "33",
"name": "text - 6"
@@ -5276,7 +5276,7 @@
{
"type": 1,
"content": {
- "json": "
\r\n## Resources\r\n\r\n💡 [Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) \r\n💡 [Device discovery overview](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-discovery?view=o365-worldwide) \r\n💡 [Learn about Conditional Access and Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) \r\n💡 [Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) \r\n💡 [Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance) \r\n💡 [Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) \r\n💡 [Conditional Access insights and reporting workbook - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-insights-reporting) \r\n💡 [Plan an Azure Active Directory Conditional Access deployment - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access) \r\n💡 [Azure Samples for Conditional Access (PowerShell) - GitHub](https://github.com/Azure-Samples/azure-ad-conditional-access-apis/tree/main/01-configure/powershell) \r\n \r\n#### Additional References: \r\n💡 [Track changes to system files and registry keys](https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview) \r\n💡 [Connect Microsoft Defender for Cloud alerts to Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-defender-for-cloud) \r\n💡 [Deploying and Managing Microsoft Defender for Cloud as Code](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/deploying-and-managing-microsoft-defender-for-cloud-as-code/ba-p/3649653) \r\n💡 [Collect data in custom log formats to Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-custom-logs?tabs=DCG) \r\n💡 [Azure Monitor Agent overview - Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview) \r\n💡 [Use entity behavior analytics to detect advanced threats](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics) "
+ "json": "
\r\n## Resources\r\n\r\n💡 [Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/mem/intune/protect/advanced-threat-protection-configure) \r\n💡 [Device discovery overview](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/device-discovery?view=o365-worldwide) \r\n💡 [Learn about Conditional Access and Intune](https://learn.microsoft.com/mem/intune/protect/conditional-access) \r\n💡 [Device compliance policies in Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/device-compliance-get-started) \r\n💡 [Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/actions-for-noncompliance) \r\n💡 [Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) \r\n💡 [Conditional Access insights and reporting workbook - Microsoft Entra](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-insights-reporting) \r\n💡 [Plan an Azure Active Directory Conditional Access deployment - Microsoft Entra](https://learn.microsoft.com/azure/active-directory/conditional-access/plan-conditional-access) \r\n💡 [Azure Samples for Conditional Access (PowerShell) - GitHub](https://github.com/Azure-Samples/azure-ad-conditional-access-apis/tree/main/01-configure/powershell) \r\n \r\n#### Additional References: \r\n💡 [Track changes to system files and registry keys](https://learn.microsoft.com/azure/defender-for-cloud/file-integrity-monitoring-overview) \r\n💡 [Connect Microsoft Defender for Cloud alerts to Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud) \r\n💡 [Deploying and Managing Microsoft Defender for Cloud as Code](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/deploying-and-managing-microsoft-defender-for-cloud-as-code/ba-p/3649653) \r\n💡 [Collect data in custom log formats to Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/connect-custom-logs?tabs=DCG) \r\n💡 [Azure Monitor Agent overview - Azure Monitor](https://learn.microsoft.com/azure/azure-monitor/agents/agents-overview) \r\n💡 [Use entity behavior analytics to detect advanced threats](https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics) "
},
"customWidth": "33",
"name": "text - 6"
@@ -5531,7 +5531,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) \r\n💡 [Conditional Access APIs and PowerShell - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-apis) \r\n💡 [Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) \r\n💡 [Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance) \r\n💡 [Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) \r\n💡 [Configure Conditional Access in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) \r\n💡 [Enhance security with the principle of least privilege](https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-least-privileged-access) \r\n💡 [Best practices for Azure AD roles](https://learn.microsoft.com/en-us/azure/active-directory/roles/best-practices) \r\n💡 [Least privileged roles by task in Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/roles/delegate-by-task) \r\n\r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) \r\n💡 [Conditional Access APIs and PowerShell - Microsoft Entra](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-apis) \r\n💡 [Device compliance policies in Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/device-compliance-get-started) \r\n💡 [Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/actions-for-noncompliance) \r\n💡 [Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/mem/intune/protect/advanced-threat-protection-configure) \r\n💡 [Configure Conditional Access in Microsoft Defender for Endpoint](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) \r\n💡 [Enhance security with the principle of least privilege](https://learn.microsoft.com/azure/active-directory/develop/secure-least-privileged-access) \r\n💡 [Best practices for Azure AD roles](https://learn.microsoft.com/azure/active-directory/roles/best-practices) \r\n💡 [Least privileged roles by task in Azure Active Directory](https://learn.microsoft.com/azure/active-directory/roles/delegate-by-task) \r\n\r\n\r\n"
},
"customWidth": "33",
"name": "text - 6"
@@ -5625,7 +5625,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [What is Windows Update for Business?](https://learn.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb) \r\n💡 [Microsoft Configuration Manager MECEM](https://learn.microsoft.com/en-us/mem/configmgr/core/understand/introduction) \r\n💡 [Update rings for Windows 10 and later policy in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-10-update-rings?source=recommendations) \r\n💡 [Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure) \r\n💡 [Deploy software updates with Configuration Manager](https://learn.microsoft.com/en-us/mem/configmgr/sum/deploy-use/deploy-software-updates) \r\n💡 [Use Intune to remediate vulnerabilities identified by Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/mem/intune/protect/atp-manage-vulnerabilities) \r\n💡 [Remediate vulnerabilities (Defender for Endpoint)](https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-remediation?view=o365-worldwide) \r\n💡 [Choose how to deliver updates for the Microsoft 365 Apps](https://learn.microsoft.com/en-us/deployoffice/fieldnotes/choose-how-to-deliver-updates) \r\n💡 [Windows Release Health](https://learn.microsoft.com/en-us/windows/release-health/) \r\n💡 [Manage updates and patches for your VMs](https://learn.microsoft.com/en-us/azure/automation/update-management/manage-updates-for-vm) \r\n💡 [Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) \r\n"
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [What is Windows Update for Business?](https://learn.microsoft.com/windows/deployment/update/waas-manage-updates-wufb) \r\n💡 [Microsoft Configuration Manager MECEM](https://learn.microsoft.com/mem/configmgr/core/understand/introduction) \r\n💡 [Update rings for Windows 10 and later policy in Intune](https://learn.microsoft.com/mem/intune/protect/windows-10-update-rings?source=recommendations) \r\n💡 [Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/mem/intune/protect/windows-update-for-business-configure) \r\n💡 [Deploy software updates with Configuration Manager](https://learn.microsoft.com/mem/configmgr/sum/deploy-use/deploy-software-updates) \r\n💡 [Use Intune to remediate vulnerabilities identified by Microsoft Defender for Endpoint](https://learn.microsoft.com/mem/intune/protect/atp-manage-vulnerabilities) \r\n💡 [Remediate vulnerabilities (Defender for Endpoint)](https://learn.microsoft.com/microsoft-365/security/defender-vulnerability-management/tvm-remediation?view=o365-worldwide) \r\n💡 [Choose how to deliver updates for the Microsoft 365 Apps](https://learn.microsoft.com/deployoffice/fieldnotes/choose-how-to-deliver-updates) \r\n💡 [Windows Release Health](https://learn.microsoft.com/windows/release-health/) \r\n💡 [Manage updates and patches for your VMs](https://learn.microsoft.com/azure/automation/update-management/manage-updates-for-vm) \r\n💡 [Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) \r\n"
},
"customWidth": "33",
"name": "text - 6"
@@ -5767,7 +5767,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [What is Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/what-is-intune) \r\n💡 [Manage your devices and control device features in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-devices) \r\n💡 [Zero Trust with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/zero-trust-with-microsoft-intune) \r\n💡 [Supported operating systems and browsers in Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/supported-devices-browsers) \r\n💡 [Enrollment guide: Microsoft Intune enrollment](https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment) \r\n💡 [Manage iOS/iPadOS software update policies in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-ios) \r\n💡 [Manage macOS software update policies in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-macos) \r\n💡 [Microsoft Intune How-To Guides](https://learn.microsoft.com/en-us/mem/intune/#how-to-guides) \r\n💡 [What is Azure Arc-enabled servers?](https://learn.microsoft.com/en-us/azure/azure-arc/servers/overview) \r\n💡 [Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) \r\n\r\n\r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [What is Microsoft Intune](https://learn.microsoft.com/mem/intune/fundamentals/what-is-intune) \r\n💡 [Manage your devices and control device features in Microsoft Intune](https://learn.microsoft.com/mem/intune/fundamentals/manage-devices) \r\n💡 [Zero Trust with Microsoft Intune](https://learn.microsoft.com/mem/intune/fundamentals/zero-trust-with-microsoft-intune) \r\n💡 [Supported operating systems and browsers in Intune](https://learn.microsoft.com/mem/intune/fundamentals/supported-devices-browsers) \r\n💡 [Enrollment guide: Microsoft Intune enrollment](https://learn.microsoft.com/mem/intune/fundamentals/deployment-guide-enrollment) \r\n💡 [Manage iOS/iPadOS software update policies in Intune](https://learn.microsoft.com/mem/intune/protect/software-updates-ios) \r\n💡 [Manage macOS software update policies in Intune](https://learn.microsoft.com/mem/intune/protect/software-updates-macos) \r\n💡 [Microsoft Intune How-To Guides](https://learn.microsoft.com/mem/intune/#how-to-guides) \r\n💡 [What is Azure Arc-enabled servers?](https://learn.microsoft.com/azure/azure-arc/servers/overview) \r\n💡 [Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) \r\n\r\n\r\n\r\n"
},
"customWidth": "33",
"name": "text - 6"
@@ -5911,7 +5911,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [What is Microsoft Defender for Endpoint?](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide) \r\n💡 [Zero Trust with Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/zero-trust-with-microsoft-defender-endpoint?view=o365-worldwide) \r\n💡 [What is Microsoft 365 Defender?](https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender?view=o365-worldwide) \r\n💡 [Zero Trust with Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/zero-trust-with-microsoft-365-defender?view=o365-worldwide) \r\n💡 [Overview of endpoint detection and response (EDR) with Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response?view=o365-worldwide) \r\n💡 [Implement Microsoft Sentinel and Microsoft 365 Defender for Zero Trust](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) \r\n💡 [Manage endpoint detection and response (EDR) policy for endpoint security in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-edr-policy) \r\n💡 [Set up your XDR tools](https://learn.microsoft.com/en-us/security/operations/setup-xdr-tools) \r\n💡 [Architect your Microsoft Sentinel workspace](https://learn.microsoft.com/en-us/security/operations/siem-workspace) \r\n💡 [Ingest data sources and configure incident detection in Sentinel](https://learn.microsoft.com/en-us/security/operations/ingest-data-sources) \r\n💡 [Respond to an incident using Microsoft Sentinel and Microsoft 365 Defender](https://learn.microsoft.com/en-us/security/operations/respond-incident) \r\n\r\n\r\n\r\n\r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [What is Microsoft Defender for Endpoint?](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide) \r\n💡 [Zero Trust with Microsoft Defender for Endpoint](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/zero-trust-with-microsoft-defender-endpoint?view=o365-worldwide) \r\n💡 [What is Microsoft 365 Defender?](https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender?view=o365-worldwide) \r\n💡 [Zero Trust with Microsoft 365 Defender](https://learn.microsoft.com/microsoft-365/security/defender/zero-trust-with-microsoft-365-defender?view=o365-worldwide) \r\n💡 [Overview of endpoint detection and response (EDR) with Microsoft 365 Defender](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response?view=o365-worldwide) \r\n💡 [Implement Microsoft Sentinel and Microsoft 365 Defender for Zero Trust](https://learn.microsoft.com/security/operations/siem-xdr-overview) \r\n💡 [Manage endpoint detection and response (EDR) policy for endpoint security in Intune](https://learn.microsoft.com/mem/intune/protect/endpoint-security-edr-policy) \r\n💡 [Set up your XDR tools](https://learn.microsoft.com/security/operations/setup-xdr-tools) \r\n💡 [Architect your Microsoft Sentinel workspace](https://learn.microsoft.com/security/operations/siem-workspace) \r\n💡 [Ingest data sources and configure incident detection in Sentinel](https://learn.microsoft.com/security/operations/ingest-data-sources) \r\n💡 [Respond to an incident using Microsoft Sentinel and Microsoft 365 Defender](https://learn.microsoft.com/security/operations/respond-incident) \r\n\r\n\r\n\r\n\r\n\r\n"
},
"customWidth": "33",
"name": "text - 6"
@@ -6699,7 +6699,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [Cloud Discovery Setup](https://learn.microsoft.com/en-us/defender-cloud-apps/set-up-cloud-discovery) \r\n💡 [Deploy Intune Softare inventory & Security Policies](https://learn.microsoft.com/en-us/answers/questions/67892/can-we-use-intune-to-inventory-software-on-devices) \r\n💡 [Configure Blocking Unwanted or Unapproved Applications](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus?view=o365-worldwide) \r\n💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) \r\n💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) \r\n💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) \r\n💡 [Active Directory Federation Services Health](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-health-adfs) \r\n💡 [Azure Active Directory Application Audit](https://github.com/jsa2/AADAppAudit#azure-ad-application-analytics-solution) \r\n💡 [Azure Active Directory Application Proxy](https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/what-is-application-proxy) \r\n💡 [Using Microsoft Defender for Cloud Asset Inventory](https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory) \r\n💡 [Working with Discovered Apps](https://learn.microsoft.com/en-us/defender-cloud-apps/discovered-apps) \r\n💡 [Software Inventory](https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-software-inventory?view=o365-worldwide) \r\n"
+ "json": " \r\n \r\n## Resources\r\n💡 [Cloud Discovery Setup](https://learn.microsoft.com/defender-cloud-apps/set-up-cloud-discovery) \r\n💡 [Deploy Intune Softare inventory & Security Policies](https://learn.microsoft.com/answers/questions/67892/can-we-use-intune-to-inventory-software-on-devices) \r\n💡 [Configure Blocking Unwanted or Unapproved Applications](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus?view=o365-worldwide) \r\n💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) \r\n💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) \r\n💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) \r\n💡 [Active Directory Federation Services Health](https://learn.microsoft.com/azure/active-directory/hybrid/connect/how-to-connect-health-adfs) \r\n💡 [Azure Active Directory Application Audit](https://github.com/jsa2/AADAppAudit#azure-ad-application-analytics-solution) \r\n💡 [Azure Active Directory Application Proxy](https://learn.microsoft.com/azure/active-directory/app-proxy/what-is-application-proxy) \r\n💡 [Using Microsoft Defender for Cloud Asset Inventory](https://learn.microsoft.com/azure/defender-for-cloud/asset-inventory) \r\n💡 [Working with Discovered Apps](https://learn.microsoft.com/defender-cloud-apps/discovered-apps) \r\n💡 [Software Inventory](https://learn.microsoft.com/microsoft-365/security/defender-vulnerability-management/tvm-software-inventory?view=o365-worldwide) \r\n"
},
"customWidth": "33",
"name": "text - 9"
@@ -6810,7 +6810,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [DoD CIO DevSecOps with IaC & Microsoft](https://dodcio.defense.gov/Portals/0/Documents/Library/DoDRefDesignCloudGithub.pdf?ver=zXJ_uO5LfouVaysHo5Ejsw%3d%3d) \r\n💡 [Microsoft Secure DevSecOps](https://www.microsoft.com/en-us/securityengineering/sdl/) \r\n💡 [Application Security & DevSecOps Security](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/organize/cloud-security-application-security-devsecops?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=eb8cd3d8eb27486d87bbb4d96d996220) \r\n💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) \r\n💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) \r\n💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) \r\n💡 [Azure AI Content Moderator API Security](https://learn.microsoft.com/en-us/azure/ai-services/content-moderator/overview)\r\n\r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n💡 [DoD CIO DevSecOps with IaC & Microsoft](https://dodcio.defense.gov/Portals/0/Documents/Library/DoDRefDesignCloudGithub.pdf?ver=zXJ_uO5LfouVaysHo5Ejsw%3d%3d) \r\n💡 [Microsoft Secure DevSecOps](https://www.microsoft.com/securityengineering/sdl/) \r\n💡 [Application Security & DevSecOps Security](https://learn.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-application-security-devsecops?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=eb8cd3d8eb27486d87bbb4d96d996220) \r\n💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) \r\n💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) \r\n💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) \r\n💡 [Azure AI Content Moderator API Security](https://learn.microsoft.com/azure/ai-services/content-moderator/overview)\r\n\r\n\r\n"
},
"customWidth": "33",
"name": "text - 9"
@@ -6982,7 +6982,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [Manage and Secure Apps In Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-apps) \r\n💡 [App Protection Policies in Intune](https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy) \r\n💡 [Microsoft Container Registry](https://mcr.microsoft.com/) \r\n💡 [GitHub Actaion For Vulnerability Scanning](https://github.com/marketplace/actions/anchore-container-scan) \r\n💡 [Code Scanning with CodeQL](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql) \r\n💡 [Keeping your supply chain secure with Dependabot](https://docs.github.com/en/code-security/dependabot) \r\n💡 [Secure Supply Chain Consumption Framework](https://www.microsoft.com/en-us/securityengineering/opensource/osssscframeworkguide) \r\n💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) \r\n💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) \r\n💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) \r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n💡 [Manage and Secure Apps In Intune](https://learn.microsoft.com/mem/intune/fundamentals/manage-apps) \r\n💡 [App Protection Policies in Intune](https://learn.microsoft.com/mem/intune/apps/app-protection-policy) \r\n💡 [Microsoft Container Registry](https://mcr.microsoft.com/) \r\n💡 [GitHub Actaion For Vulnerability Scanning](https://github.com/marketplace/actions/anchore-container-scan) \r\n💡 [Code Scanning with CodeQL](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql) \r\n💡 [Keeping your supply chain secure with Dependabot](https://docs.github.com/en/code-security/dependabot) \r\n💡 [Secure Supply Chain Consumption Framework](https://www.microsoft.com/securityengineering/opensource/osssscframeworkguide) \r\n💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) \r\n💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) \r\n💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) \r\n\r\n"
},
"customWidth": "33",
"name": "text - 9"
@@ -7117,7 +7117,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [Deploy Microsoft Defender for Cloud - Enterprise Cloud Application Protection](https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction) \r\n💡 [Configure Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/en-us/download/details.aspx?id=54431) \r\n💡 [Deploying Application & Authorization Azure App Services](https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization) \r\n💡 [How to create and deploy a custome Authorization Manager](https://learn.microsoft.com/en-us/dotnet/framework/wcf/extending/how-to-create-a-custom-authorization-manager-for-a-service) \r\n💡 [Configure with Entra Identity Platform](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow) \r\n💡 [How-to Manage Apps Remove User Access with Entra](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/methods-for-removing-user-access) \r\n💡 [Setup Protecting Apps w. Entra Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps) \r\n💡 [Role Based Access Control Configuration with Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control) \r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n💡 [Deploy Microsoft Defender for Cloud - Enterprise Cloud Application Protection](https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction) \r\n💡 [Configure Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/download/details.aspx?id=54431) \r\n💡 [Deploying Application & Authorization Azure App Services](https://learn.microsoft.com/azure/app-service/overview-authentication-authorization) \r\n💡 [How to create and deploy a custome Authorization Manager](https://learn.microsoft.com/dotnet/framework/wcf/extending/how-to-create-a-custom-authorization-manager-for-a-service) \r\n💡 [Configure with Entra Identity Platform](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow) \r\n💡 [How-to Manage Apps Remove User Access with Entra](https://learn.microsoft.com/azure/active-directory/manage-apps/methods-for-removing-user-access) \r\n💡 [Setup Protecting Apps w. Entra Conditional Access](https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps) \r\n💡 [Role Based Access Control Configuration with Intune](https://learn.microsoft.com/mem/intune/fundamentals/role-based-access-control) \r\n\r\n"
},
"customWidth": "33",
"name": "text - 9"
@@ -7302,7 +7302,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [How-to-Build a Successful App Security Program](https://www.microsoft.com/en-us/security/blog/2021/03/29/how-to-build-a-successful-application-security-program/) \r\n💡 [Setting up Hybrid Continuous Monitoring with Sentinel](https://learn.microsoft.com/en-us/azure/architecture/hybrid/hybrid-security-monitoring) \r\n💡 [Deploy Adaptive Appliation Conrols Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls) \r\n💡 [Configure Azure Security Management & Monitoring](https://learn.microsoft.com/en-us/azure/security/fundamentals/management-monitoring-overview) \r\n💡 [Leverage Security Baselines for M365 Apps Enterprise](https://learn.microsoft.com/en-us/deployoffice/security/security-baseline) \r\n💡 [Utilize Application Control for Windows](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/wdac) \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n💡 [How-to-Build a Successful App Security Program](https://www.microsoft.com/security/blog/2021/03/29/how-to-build-a-successful-application-security-program/) \r\n💡 [Setting up Hybrid Continuous Monitoring with Sentinel](https://learn.microsoft.com/azure/architecture/hybrid/hybrid-security-monitoring) \r\n💡 [Deploy Adaptive Appliation Conrols Microsoft Defender for Cloud](https://learn.microsoft.com/azure/defender-for-cloud/adaptive-application-controls) \r\n💡 [Configure Azure Security Management & Monitoring](https://learn.microsoft.com/azure/security/fundamentals/management-monitoring-overview) \r\n💡 [Leverage Security Baselines for M365 Apps Enterprise](https://learn.microsoft.com/deployoffice/security/security-baseline) \r\n💡 [Utilize Application Control for Windows](https://learn.microsoft.com/windows/security/application-security/application-control/windows-defender-application-control/wdac) \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n"
},
"customWidth": "33",
"name": "text - 9"
@@ -8540,7 +8540,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Create a Azrure Data Catalog](https://learn.microsoft.com/en-us/azure/data-catalog/data-catalog-get-started) \r\n💡 [Use the Service Catalog](https://learn.microsoft.com/en-us/system-center/scsm/service-catalog?view=sc-sm-2022) \r\n💡 [Azure Data Catalog FAQ](https://learn.microsoft.com/en-us/azure/data-catalog/data-catalog-frequently-asked-questions) \r\n💡 [Establishing Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) \r\n💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) \r\n💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) \r\n💡 [Set up Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) \r\n💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) \r\n💡 [Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) \r\n💡 [Discover Data & Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) \r\n\r\n\r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Create a Azrure Data Catalog](https://learn.microsoft.com/azure/data-catalog/data-catalog-get-started) \r\n💡 [Use the Service Catalog](https://learn.microsoft.com/system-center/scsm/service-catalog?view=sc-sm-2022) \r\n💡 [Azure Data Catalog FAQ](https://learn.microsoft.com/azure/data-catalog/data-catalog-frequently-asked-questions) \r\n💡 [Establishing Sensitivity Labels](https://learn.microsoft.com/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) \r\n💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) \r\n💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) \r\n💡 [Set up Azure Rights Management](https://learn.microsoft.com/azure/information-protection/what-is-azure-rms) \r\n💡 [Deploy Azure Information Protection](https://learn.microsoft.com/azure/information-protection/aip-classification-and-protection) \r\n💡 [Sentinel Data Connectors](https://learn.microsoft.com/azure/sentinel/connect-data-sources) \r\n💡 [Discover Data & Apply Sensitivity Labels Automatically](https://learn.microsoft.com/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) \r\n\r\n\r\n\r\n"
},
"customWidth": "33",
"name": "text - 6"
@@ -8737,7 +8737,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [Implement Microsoft Purview - IRM & Compliance - DoD Deployments](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) \r\n💡 [Implement a Data Governance Maturity Model Framework](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) \r\n💡 [Deploy Azure Data Governance](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) \r\n💡 [Leverage Microsoft Defender for For Cloud Goverance Rules](https://learn.microsoft.com/en-us/azure/defender-for-cloud/governance-rules) \r\n💡 [Implement Purview Data Governance](https://learn.microsoft.com/en-us/purview/?view=o365-worldwide) \r\n💡 [Purview Data Lineage Machine Learning](https://learn.microsoft.com/en-us/samples/microsoft/purview-machine-learning-lineage-solution-accelerator/purview-machine-learning-lineage-solution-accelerator/) \r\n💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) \r\n💡 [Azure Collaboration Governance](https://learn.microsoft.com/en-us/microsoft-365/solutions/collaboration-governance-overview?view=o365-worldwide) \r\n💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) \r\n💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) \r\n💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/en-us/azure/azure-sql/database/sql-insights-overview?view=azuresql) \r\n💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) \r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n💡 [Implement Microsoft Purview - IRM & Compliance - DoD Deployments](https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) \r\n💡 [Implement a Data Governance Maturity Model Framework](https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) \r\n💡 [Deploy Azure Data Governance](https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) \r\n💡 [Leverage Microsoft Defender for For Cloud Goverance Rules](https://learn.microsoft.com/azure/defender-for-cloud/governance-rules) \r\n💡 [Implement Purview Data Governance](https://learn.microsoft.com/purview/?view=o365-worldwide) \r\n💡 [Purview Data Lineage Machine Learning](https://learn.microsoft.com/samples/microsoft/purview-machine-learning-lineage-solution-accelerator/purview-machine-learning-lineage-solution-accelerator/) \r\n💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) \r\n💡 [Azure Collaboration Governance](https://learn.microsoft.com/microsoft-365/solutions/collaboration-governance-overview?view=o365-worldwide) \r\n💡 [Deploy Azure Information Protection](https://learn.microsoft.com/azure/information-protection/aip-classification-and-protection) \r\n💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/azure/sentinel/connect-data-sources) \r\n💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/azure/azure-sql/database/sql-insights-overview?view=azuresql) \r\n💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) \r\n\r\n"
},
"customWidth": "33",
"name": "text - 2"
@@ -8945,7 +8945,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Create Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) \r\n💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) \r\n💡 [Deploy with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) \r\n💡 [Utilize Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) \r\n💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) \r\n💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) \r\n💡 [Use the Service Catalog](https://learn.microsoft.com/en-us/system-center/scsm/service-catalog?view=sc-sm-2022) \r\n"
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Create Sensitivity Labels](https://learn.microsoft.com/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) \r\n💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) \r\n💡 [Deploy with Trainable Classifiers](https://learn.microsoft.com/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) \r\n💡 [Utilize Rights Management](https://learn.microsoft.com/azure/information-protection/what-is-azure-rms) \r\n💡 [Deploy Azure Information Protection](https://learn.microsoft.com/azure/information-protection/aip-classification-and-protection) \r\n💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) \r\n💡 [Use the Service Catalog](https://learn.microsoft.com/system-center/scsm/service-catalog?view=sc-sm-2022) \r\n"
},
"customWidth": "33",
"name": "text - 2"
@@ -9067,7 +9067,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Leverage Data Monitoring & Self Healing](https://learn.microsoft.com/en-us/compliance/assurance/assurance-monitoring-and-self-healing) \r\n💡 [Deploy Microsoft 365 Monitorning](https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-monitoring?view=o365-worldwide) \r\n💡 [Senitnel Data Collection Best Practices](https://learn.microsoft.com/en-us/azure/sentinel/best-practices-data) \r\n💡 [Deploy Microsoft Purview](https://learn.microsoft.com/en-us/purview/purview) \r\n💡 [Utilze Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) \r\n💡 [Configure Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) \r\n💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) \r\n💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/en-us/azure/azure-sql/database/sql-insights-overview?view=azuresql) \r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Leverage Data Monitoring & Self Healing](https://learn.microsoft.com/compliance/assurance/assurance-monitoring-and-self-healing) \r\n💡 [Deploy Microsoft 365 Monitorning](https://learn.microsoft.com/microsoft-365/enterprise/microsoft-365-monitoring?view=o365-worldwide) \r\n💡 [Senitnel Data Collection Best Practices](https://learn.microsoft.com/azure/sentinel/best-practices-data) \r\n💡 [Deploy Microsoft Purview](https://learn.microsoft.com/purview/purview) \r\n💡 [Utilze Azure Rights Management](https://learn.microsoft.com/azure/information-protection/what-is-azure-rms) \r\n💡 [Configure Azure Information Protection](https://learn.microsoft.com/azure/information-protection/aip-classification-and-protection) \r\n💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/azure/sentinel/connect-data-sources) \r\n💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/azure/azure-sql/database/sql-insights-overview?view=azuresql) \r\n\r\n"
},
"customWidth": "33",
"name": "text - 2"
@@ -9258,7 +9258,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [Utilize Azure Encrption](https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview) \r\n💡 [Deploy Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) \r\n💡 [Deploy Purview Information Protection](https://learn.microsoft.com/en-us/purview/information-protection) \r\n💡 [Configure Dynamic Key & Encrption Delivery](https://learn.microsoft.com/en-us/azure/media-services/latest/drm-content-protection-concept) \r\n💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) \r\n\r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n💡 [Utilize Azure Encrption](https://learn.microsoft.com/azure/security/fundamentals/encryption-overview) \r\n💡 [Deploy Azure Rights Management](https://learn.microsoft.com/azure/information-protection/what-is-azure-rms) \r\n💡 [Deploy Purview Information Protection](https://learn.microsoft.com/purview/information-protection) \r\n💡 [Configure Dynamic Key & Encrption Delivery](https://learn.microsoft.com/azure/media-services/latest/drm-content-protection-concept) \r\n💡 [Deploy Azure Information Protection](https://learn.microsoft.com/azure/information-protection/aip-classification-and-protection) \r\n\r\n\r\n"
},
"customWidth": "33",
"name": "text - 2"
@@ -9326,7 +9326,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Implement Data Loss & Prevention (DLP)](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp) \r\n💡 [Informaiton Protection & Data Loss and Prevention- GITHUB LAB](https://microsoft.github.io/ComplianceCxE/dag/mip-dlp/) \r\n💡 [Deploy Adaptive Protection- Data Loss & Protections](https://learn.microsoft.com/en-us/purview/dlp-adaptive-protection-learn) \r\n💡 [Apply Rules for DLP Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/data-loss-prevention/dlp-rule-application) \r\n💡 [Utilize Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) \r\n💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) \r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Implement Data Loss & Prevention (DLP)](https://learn.microsoft.com/purview/dlp-learn-about-dlp) \r\n💡 [Informaiton Protection & Data Loss and Prevention- GITHUB LAB](https://microsoft.github.io/ComplianceCxE/dag/mip-dlp/) \r\n💡 [Deploy Adaptive Protection- Data Loss & Protections](https://learn.microsoft.com/purview/dlp-adaptive-protection-learn) \r\n💡 [Apply Rules for DLP Exchange Online](https://learn.microsoft.com/exchange/security-and-compliance/data-loss-prevention/dlp-rule-application) \r\n💡 [Utilize Trainable Classifiers](https://learn.microsoft.com/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) \r\n💡 [Deploy Azure Information Protection](https://learn.microsoft.com/azure/information-protection/aip-classification-and-protection) \r\n\r\n"
},
"customWidth": "33",
"name": "text - 2"
@@ -9472,7 +9472,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Configure Conditional Access in Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview) \r\n💡 [Use Conditional Access Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) \r\n💡 [Use Conditional Access APIs](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-apis) \r\n💡 [Deploy Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access#deploy-conditional-access-policies) \r\n💡 [Use Conditional Access With Data Explorer](https://learn.microsoft.com/en-us/azure/data-explorer/security-conditional-access) \r\n💡 [Deploy Common Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common?tabs=secure-foundation) \r\n💡 [Build Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policies) \r\n\r\n"
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Configure Conditional Access in Azure Active Directory](https://learn.microsoft.com/azure/active-directory/conditional-access/overview) \r\n💡 [Use Conditional Access Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/conditional-access) \r\n💡 [Use Conditional Access APIs](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-apis) \r\n💡 [Deploy Conditional Access Policies](https://learn.microsoft.com/azure/active-directory/conditional-access/plan-conditional-access#deploy-conditional-access-policies) \r\n💡 [Use Conditional Access With Data Explorer](https://learn.microsoft.com/azure/data-explorer/security-conditional-access) \r\n💡 [Deploy Common Conditional Access Policies](https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common?tabs=secure-foundation) \r\n💡 [Build Conditional Access](https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policies) \r\n\r\n"
},
"customWidth": "33",
"name": "text - 4"
@@ -10430,7 +10430,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Use Data Flow Mapping Power Platform](https://learn.microsoft.com/en-us/power-query/dataflows/create-use) \r\n💡 [User Azure Network Traffic Analytics](https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics) \r\n💡 [Azure Blue Print ](https://learn.microsoft.com/en-us/azure/governance/blueprints/overview) \r\n💡 [Leverage Azure Data Visualization with Data Explorer](https://learn.microsoft.com/en-us/azure/data-explorer/viz-overview) \r\n💡 [Use Power Automate for Event Tagging](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-microsoft-flow?view=o365-worldwide) \r\n💡 [Secure & Govern Workloads with Network-level Segmentation](https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/network-level-segmentation) \r\n💡 [Deploy Software Defined Netoworking](https://learn.microsoft.com/en-us/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) \r\n💡 [Manage Software Defined Netoworking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/manage-sdn) \r\n💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) "
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Use Data Flow Mapping Power Platform](https://learn.microsoft.com/power-query/dataflows/create-use) \r\n💡 [User Azure Network Traffic Analytics](https://learn.microsoft.com/azure/network-watcher/traffic-analytics) \r\n💡 [Azure Blue Print ](https://learn.microsoft.com/azure/governance/blueprints/overview) \r\n💡 [Leverage Azure Data Visualization with Data Explorer](https://learn.microsoft.com/azure/data-explorer/viz-overview) \r\n💡 [Use Power Automate for Event Tagging](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/api-microsoft-flow?view=o365-worldwide) \r\n💡 [Secure & Govern Workloads with Network-level Segmentation](https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/network-level-segmentation) \r\n💡 [Deploy Software Defined Netoworking](https://learn.microsoft.com/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) \r\n💡 [Manage Software Defined Netoworking](https://learn.microsoft.com/windows-server/networking/sdn/manage/manage-sdn) \r\n💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -10592,7 +10592,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Use Secure Access Service Edge SASE - Software Defined Networking Zero Trust](https://www.microsoft.com/en-us/security/business/security-101/what-is-sase) \r\n💡 [Software Defined Network Monitoring using Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/software-defined-monitoring-using-automated-notebooks-and-azure/ba-p/2587775) \r\n💡 [Plan Software Defined Netoworking](https://learn.microsoft.com/en-us/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) \r\n💡 [Implementing Software Defined Networking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/) \r\n💡 [Manage Software Detined Netoworking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/manage-sdn) \r\n💡 [Deploy Software Defined Networking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/deploy/deploy-a-software-defined-network-infrastructure-using-scripts) \r\n💡 [Secure the Network Controller](https://learn.microsoft.com/en-us/azure-stack/hci/manage/nc-security) \r\n💡 [SDN for Win Server 2019 and 2022](https://learn.microsoft.com/en-us/windows-server/networking/sdn/sdn-whats-new) \r\n💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) \r\n💡 [IPV6 Config Interface](https://learn.microsoft.com/en-us/javascript/api/%40azure/arm-databoxedge-profile-2020-09-01-hybrid/ipv6config?view=azure-node-latest&wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) \r\n💡 [Leverage IPV6 for Azure Virtual Networks](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) \r\n💡 [Segementation Security Strategies](https://learn.microsoft.com/en-us/azure/well-architected/security/design-segmentation) \r\n💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) \r\n💡 [Utilize Microsoft Packet Monitor](https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon) "
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Use Secure Access Service Edge SASE - Software Defined Networking Zero Trust](https://www.microsoft.com/security/business/security-101/what-is-sase) \r\n💡 [Software Defined Network Monitoring using Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/software-defined-monitoring-using-automated-notebooks-and-azure/ba-p/2587775) \r\n💡 [Plan Software Defined Netoworking](https://learn.microsoft.com/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) \r\n💡 [Implementing Software Defined Networking](https://learn.microsoft.com/windows-server/networking/sdn/) \r\n💡 [Manage Software Detined Netoworking](https://learn.microsoft.com/windows-server/networking/sdn/manage/manage-sdn) \r\n💡 [Deploy Software Defined Networking](https://learn.microsoft.com/windows-server/networking/sdn/deploy/deploy-a-software-defined-network-infrastructure-using-scripts) \r\n💡 [Secure the Network Controller](https://learn.microsoft.com/azure-stack/hci/manage/nc-security) \r\n💡 [SDN for Win Server 2019 and 2022](https://learn.microsoft.com/windows-server/networking/sdn/sdn-whats-new) \r\n💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) \r\n💡 [IPV6 Config Interface](https://learn.microsoft.com/javascript/api/%40azure/arm-databoxedge-profile-2020-09-01-hybrid/ipv6config?view=azure-node-latest&wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) \r\n💡 [Leverage IPV6 for Azure Virtual Networks](https://learn.microsoft.com/azure/virtual-network/ip-services/ipv6-overview?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) \r\n💡 [Segementation Security Strategies](https://learn.microsoft.com/azure/well-architected/security/design-segmentation) \r\n💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/azure/well-architected/security/design-network-segmentation) \r\n💡 [Utilize Microsoft Packet Monitor](https://learn.microsoft.com/windows-server/networking/technologies/pktmon/pktmon) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -10708,7 +10708,7 @@
{
"type": 1,
"content": {
- "json": "# 5.3 Macro Segmentation\r\n\r\n## Microsoft Portals Department of Defense\r\n🔀 [Impletment Network Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) \r\n🔀 [Azure Features for Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation#azure-features-for-segmentation) \r\n🔀 [Network Service](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.HybridNetwork%2Fpublishers%2Fnetworkservicedesigngroups) \r\n🔀 [Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview)"
+ "json": "# 5.3 Macro Segmentation\r\n\r\n## Microsoft Portals Department of Defense\r\n🔀 [Impletment Network Segmentation](https://learn.microsoft.com/azure/well-architected/security/design-network-segmentation) \r\n🔀 [Azure Features for Segmentation](https://learn.microsoft.com/azure/well-architected/security/design-network-segmentation#azure-features-for-segmentation) \r\n🔀 [Network Service](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.HybridNetwork%2Fpublishers%2Fnetworkservicedesigngroups) \r\n🔀 [Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview)"
},
"customWidth": "33",
"name": "LT-1"
@@ -10716,7 +10716,7 @@
{
"type": 1,
"content": {
- "json": "
\r\n## Microsoft Portals Government\r\n🔀 [Impletment Network Segmentation](https://learn.microsoft.us/azure/well-architected/security/design-network-segmentation) \r\n🔀 [Segementation Security Strategies](https://learn.microsoft.us/azure/well-architected/security/design-segmentation) \r\n🔀 [Network Service](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.HybridNetwork%2Fpublishers%2Fnetworkservicedesigngroups) \r\n🔀 [Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) \r\n"
},
"customWidth": "33",
"name": "LT-1 - Copy"
@@ -10724,7 +10724,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n\r\n💡 [Impletment Network Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) \r\n💡 [Azure Features for Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation#azure-features-for-segmentation) \r\n💡 [Segementation Security Strategies](https://learn.microsoft.com/en-us/azure/well-architected/security/design-segmentation) \r\n💡 [Network Service Designs](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.HybridNetwork%2Fpublishers%2Fnetworkservicedesigngroups) \r\n💡 [Network Watcher](https://portal.azure.com/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) "
+ "json": " \r\n \r\n## Resources\r\n\r\n\r\n💡 [Impletment Network Segmentation](https://learn.microsoft.com/azure/well-architected/security/design-network-segmentation) \r\n💡 [Azure Features for Segmentation](https://learn.microsoft.com/azure/well-architected/security/design-network-segmentation#azure-features-for-segmentation) \r\n💡 [Segementation Security Strategies](https://learn.microsoft.com/azure/well-architected/security/design-segmentation) \r\n💡 [Network Service Designs](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.HybridNetwork%2Fpublishers%2Fnetworkservicedesigngroups) \r\n💡 [Network Watcher](https://portal.azure.com/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -10976,7 +10976,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Enabling JIT Access Controls](https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) \r\n💡 [Conditional Access Block Access by Location](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-location?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) \r\n💡 [Secure Networks with Zero Trust](https://learn.microsoft.com/en-us/security/zero-trust/deploy/networks) \r\n💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation?wtmc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) \r\n💡 [Microsoft Packet Monitor](https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon) "
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Enabling JIT Access Controls](https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) \r\n💡 [Conditional Access Block Access by Location](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-location?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) \r\n💡 [Secure Networks with Zero Trust](https://learn.microsoft.com/security/zero-trust/deploy/networks) \r\n💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/azure/well-architected/security/design-network-segmentation?wtmc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) \r\n💡 [Microsoft Packet Monitor](https://learn.microsoft.com/windows-server/networking/technologies/pktmon/pktmon) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -12535,7 +12535,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Visibility,Automation and Orchestration with Zero Trust](https://learn.microsoft.com/en-us/) \r\n💡 [Azure Orchestration for Azure Security Policy](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/azure-policy-security-baseline) \r\n💡 [Configuration Analyzer for Security Policies](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies?view=o365-worldwide) \r\n💡 [Azure Automation Overview](https://learn.microsoft.com/en-us/azure/automation/overview) \r\n💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/automation-security-baseline) \r\n💡 [Azure Policy](https://learn.microsoft.com/en-us/azure/governance/policy/overview) \r\n💡 [What is Azure Firewall?](https://learn.microsoft.com/en-us/azure/firewall/overview) \r\n💡 [Apply Zero Trust principles to a hub virtual network in Azure](https://learn.microsoft.com/en-us/security/zero-trust/azure-infrastructure-networking) \r\n💡 [Management of Role Permissions and Automation](https://learn.microsoft.com/en-us/azure/automation/automation-role-based-access-control) \r\n💡 [Using Azure Machine Learning to assign roles](https://learn.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler) \r\n💡 [Azure AD Seccurity Groups ML](https://learn.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler#use-azure-ad-security-groups-to-manage-workspace-access) "
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Visibility,Automation and Orchestration with Zero Trust](https://learn.microsoft.com/) \r\n💡 [Azure Orchestration for Azure Security Policy](https://learn.microsoft.com/security/benchmark/azure/baselines/azure-policy-security-baseline) \r\n💡 [Configuration Analyzer for Security Policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies?view=o365-worldwide) \r\n💡 [Azure Automation Overview](https://learn.microsoft.com/azure/automation/overview) \r\n💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/security/benchmark/azure/baselines/automation-security-baseline) \r\n💡 [Azure Policy](https://learn.microsoft.com/azure/governance/policy/overview) \r\n💡 [What is Azure Firewall?](https://learn.microsoft.com/azure/firewall/overview) \r\n💡 [Apply Zero Trust principles to a hub virtual network in Azure](https://learn.microsoft.com/security/zero-trust/azure-infrastructure-networking) \r\n💡 [Management of Role Permissions and Automation](https://learn.microsoft.com/azure/automation/automation-role-based-access-control) \r\n💡 [Using Azure Machine Learning to assign roles](https://learn.microsoft.com/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler) \r\n💡 [Azure AD Seccurity Groups ML](https://learn.microsoft.com/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler#use-azure-ad-security-groups-to-manage-workspace-access) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -12738,7 +12738,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Azure Automation Overview](https://learn.microsoft.com/en-us/azure/automation/overview) \r\n💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/automation-security-baseline) \r\n💡 [Visibility, Automation, and Orchestration with Zero Trust](https://learn.microsoft.com/en-us/) \r\n💡 [Automation in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automation) \r\n💡 [Automate Threat Response with Playbooks](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) \r\n💡 [Automated Investigation & Response M365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) \r\n💡 [Power Automate U.S Government](https://learn.microsoft.com/en-us/power-automate/us-govt) "
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Azure Automation Overview](https://learn.microsoft.com/azure/automation/overview) \r\n💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/security/benchmark/azure/baselines/automation-security-baseline) \r\n💡 [Visibility, Automation, and Orchestration with Zero Trust](https://learn.microsoft.com/) \r\n💡 [Automation in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/automation) \r\n💡 [Automate Threat Response with Playbooks](https://learn.microsoft.com/azure/sentinel/automate-responses-with-playbooks) \r\n💡 [Automated Investigation & Response M365 Defender](https://learn.microsoft.com/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) \r\n💡 [Power Automate U.S Government](https://learn.microsoft.com/power-automate/us-govt) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -12909,7 +12909,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Advanced multistage attack detection in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/fusion) \r\n💡 [Bring your own Machine Learning (ML) into Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/bring-your-own-ml) \r\n💡 [Azure Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/?view=azureml-api-2) \r\n💡 [Enterprise Security & Governance w. Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/concept-enterprise-security?view=azureml-api-2) \r\n💡 [Azure Government Isolaiton Guidelines using AI & ML](https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-impact-level-5) \r\n💡 [Quick Start Azure Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/tutorial-azure-ml-in-a-day?view=azureml-api-2) \r\n💡 [Azure security baseline for Azure Machine Learning](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/machine-learning-security-baseline) "
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Advanced multistage attack detection in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/fusion) \r\n💡 [Bring your own Machine Learning (ML) into Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/bring-your-own-ml) \r\n💡 [Azure Machine Learning](https://learn.microsoft.com/azure/machine-learning/?view=azureml-api-2) \r\n💡 [Enterprise Security & Governance w. Machine Learning](https://learn.microsoft.com/azure/machine-learning/concept-enterprise-security?view=azureml-api-2) \r\n💡 [Azure Government Isolaiton Guidelines using AI & ML](https://learn.microsoft.com/azure/azure-government/documentation-government-impact-level-5) \r\n💡 [Quick Start Azure Machine Learning](https://learn.microsoft.com/azure/machine-learning/tutorial-azure-ml-in-a-day?view=azureml-api-2) \r\n💡 [Azure security baseline for Azure Machine Learning](https://learn.microsoft.com/security/benchmark/azure/baselines/machine-learning-security-baseline) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -13142,7 +13142,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [AI Security Services](https://learn.microsoft.com/en-us/azure/ai-services/security-features) \r\n💡 [Senintel Automation](https://learn.microsoft.com/en-us/azure/sentinel/automation) \r\n💡 [AI ID & Access Risk Based Controls](https://azure.microsoft.com/en-us/products/category/identity/) \r\n💡 [Implement Sentinel & M365 Defender for XDR - AI Driven Zero Trust ](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) \r\n💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) "
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [AI Security Services](https://learn.microsoft.com/azure/ai-services/security-features) \r\n💡 [Senintel Automation](https://learn.microsoft.com/azure/sentinel/automation) \r\n💡 [AI ID & Access Risk Based Controls](https://azure.microsoft.com/products/category/identity/) \r\n💡 [Implement Sentinel & M365 Defender for XDR - AI Driven Zero Trust ](https://learn.microsoft.com/security/operations/siem-xdr-overview) \r\n💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -13232,7 +13232,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Security Ochestration, Automation & Response (SOAR) In Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automation) \r\n💡 [Sentinel SOAR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/how-to-use-azure-sentinel-for-incident-response-orchestration/ba-p/2242397) \r\n💡 [Microsoft Sentinel SOAR Content Catalog](https://learn.microsoft.com/en-us/azure/sentinel/sentinel-soar-content) \r\n💡 [Automate Threat Response with Playbooks in Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) \r\n💡 [Automated investigation and response in Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) \r\n💡 [Workflow Automation in Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation) \r\n💡 [SOAR Best Practices](https://www.microsoft.com/en-us/security/business/security-101/what-is-soar#SOARbestpractices) \r\n💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) "
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Security Ochestration, Automation & Response (SOAR) In Sentinel](https://learn.microsoft.com/azure/sentinel/automation) \r\n💡 [Sentinel SOAR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/how-to-use-azure-sentinel-for-incident-response-orchestration/ba-p/2242397) \r\n💡 [Microsoft Sentinel SOAR Content Catalog](https://learn.microsoft.com/azure/sentinel/sentinel-soar-content) \r\n💡 [Automate Threat Response with Playbooks in Sentinel](https://learn.microsoft.com/azure/sentinel/automate-responses-with-playbooks) \r\n💡 [Automated investigation and response in Microsoft 365 Defender](https://learn.microsoft.com/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) \r\n💡 [Workflow Automation in Microsoft Defender for Cloud](https://learn.microsoft.com/azure/defender-for-cloud/workflow-automation) \r\n💡 [SOAR Best Practices](https://www.microsoft.com/security/business/security-101/what-is-soar#SOARbestpractices) \r\n💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -13308,7 +13308,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Microsft API Management & Security](https://azure.microsoft.com/en-us/products/api-management/) \r\n💡 [Mitigate OWASP Top 10 Security Threats Using Microsoft API Management](https://learn.microsoft.com/en-us/azure/api-management/mitigate-owasp-api-threats) \r\n💡 [Security Baselines for API Management](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/api-management-security-baseline) \r\n💡 [Secure and Compliant APIs for a Hybrid and Multi Cloud World](https://azure.microsoft.com/en-us/blog/secure-and-compliant-apis-for-a-hybrid-and-multi-cloud-world/) \r\n💡 [Web API Design Best Practice](https://learn.microsoft.com/en-us/azure/architecture/best-practices/api-design) \r\n💡 [Monitor & Protect Your APIs](https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-use-azure-monitor) "
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Microsft API Management & Security](https://azure.microsoft.com/products/api-management/) \r\n💡 [Mitigate OWASP Top 10 Security Threats Using Microsoft API Management](https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats) \r\n💡 [Security Baselines for API Management](https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline) \r\n💡 [Secure and Compliant APIs for a Hybrid and Multi Cloud World](https://azure.microsoft.com/blog/secure-and-compliant-apis-for-a-hybrid-and-multi-cloud-world/) \r\n💡 [Web API Design Best Practice](https://learn.microsoft.com/azure/architecture/best-practices/api-design) \r\n💡 [Monitor & Protect Your APIs](https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -13389,7 +13389,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Security Operations In Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-security-operations) \r\n💡 [Microsoft SOC Best Practices Landing Page](https://www.microsoft.com/en-us/security/business/security-101/what-is-a-security-operations-center-soc?ef_id=_k_ce7dcd6e8f2d1919667ca9a72f733870_k_&OCID=AIDcmmdamuj0pc_SEM__k_ce7dcd6e8f2d1919667ca9a72f733870_k_&msclkid=ce7dcd6e8f2d1919667ca9a72f733870) \r\n💡 [Playbook for Modernizing Security Operations Centers](https://www.microsoft.com/en-us/security/blog/2021/02/11/a-playbook-for-modernizing-security-operations/) \r\n💡 [CISO Series Lessons Learned from Microsoft's SOC](https://www.microsoft.com/en-us/security/blog/2019/10/07/ciso-series-lessons-learned-from-the-microsoft-soc-part-3a-choosing-soc-tools/) \r\n💡 [Integrating Microsoft 365 Defender into your security operations](https://learn.microsoft.com/en-us/microsoft-365/security/defender/integrate-microsoft-365-defender-secops?view=o365-worldwide) "
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Security Operations In Azure](https://learn.microsoft.com/azure/well-architected/security/monitor-security-operations) \r\n💡 [Microsoft SOC Best Practices Landing Page](https://www.microsoft.com/security/business/security-101/what-is-a-security-operations-center-soc?ef_id=_k_ce7dcd6e8f2d1919667ca9a72f733870_k_&OCID=AIDcmmdamuj0pc_SEM__k_ce7dcd6e8f2d1919667ca9a72f733870_k_&msclkid=ce7dcd6e8f2d1919667ca9a72f733870) \r\n💡 [Playbook for Modernizing Security Operations Centers](https://www.microsoft.com/security/blog/2021/02/11/a-playbook-for-modernizing-security-operations/) \r\n💡 [CISO Series Lessons Learned from Microsoft's SOC](https://www.microsoft.com/security/blog/2019/10/07/ciso-series-lessons-learned-from-the-microsoft-soc-part-3a-choosing-soc-tools/) \r\n💡 [Integrating Microsoft 365 Defender into your security operations](https://learn.microsoft.com/microsoft-365/security/defender/integrate-microsoft-365-defender-secops?view=o365-worldwide) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -14344,7 +14344,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Azure Log Analytics](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-overview) \r\n💡 [Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/overview) \r\n💡 [Audit Logging and Monitoring](https://learn.microsoft.com/en-us/compliance/assurance/assurance-audit-logging) \r\n💡 [Maturity Model for Log Management M2131](https://techcommunity.microsoft.com/t5/public-sector-blog/microsoft-sentinel-maturity-model-for-event-log-management-m-21/ba-p/3074336) \r\n💡 [Device Log Capture - Intune](https://learn.microsoft.com/en-us/mem/intune/remote-actions/collect-diagnostics) \r\n💡 [Application Logging](https://learn.microsoft.com/en-us/sql/relational-databases/performance/view-the-windows-application-log-windows-10?view=sql-server-ver16) \r\n💡 [User Access Logging](https://learn.microsoft.com/en-us/windows-server/administration/user-access-logging/get-started-with-user-access-logging) \r\n💡 [Azure Infrastructure Logs](https://learn.microsoft.com/en-us/azure/well-architected/scalability/monitor-infrastructure) \r\n💡 [Network Logging](https://learn.microsoft.com/en-us/azure/azure-web-pubsub/howto-troubleshoot-network-trace) \r\n💡 [Supported Logs for Network](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/supported-logs/microsoft-network-networkmanagers-logs) "
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Azure Log Analytics](https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-overview) \r\n💡 [Azure Monitor](https://learn.microsoft.com/azure/azure-monitor/overview) \r\n💡 [Audit Logging and Monitoring](https://learn.microsoft.com/compliance/assurance/assurance-audit-logging) \r\n💡 [Maturity Model for Log Management M2131](https://techcommunity.microsoft.com/t5/public-sector-blog/microsoft-sentinel-maturity-model-for-event-log-management-m-21/ba-p/3074336) \r\n💡 [Device Log Capture - Intune](https://learn.microsoft.com/mem/intune/remote-actions/collect-diagnostics) \r\n💡 [Application Logging](https://learn.microsoft.com/sql/relational-databases/performance/view-the-windows-application-log-windows-10?view=sql-server-ver16) \r\n💡 [User Access Logging](https://learn.microsoft.com/windows-server/administration/user-access-logging/get-started-with-user-access-logging) \r\n💡 [Azure Infrastructure Logs](https://learn.microsoft.com/azure/well-architected/scalability/monitor-infrastructure) \r\n💡 [Network Logging](https://learn.microsoft.com/azure/azure-web-pubsub/howto-troubleshoot-network-trace) \r\n💡 [Supported Logs for Network](https://learn.microsoft.com/azure/azure-monitor/reference/supported-logs/microsoft-network-networkmanagers-logs) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -14830,7 +14830,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/overview) \r\n💡 [Implement Sentinel & M365](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) \r\n💡 [Unified SIEM & XDR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-unified-microsoft-siem-and-xdr-github-community/ba-p/3249533) \r\n💡 [Stream Alerts Defender for Cloud to SIEM](https://learn.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem#stream-alerts-to-azure-sentinel) \r\n💡 [Azure Sentinel Github Repo](https://github.com/Azure/Azure-Sentinel) \r\n💡 [Sentinel & SOC Analysis Process](https://learn.microsoft.com/en-us/azure/sentinel/migration-security-operations-center-processes) \r\n💡 [Microsoft Sentinel Skill Up Training](https://learn.microsoft.com/en-us/azure/sentinel/skill-up-resources) "
+ "json": " \r\n \r\n## Resources\r\n💡 [Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/overview) \r\n💡 [Implement Sentinel & M365](https://learn.microsoft.com/security/operations/siem-xdr-overview) \r\n💡 [Unified SIEM & XDR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-unified-microsoft-siem-and-xdr-github-community/ba-p/3249533) \r\n💡 [Stream Alerts Defender for Cloud to SIEM](https://learn.microsoft.com/azure/defender-for-cloud/export-to-siem#stream-alerts-to-azure-sentinel) \r\n💡 [Azure Sentinel Github Repo](https://github.com/Azure/Azure-Sentinel) \r\n💡 [Sentinel & SOC Analysis Process](https://learn.microsoft.com/azure/sentinel/migration-security-operations-center-processes) \r\n💡 [Microsoft Sentinel Skill Up Training](https://learn.microsoft.com/azure/sentinel/skill-up-resources) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -14994,7 +14994,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Microsoft Security Response Center Security Updates Guide](https://msrc.microsoft.com/update-guide) \r\n💡 [Explore Risks to Sensitive Data Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/data-security-review-risks) \r\n💡 [Identify & Analyze Risks Across Your Environment](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-attack-path) \r\n💡 [Cloud Security Posture Management](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management) \r\n💡 [Microsoft Cloud Security Benchmark](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-regulatory-compliance) "
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Microsoft Security Response Center Security Updates Guide](https://msrc.microsoft.com/update-guide) \r\n💡 [Explore Risks to Sensitive Data Microsoft Defender for Cloud](https://learn.microsoft.com/azure/defender-for-cloud/data-security-review-risks) \r\n💡 [Identify & Analyze Risks Across Your Environment](https://learn.microsoft.com/azure/defender-for-cloud/concept-attack-path) \r\n💡 [Cloud Security Posture Management](https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management) \r\n💡 [Microsoft Cloud Security Benchmark](https://learn.microsoft.com/azure/defender-for-cloud/concept-regulatory-compliance) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -15267,7 +15267,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [ID Threats with User and Entity Behavior Analytics](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) \r\n💡 [Enable Entity Behavior Analytics to Detect Threats](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics) \r\n💡 [Microsoft Sentinel UEBA Reference](https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference) \r\n💡 [Investigate Incidents with UEBA](https://learn.microsoft.com/en-us/azure/sentinel/investigate-with-ueba) \r\n💡 [Discover and Protect Sensitive Information in your Organization](https://learn.microsoft.com/en-us/defender-cloud-apps/tutorial-dlp) \r\n💡 [Purview Insider Risk Management](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) "
+ "json": " \r\n \r\n## Resources\r\n💡 [ID Threats with User and Entity Behavior Analytics](https://learn.microsoft.com/azure/sentinel/identify-threats-with-entity-behavior-analytics) \r\n💡 [Enable Entity Behavior Analytics to Detect Threats](https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics) \r\n💡 [Microsoft Sentinel UEBA Reference](https://learn.microsoft.com/azure/sentinel/ueba-reference) \r\n💡 [Investigate Incidents with UEBA](https://learn.microsoft.com/azure/sentinel/investigate-with-ueba) \r\n💡 [Discover and Protect Sensitive Information in your Organization](https://learn.microsoft.com/defender-cloud-apps/tutorial-dlp) \r\n💡 [Purview Insider Risk Management](https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -15471,7 +15471,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n\r\n💡 [Microsoft Threat Intelligence](https://learn.microsoft.com/en-us/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti) \r\n💡 [Microsoft Security Graph API](https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview?view=graph-rest-beta) \r\n💡 [Create Threat Intelligence Indicators](https://learn.microsoft.com/en-us/graph/api/tiindicators-post?view=graph-rest-beta&tabs=http) \r\n💡 [Threat intelligence integration in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/threat-intelligence-integration) \r\n💡 [Bring Your Own Threat Intelligence Feeds](https://learn.microsoft.com/en-us/defender-cloud-apps/additional-integrations) \r\n💡 [Accessing the Threat Intelligence Portal](https://learn.microsoft.com/en-us/defender/threat-intelligence/learn-how-to-access-microsoft-defender-threat-intelligence-and-make-customizations-in-your-portal) "
+ "json": " \r\n \r\n## Resources\r\n\r\n💡 [Microsoft Threat Intelligence](https://learn.microsoft.com/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti) \r\n💡 [Microsoft Security Graph API](https://learn.microsoft.com/graph/api/resources/security-api-overview?view=graph-rest-beta) \r\n💡 [Create Threat Intelligence Indicators](https://learn.microsoft.com/graph/api/tiindicators-post?view=graph-rest-beta&tabs=http) \r\n💡 [Threat intelligence integration in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/threat-intelligence-integration) \r\n💡 [Bring Your Own Threat Intelligence Feeds](https://learn.microsoft.com/defender-cloud-apps/additional-integrations) \r\n💡 [Accessing the Threat Intelligence Portal](https://learn.microsoft.com/defender/threat-intelligence/learn-how-to-access-microsoft-defender-threat-intelligence-and-make-customizations-in-your-portal) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -15597,7 +15597,7 @@
{
"type": 1,
"content": {
- "json": " \r\n \r\n## Resources\r\n💡 [Automate Threat Response with Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) \r\n💡 [Adaptive Protection - Microsoft Purview](https://www.microsoft.com/en-us/security/blog/2023/02/06/introducing-adaptive-protection-in-microsoft-purview-people-centric-data-protection-for-a-multiplatform-world/#:~:text=With%20Adaptive%20Protection%2C%20DLP%20policies%20become%20dynamic%2C%20ensuring,efficient%20and%20empowered%20to%20do%20more%20with%20less.) \r\n💡 [Adaptive Policy Scopes M365](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/using-adaptive-policy-scopes-to-apply-m365-retention-to-shared/ba-p/3053641#:~:text=Back%20in%20October,in%20Microsoft%20365.) \r\n💡 [Adaptive Application Controls](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls) \r\n💡 [AI-Driven Adaptive Device Controls Microsoft Defender for Endpoint](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/ai-driven-adaptive-protection-in-microsoft-defender-for-endpoint/ba-p/2966491) \r\n💡 [AI-Driven Adaptive Protection Against Human Operated Ransomeware](https://www.microsoft.com/en-us/security/blog/2021/11/15/ai-driven-adaptive-protection-against-human-operated-ransomware/) \r\n💡 [Microsoft Defender for Cloud Automated Security Posture Management](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management) \r\n💡 [Improve your network security posture with adaptive network hardening](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-network-hardening) \r\n💡 [What is Microsoft Entra ID Protection?](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection) \r\n💡 [Azure Automation update management](https://learn.microsoft.com/en-us/azure/architecture/hybrid/azure-update-mgmt) \r\n💡 [Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure) "
+ "json": " \r\n \r\n## Resources\r\n💡 [Automate Threat Response with Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/automate-responses-with-playbooks) \r\n💡 [Adaptive Protection - Microsoft Purview](https://www.microsoft.com/security/blog/2023/02/06/introducing-adaptive-protection-in-microsoft-purview-people-centric-data-protection-for-a-multiplatform-world/#:~:text=With%20Adaptive%20Protection%2C%20DLP%20policies%20become%20dynamic%2C%20ensuring,efficient%20and%20empowered%20to%20do%20more%20with%20less.) \r\n💡 [Adaptive Policy Scopes M365](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/using-adaptive-policy-scopes-to-apply-m365-retention-to-shared/ba-p/3053641#:~:text=Back%20in%20October,in%20Microsoft%20365.) \r\n💡 [Adaptive Application Controls](https://learn.microsoft.com/azure/defender-for-cloud/adaptive-application-controls) \r\n💡 [AI-Driven Adaptive Device Controls Microsoft Defender for Endpoint](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/ai-driven-adaptive-protection-in-microsoft-defender-for-endpoint/ba-p/2966491) \r\n💡 [AI-Driven Adaptive Protection Against Human Operated Ransomeware](https://www.microsoft.com/security/blog/2021/11/15/ai-driven-adaptive-protection-against-human-operated-ransomware/) \r\n💡 [Microsoft Defender for Cloud Automated Security Posture Management](https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management) \r\n💡 [Improve your network security posture with adaptive network hardening](https://learn.microsoft.com/azure/defender-for-cloud/adaptive-network-hardening) \r\n💡 [What is Microsoft Entra ID Protection?](https://learn.microsoft.com/azure/active-directory/identity-protection/overview-identity-protection) \r\n💡 [Azure Automation update management](https://learn.microsoft.com/azure/architecture/hybrid/azure-update-mgmt) \r\n💡 [Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/mem/intune/protect/windows-update-for-business-configure) "
},
"customWidth": "33",
"name": "LT-1 - Copy - Copy"
@@ -19391,7 +19391,7 @@
{
"type": 1,
"content": {
- "json": "## DoD Zero Trust Strategy Workbook Workbook FAQ \r\n\r\n \r\n### What will this workbook do for my organization? \r\n\r\nThis workbook provides structure, guidance, and simplification of the DoD Zero Trust Strategy to make it easier to track, prioritize, and improve Zero Trust Target (and Advanced) level Capabilities/Activities that are required to be implemented by 2027. \r\n\r\n \r\n### Does this workbook only pertain to Microsoft-specific capabiltiies?\r\n\r\nNo, the out-of-the-box content of this Sentinel workbook includes references to Microsoft-specific capabilities/solutions. However, the workbook has been designed to account for \"Alternate Implementations\" (non-Microsoft), which may also meet the Target (and Advanced)-level Zero Trust Capabilities and Activities. In addition, Microsoft Sentinel supports custom log formats and multiple third-party [data connectors](\"https://learn.microsoft.com/en-us/azure/sentinel/data-connectors-reference\") that can provide visibility for non-Microsoft solutions. \r\n\r\n \r\n### How will this workbook help with deployment and maturity of the DoD Zero Trust Strategy Capabilities & Activities? \r\n\r\n* Provides Zero Trust roll-up of organizational maturity and situational awareness as it relates directly to the 2027 Zero Trust Target-level deadline. \r\n\r\n* Provides DoD Zero Trust Activity simplification and improved awareness, allowing responsible parties for each pillar(s) to report which capabilities are planned, implemented, or not applicable. \r\n\r\n* Provides guidance and recommendations to meet the 45 capabilities (and supporting 152 activities) \r\n\r\n* Provides a working (and evolving) organized method of orchestrating and managing/tracking efforts around the Zero Trust Capabilities and Activities covered in the DoD Zero Trust Strategy. \r\n\r\n \r\n### Why are some of the visualizations not working in my workbook? \r\n\r\nThe visualizations within this workbook are simply examples and rely on specific logs to populate accordingly. We realize that not every organization leverages the same solution logs used to build/populate this workbook. In addition, we also realize that many customers leverage third-party solutions for their needs. Every implementation of this workbook is unique to the respective environment in which it is installed. It is intended to be a starting point and can be further customized to better meet the needs of each customer. Please contact your Account Representative if your team requires further assistance and/or customizations. \r\n\r\nVisualizations can be used to show examples of the DoD Zero Trust Activities in use/or configurations themselves. They can also be used to further develop automations related to improving cyber hygiene through deploying Zero Trust principals. \r\n\r\n \r\n### Who should use this workbook? \r\n\r\nThis workbook is designed for both executives and individuals who are directly responsible for implementing the respective Capabilities/Activities due by 2027 outlined in the DoD Zero Trust Strategy. \r\n\r\nThis workbook derives language and terminology specific to the DoD Zero Trust Strategy. However, many non-DoD organizations can also leverage this guidance for their needs. \r\n\r\n \r\n### Where does the Zero Trust Maturity (Percentage) score come from? \r\n\r\nThe Zero Trust Maturity score is calculated based on the interactive capabilities sections contained within each of the pillars. When updated, the drop-down boxes labeled, “Implementation Status” directly contribute to the overall level of maturity reported under the “Zero Trust Essentials” → \"DoD Zero Trust Assessment Tracker\". \r\n\r\n \r\n### How can I make recommendations to improve this workbook? \r\n\r\nPlease utilize the link in the opening screen labeled, “Please take some time to take a quick survey”. Our team values these responses and takes them very seriously. Any feedback that you can provide is greatly appreciated. \r\n\r\n \r\n### Can this workbook be customized? \r\n\r\nYes! This workbook has been created with additional customization in mind. Please contact your Account Representative if you would to like to inquire about any additional assistance with customizing this workbook to suit your organizational goals related to DoD Zero Trust Strategy maturity. \r\n\r\n \r\n### Do other customers outside the DoD utilize this workbook? \r\n\r\nYes, many customers outside the DoD have also gravitated toward the DoD Zero Trust Strategy because it focuses on an outcomes-focused methodology and includes specific \"Capabilities and Activities\" that apply to core Zero Trust principals. \r\n\r\n \r\n### Who created this workbook? \r\n\r\nThis workbook was created by a collaboration of Microsoft teams and subject matter experts along with our pilot customers. \r\n\r\n \r\n### Does this workbook cover all 152 “Activities” defined in the Strategy? \r\n\r\nYes, the recommendations, visualizations, and guidance, while centered around the 45 capabilities, will still apply to all 152 activities. This workbook aims to simplify the Target (and Advanced)-level Zero Trust Capabilities and Activities. Based on prior feedback, this workbook may be updated in the future to include further guidance, reporting, and relevant information. ",
+ "json": "## DoD Zero Trust Strategy Workbook Workbook FAQ \r\n\r\n \r\n### What will this workbook do for my organization? \r\n\r\nThis workbook provides structure, guidance, and simplification of the DoD Zero Trust Strategy to make it easier to track, prioritize, and improve Zero Trust Target (and Advanced) level Capabilities/Activities that are required to be implemented by 2027. \r\n\r\n \r\n### Does this workbook only pertain to Microsoft-specific capabiltiies?\r\n\r\nNo, the out-of-the-box content of this Sentinel workbook includes references to Microsoft-specific capabilities/solutions. However, the workbook has been designed to account for \"Alternate Implementations\" (non-Microsoft), which may also meet the Target (and Advanced)-level Zero Trust Capabilities and Activities. In addition, Microsoft Sentinel supports custom log formats and multiple third-party [data connectors](\"https://learn.microsoft.com/azure/sentinel/data-connectors-reference\") that can provide visibility for non-Microsoft solutions. \r\n\r\n \r\n### How will this workbook help with deployment and maturity of the DoD Zero Trust Strategy Capabilities & Activities? \r\n\r\n* Provides Zero Trust roll-up of organizational maturity and situational awareness as it relates directly to the 2027 Zero Trust Target-level deadline. \r\n\r\n* Provides DoD Zero Trust Activity simplification and improved awareness, allowing responsible parties for each pillar(s) to report which capabilities are planned, implemented, or not applicable. \r\n\r\n* Provides guidance and recommendations to meet the 45 capabilities (and supporting 152 activities) \r\n\r\n* Provides a working (and evolving) organized method of orchestrating and managing/tracking efforts around the Zero Trust Capabilities and Activities covered in the DoD Zero Trust Strategy. \r\n\r\n \r\n### Why are some of the visualizations not working in my workbook? \r\n\r\nThe visualizations within this workbook are simply examples and rely on specific logs to populate accordingly. We realize that not every organization leverages the same solution logs used to build/populate this workbook. In addition, we also realize that many customers leverage third-party solutions for their needs. Every implementation of this workbook is unique to the respective environment in which it is installed. It is intended to be a starting point and can be further customized to better meet the needs of each customer. Please contact your Account Representative if your team requires further assistance and/or customizations. \r\n\r\nVisualizations can be used to show examples of the DoD Zero Trust Activities in use/or configurations themselves. They can also be used to further develop automations related to improving cyber hygiene through deploying Zero Trust principals. \r\n\r\n \r\n### Who should use this workbook? \r\n\r\nThis workbook is designed for both executives and individuals who are directly responsible for implementing the respective Capabilities/Activities due by 2027 outlined in the DoD Zero Trust Strategy. \r\n\r\nThis workbook derives language and terminology specific to the DoD Zero Trust Strategy. However, many non-DoD organizations can also leverage this guidance for their needs. \r\n\r\n \r\n### Where does the Zero Trust Maturity (Percentage) score come from? \r\n\r\nThe Zero Trust Maturity score is calculated based on the interactive capabilities sections contained within each of the pillars. When updated, the drop-down boxes labeled, “Implementation Status” directly contribute to the overall level of maturity reported under the “Zero Trust Essentials” → \"DoD Zero Trust Assessment Tracker\". \r\n\r\n \r\n### How can I make recommendations to improve this workbook? \r\n\r\nPlease utilize the link in the opening screen labeled, “Please take some time to take a quick survey”. Our team values these responses and takes them very seriously. Any feedback that you can provide is greatly appreciated. \r\n\r\n \r\n### Can this workbook be customized? \r\n\r\nYes! This workbook has been created with additional customization in mind. Please contact your Account Representative if you would to like to inquire about any additional assistance with customizing this workbook to suit your organizational goals related to DoD Zero Trust Strategy maturity. \r\n\r\n \r\n### Do other customers outside the DoD utilize this workbook? \r\n\r\nYes, many customers outside the DoD have also gravitated toward the DoD Zero Trust Strategy because it focuses on an outcomes-focused methodology and includes specific \"Capabilities and Activities\" that apply to core Zero Trust principals. \r\n\r\n \r\n### Who created this workbook? \r\n\r\nThis workbook was created by a collaboration of Microsoft teams and subject matter experts along with our pilot customers. \r\n\r\n \r\n### Does this workbook cover all 152 “Activities” defined in the Strategy? \r\n\r\nYes, the recommendations, visualizations, and guidance, while centered around the 45 capabilities, will still apply to all 152 activities. This workbook aims to simplify the Target (and Advanced)-level Zero Trust Capabilities and Activities. Based on prior feedback, this workbook may be updated in the future to include further guidance, reporting, and relevant information. ",
"style": "info"
},
"conditionalVisibility": {
@@ -19404,7 +19404,7 @@
{
"type": 1,
"content": {
- "json": "| DoD Zero Trust Pillar | DoD Zero Trust Capability | Recommended Microsoft Solution(s) | Recommended DoD Portal(s) | Recommended Resources |\r\n|--------------------------------|------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\r\n| User 1.x | | | | |\r\n| | 1.1 User Inventory | Entra ID Microsoft Sentinel UEBA Microsoft Defender for Cloud (MDfC) | 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Microsoft Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Microsoft Identity Platform Entra (formerly AAD)](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-overview) 💡 [Microsoft Hybrid Identity with Entra/AAD/AD](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/) 💡 [Using the Inventory in Secure Score - Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory) 💡 [Identity Decision Guide](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/decision-guides/identity/) 💡 [Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/en-us/download/details.aspx?id=54431) 💡 [Identity Security Monitoring](https://github.com/Cloud-Architekt/AzureAD-Attack-Defense/blob/main/IdentitySecurityMonitoring.md#identity-security-monitoring-in-a-hybrid-environment) 💡 [Collect Azure Active Directory (Azure AD) Logs](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics#send-logs-to-azure-monitor) 💡 [Enable User Entity Behavorial Analytics](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics#how-to-enable-user-and-entity-behavior-analytics) 💡 [Deploy Microsoft Defender for Identity](https://learn.microsoft.com/en-us/defender-for-identity/deploy-defender-identity) 💡 [Secure with Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/secure-with-azure-ad-introduction) 💡 [AAD Hybrid Identity](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/plan-hybrid-identity-design-considerations-overview?WT.mc_id=DT-MVP-5001664) 💡 [Azure AD Reports](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/overview-reports?WT.mc_id=DT-MVP-5001664) 💡 [B2B Collaboration](https://learn.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b?WT.mc_id=DT-MVP-5001664) |\r\n| | 1.2 Conditional User Access | Entra ID Conditional Access (CA) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel Microsoft 365 Defender Microsoft Intune | 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) 🔀 [Conditional Access Policy Templates](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Microsoft Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [What is Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview) 💡 [Conditional Access Learning Path](https://learn.microsoft.com/en-us/training/modules/plan-implement-administer-conditional-access/) 💡 [Conditional Access Licensing- Need at least AADP1](https://www.microsoft.com/en-us/security/business/identity-access/azure-active-directory-pricing?rtc=1) 💡 [Conditional Access Design Principles](https://learn.microsoft.com/en-us/azure/architecture/guide/security/conditional-access-design) 💡 [Templates -Secure Foundation & Work Toward ZT](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common) 💡 [Conditional Access Trends and Changes](https://github.com/Cyberlorians/Workbooks/blob/main/ConditionalAccessTrendsandChanges.json) 💡 [Implement Authentication Strengths](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/authentication-strength-choose-the-right-auth-method-for-your/ba-p/2365674) 💡 [Intune Conditional Access](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) 💡 [Using Locations in Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition) |\r\n| | 1.3 Multi-Factor Authentication (MFA) | Entra ID Entra ID - Certificate Based Authorization (CBA) | 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Entra ID - AuthN Methods Activity](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthMethodsActivity/menuId/AuthMethodsActivity) 🔀 [Entra ID - AuthN Methods Policies](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods) 🔀 [Entra ID - AuthN Strengths](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthStrengths) 🔀 [Defender for Cloud Recommendations](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_Security/SecurityMenuBlade/~/5) | 💡 [How MFA Works](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks) 💡 [Setup Multifactor Authenication for Users M365](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) 💡 [Configure the MFA Azure Active Directrory Registration Policies](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) 💡 [Deploy Passwordless Solution](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-deployment) 💡 [Configure Azure AD CBA](https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-certificate-based-authentication) 💡 [Conditional Access Policy - MFA](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy?WT.mc_id=DT-MVP-5001664) 💡 [Plan AAD MFA](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted?WT.mc_id=DT-MVP-5001664) |\r\n| | 1.4 Privileged Access Management (PAM) | Entra ID Entra ID - Privileged Identity Management (PIM) | 🔀 [Entra ID DiagnosticSettings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Entra ID - PIM](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_PIMCommon/CommonMenuBlade/~/quickStart) 🔀 [AAD PIM - Audit History](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_PIMCommon/MyAuditsMenuBlade/~/aadmigratedroles) | 💡 [Plan a Privileged Identity Management Deployment](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-deployment-plan) 💡 [Privileged Identity Management - Why use it with Defender for O365?](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/use-privileged-identity-management-in-defender-for-office-365?view=o365-worldwide) 💡 [Implementing PIM - Micrsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started) 💡 [Secure Roadmap - PIM](https://learn.microsoft.com/en-us/azure/active-directory/roles/security-planning#use-azure-ad-privileged-identity-management) 💡 [PIM for Groups](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/concept-pim-for-groups) 💡 [Configure Approve or Deny Request for AD Roles in PIM](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-approval-workflow) 💡 [Azure Security Benchmark Defender for Identity](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/defender-for-identity-security-baseline) |\r\n| | 1.5 Identity Federation & User Credentialing | Entra ID - Certificate-Based Authorization (CBA) Entra ID - Guest Access | 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Entra ID - AAD Connect](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/GetStarted) 🔀 [Entra ID - Enterprise Apps](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null) 🔀 [Entra ID - Identity Governance](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_ERM/DashboardBlade/~/GettingStarted) | 💡 [Azure Governement - Planning Identity for Azure Government Apps](https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-plan-identity) 💡 [Federated Identity Credentials](https://learn.microsoft.com/en-us/graph/api/resources/federatedidentitycredentials-overview?view=graph-rest-1.0) 💡 [What is Hybrid Identity](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-hybrid-identity) 💡 [Azure AD Certificate Based Authentication](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-certificate-based-authentication) 💡 [Azure AD SCIM](https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups) 💡 [Provisioning with Google Cloud](https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on) 💡 [Provisioning with Amazon Cloud](https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/aws-single-sign-on-provisioning-tutorial) 💡 [Azure AD Application Roles](https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps) 💡 [What is Identity Governace?](https://learn.microsoft.com/en-us/azure/active-directory/governance/identity-governance-overview) |\r\n| | 1.6 Behavioral, Contextual ID, and Biometrics | Microsoft Sentinel UEBA Entra ID - Identity Protection | 🔀 [Azure Face APIs](https://portal.azure.us/#view/Microsoft_Azure_ProjectOxford/CognitiveServicesHub/~/Face) 🔀 [Sentinel - UEBA](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Verified ID](https://portal.azure.us/#view/Microsoft_AAD_DecentralizedIdentity/InitialMenuBlade/~/setupBlade) | 💡 [User Entity Behavorial Analytics - What is it?](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [Windows Hello Biometrics](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise) 💡 [Identify Advanced Threats with UEBA](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [UEBA Reference](https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference?WT.mc_id=AZ-MVP-5004810#ueba-enrichments) 💡 [UEBA Sentinel Content Hub](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/ueba-essentials-solution-now-available-in-content-hub/ba-p/3651074) 💡 [Guided UEBA Investigation Scenarios](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/guided-ueba-investigation-scenarios-to-empower-your-soc/ba-p/1857100) 💡 [Combatting Risky Sign-ins in Azure Active Directory](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/combatting-risky-sign-ins-in-azure-active-directory/ba-p/3724786) 💡 [Securing Workload Identities](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-workload-identity-risk) 💡 [Reprise99 UEBA](https://github.com/reprise99/Sentinel-Queries/tree/main/UEBA) |\r\n| | 1.7 Least Privileged Access | Entra ID - Permissions Azure Policy Entra ID - Privileged Identity Management (PIM) | 🔀 [Entra ID - Enterprise Apps](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null) 🔀 [Entra ID - Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) 🔀 [Entra ID - Identity Protection](https://portal.azure.us/#view/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/~/Overview) 🔀 [Microsoft Defender for Cloud Apps](https://security.microsoft.us/cloudapps/) 🔀 [Application Security Groupss](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FapplicationSecurityGroups) | 💡 [Implementing Least-Privileged Administrative Models](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models) 💡 [Enhance Application Security with Lease Privilege Access Controls](https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-least-privileged-access) 💡 [Identity Protection](https://techcommunity.microsoft.com/t5/itops-talk-blog/what-s-the-difference-between-azure-active-directory-identity/ba-p/1320887?WT.mc_id=itopstalk-newsletter-abartolo) 💡 [Continuous Access Evaluation Monitoring](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-continuous-access-evaluation-troubleshoot#continuous-access-evaluation-sign-in-reporting) |\r\n| | 1.8 Continuous Authentication | Entra ID - Continuous Access Evaluation (CAE) Entra ID - Privileged Identity Management (PIM) Entra ID - Identity Protection | 🔀 [Entra ID - Device Inventory](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Entra ID - Connect Sync (Hybrid Join)](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/ConnectSync) 🔀 [Entra ID - Enterprise Apps](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null) 🔀 [Entra ID - Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) 🔀 [Entra ID - Identity Governance](https://portal.azure.us/#view/Microsoft_AAD_ERM/DashboardBlade/~/GettingStarted) 🔀 [Entra ID - PIM Insights](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/aaddiscovery/resourceId//resourceType/tenant/provider/aadroles) | 💡 [Implement Continuous Access Evaluation Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation) 💡 [Implementing Primary Refresh Token](https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token) 💡 [Privileged Identity Management Insights](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-security-wizard#discovery-and-insights-preview) 💡 [Entra Permissions Managment](https://learn.microsoft.com/en-us/azure/active-directory/cloud-infrastructure-entitlement-management/permissions-management-trial-user-guide) 💡 [Session Management with Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime) |\r\n| | 1.9 Integrated ICAM Platform | Entra Entitlement Management Entra ID Certificate Based Authentication (CBA) | 🔀 [Entra ID - AuthN Methods](https://portal.azure.us/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods) 🔀 [Entra ID - AuthN Strengths](https://portal.azure.us/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthStrengths) 🔀 [Entra ID - AuthN Insights](https://portal.azure.us/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthMethodsActivity) 🔀 [Entra ID - Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) | 💡 [Microsoft Integrated Identity Platform Entra](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-overview) 💡 [Implement Passwordless Auth with Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/auth-passwordless) 💡 [Configure Passwordless Key with Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-security-key) 💡 [Entra Certificate Based Authorization](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-certificate-based-authentication) |\r\n| Device 2.x | | | | |\r\n| | 2.1 Device Inventory | Microsft Entra ID Microsft Entra ID Conditional Access (CA) Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Defender for Identity (MDI) Microsoft Intune | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_DeviceSettings/DevicesMenu/~/overview) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡[M365 Defender Device inventory](https://learn.microsoft.com/en-us/graph/api/resources/intune-graph-overview?view=graph-rest-1.0%22%20%EF%BF%BDHYPERLINK%20%22https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machines-view-overview?view=o365-worldwide) 💡[What is a device identity (Azure Active Directory)?](https://learn.microsoft.com/en-us/azure/active-directory/devices/overview) 💡[Manage device identities by using the Azure portal](https://learn.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal) 💡[Manage your devices and control features with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-devices) 💡[Hybrid Azure AD joined devices](https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-join-hybrid) 💡[Conditional Access policy: Device Compliancy](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡[ZT Guide: Endpoint Zero Trust Deployment Objectives](https://learn.microsoft.com/en-us/security/zero-trust/deploy/endpoints#endpoint-zero-trust-deployment-objectives) 💡[Intune Reporting](https://learn.microsoft.com/en-us/mem/intune/fundamentals/review-logs-using-azure-monitor) ** not yet availble in DoD cloud 💡[Provide Additional Intune Reporting](https://www.linkedin.com/pulse/provide-additional-intune-reporting-data-wmi-iren%C3%A4us-becker/) 💡[Working with Intune in Microsoft Graph](https://learn.microsoft.com/en-us/graph/api/resources/intune-graph-overview?view=graph-rest-1.0) |\r\n| | 2.2 Device Detection and Compliance | Entra ID Conditional Access (CA) Microsoft Defender for Endpoint (MDE) Microsoft Intune | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) | 💡[Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) 💡[Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) 💡[Configure Conditional Access in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) 💡[Scenarios for using Conditional Access with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access-intune-common-ways-use?source=recommendations) |\r\n| | 2.3 Device Authorization w/ Real Time Inspection | Microsft Entra ID Microsoft Intune Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡[Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) 💡[Device discovery overview](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-discovery?view=o365-worldwide) 💡[Learn about Conditional Access and Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) 💡[Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) 💡[Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance) 💡[Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡[Conditional Access insights and reporting workbook - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-insights-reporting) 💡[Plan an Azure Active Directory Conditional Access deployment - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access) 💡[Azure Samples for Conditional Access (PowerShell) - GitHub](https://github.com/Azure-Samples/azure-ad-conditional-access-apis/tree/main/01-configure/powershell)
Additional References: 💡[Track changes to system files and registry keys](https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview) 💡[Connect Microsoft Defender for Cloud alerts to Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-defender-for-cloud) 💡[Deploying and Managing Microsoft Defender for Cloud as Code](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/deploying-and-managing-microsoft-defender-for-cloud-as-code/ba-p/3649653) 💡[Collect data in custom log formats to Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/connect-custom-logs?tabs=DCG) 💡[Azure Monitor Agent overview - Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview) 💡[Use entity behavior analytics to detect advanced threats](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics) |\r\n| | 2.4 Remote Access | Microsft Entra ID Microsft Entra ID Conditional Access (CA) Microsoft Intune Microsoft Defender for Endpoint (MDE) | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) | 💡[Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡[Conditional Access APIs and PowerShell - Microsoft Entra](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-apis) 💡[Device compliance policies in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started) 💡[Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance) 💡[Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection-configure) 💡[Configure Conditional Access in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) 💡[Enhance security with the principle of least privilege](https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-least-privileged-access) 💡[Best practices for Azure AD roles](https://learn.microsoft.com/en-us/azure/active-directory/roles/best-practices) 💡[Least privileged roles by task in Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/roles/delegate-by-task) |\r\n| | 2.5 Partially & Fully Automated Asset, Vulnerability and Patch | Microsoft Intune Microsoft Endpoint Configuration Manager (MECM) Mircosoft Defender for Endpoint (MDE) Threat & Vulnerability Management (TVM) Azure Arc-enabled Servers Azure Automation | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Azure Arc](https://portal.azure.us/#view/Microsoft_Azure_HybridCompute/AzureArcCenterBlade/~/overview) | 💡 [What is Windows Update for Business?](https://learn.microsoft.com/en-us/windows/deployment/update/waas-manage-updates-wufb) 💡 [Microsoft Configuration Manager MECEM](https://learn.microsoft.com/en-us/mem/configmgr/core/understand/introduction) 💡 [Update rings for Windows 10 and later policy in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-10-update-rings?source=recommendations) 💡 [Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure) 💡 [Deploy software updates with Configuration Manager](https://learn.microsoft.com/en-us/mem/configmgr/sum/deploy-use/deploy-software-updates) 💡 [Use Intune to remediate vulnerabilities identified by Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/mem/intune/protect/atp-manage-vulnerabilities) 💡 [Remediate vulnerabilities (Defender for Endpoint)](https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-remediation?view=o365-worldwide) 💡 [Choose how to deliver updates for the Microsoft 365 Apps](https://learn.microsoft.com/en-us/deployoffice/fieldnotes/choose-how-to-deliver-updates) 💡 [Windows Release Health](https://learn.microsoft.com/en-us/windows/release-health/) 💡 [Manage updates and patches for your VMs](https://learn.microsoft.com/en-us/azure/automation/update-management/manage-updates-for-vm) 💡 [Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) |\r\n| | 2.6 Unified Endpoint Management (UEM) & Mobile Device Management (MDM) | Microsoft Intune Azure Arc-enabled Servers Azure Autiomation | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Azure Arc](https://portal.azure.us/#view/Microsoft_Azure_HybridCompute/AzureArcCenterBlade/~/overview) | 💡[What is Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/what-is-intune) 💡[Manage your devices and control device features in Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-devices) 💡[Zero Trust with Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/zero-trust-with-microsoft-intune) 💡[Supported operating systems and browsers in Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/supported-devices-browsers) 💡[Enrollment guide: Microsoft Intune enrollment](https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment) 💡[Manage iOS/iPadOS software update policies in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-ios) 💡[Manage macOS software update policies in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-macos) 💡[Microsoft Intune How-To Guides](https://learn.microsoft.com/en-us/mem/intune/#how-to-guides) 💡[What is Azure Arc-enabled servers?](https://learn.microsoft.com/en-us/azure/azure-arc/servers/overview) 💡[Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) |\r\n| | 2.7 Endpoint & Extended Detection & Response (EDR & XDR) | Microsoft 365 Defender Microsoft Defender for Endpoint (MDE) Microsoft Defednder for Identity (MDI) Microsoft Defender for Office 365 (MDO) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us) | 💡[What is Microsoft Defender for Endpoint?](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide) 💡[Zero Trust with Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/zero-trust-with-microsoft-defender-endpoint?view=o365-worldwide) 💡[What is Microsoft 365 Defender?](https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender?view=o365-worldwide) 💡[Zero Trust with Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/zero-trust-with-microsoft-365-defender?view=o365-worldwide) 💡[Overview of endpoint detection and response (EDR) with Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response?view=o365-worldwide) 💡[Implement Microsoft Sentinel and Microsoft 365 Defender for Zero Trust](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) 💡[Manage endpoint detection and response (EDR) policy for endpoint security in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-edr-policy) 💡[Set up your XDR tools](https://learn.microsoft.com/en-us/security/operations/setup-xdr-tools) 💡[Architect your Microsoft Sentinel workspace](https://learn.microsoft.com/en-us/security/operations/siem-workspace) 💡[Ingest data sources and configure incident detection in Sentinel](https://learn.microsoft.com/en-us/security/operations/ingest-data-sources) 💡[Respond to an incident using Microsoft Sentinel and Microsoft 365 Defender](https://learn.microsoft.com/en-us/security/operations/respond-incident) |\r\n| Application & Workload 3.x | | | | |\r\n| | 3.1 Application Inventory | Entra ID Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) Microsoft Intune | 🔀 [Entra ID Applications - Useage & Insights](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/EnterpriseApplicationsInsightsMenuBlade/~/ApplicationActivity) 🔀 [Application Security Groups](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FapplicationSecurityGroups) 🔀 [Microsoft Defender for Cloud Apps - Discovery](https://security.microsoft.us/cloudapps/discovery) 🔀 [Virtual Network Gateways](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FvirtualNetworkGateways) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Cloud Discovery Setup](https://learn.microsoft.com/en-us/defender-cloud-apps/set-up-cloud-discovery) 💡 [Deploy Intune Softare inventory & Security Policies](https://learn.microsoft.com/en-us/answers/questions/67892/can-we-use-intune-to-inventory-software-on-devices) 💡 [Configure Blocking Unwanted or Unapproved Applications](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus?view=o365-worldwide) 💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) 💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) 💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) 💡 [Active Directory Federation Services Health](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-health-adfs) 💡 [Azure Active Directory Application Audit](https://github.com/jsa2/AADAppAudit#azure-ad-application-analytics-solution) 💡 [Azure Active Directory Application Proxy](https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/what-is-application-proxy) 💡 [Using Microsoft Defender for Cloud Asset Inventory](https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory) 💡 [Working with Discovered Apps](https://learn.microsoft.com/en-us/defender-cloud-apps/discovered-apps) 💡 [Software Inventory](https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/tvm-software-inventory?view=o365-worldwide) |\r\n| | 3.2 Secure Software Development & Integration | Azure Policy Microsoft Defender for Cloud (MDfC) Microsoft Defender for Endpoint (MDE) | 🔀 [Azure DevOps](https://portal.azure.us/#view/AzureTfsExtension/OrganizationsTemplateBlade) 🔀 [Azure Dev Test Center](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.DevTestLab%2Flabs) 🔀 [Azure DevTest Lab](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.DevTestLab%2Flabs) 🔀 [Intune App Security](https://endpoint.microsoft.us) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | |\r\n| | 3.3 Software Risk Management | Microsoft Defender for Cloud Apps (MDA) Mircosoft Defender for Endpoint (MDE) Threat & Vulnerability Management (TVM) Microsoft Intune | 🔀 [Azure Enterprise Apps Portal](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview) 🔀 [Intune Application Security](https://endpoint.microsoft.us/#view/Microsoft_Intune_DeviceSettings/AppsMenu/~/overview) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Manage and Secure Apps In Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/manage-apps) 💡 [App Protection Policies in Intune](https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy) 💡 [Microsoft Container Registry](https://mcr.microsoft.com/) 💡 [GitHub Actaion For Vulnerability Scanning](https://github.com/marketplace/actions/anchore-container-scan) 💡 [Code Scanning with CodeQL](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql) 💡 [Keeping your supply chain secure with Dependabot](https://docs.github.com/en/code-security/dependabot) 💡 [Secure Supply Chain Consumption Framework](https://www.microsoft.com/en-us/securityengineering/opensource/osssscframeworkguide) 💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) 💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) 💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) |\r\n| | 3.4 Resource Authorization & Integration | Entra ID Conditional Access (CA) Entra ID Application Proxy Azure Policy Entra ID Privilleged Identity Management (PIM) Microsoft 365 Defender Microsoft Intune Microsoft Defender for Cloud (MDfC) | 🔀 [Azure Identity Governance](https://portal.azure.us/#blade/Microsoft_AAD_ERM/DashboardBlade) 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Azure Application Proxy](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppProxy) 🔀 [Managed Service Identity](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/6f3afa5d-4b81-4f10-8806-fb75689672da/appId/c75517e9-05c9-49e9-9990-94f68b04ffc4) 🔀 [Intune Application Security](https://endpoint.microsoft.us/#view/Microsoft_Intune_DeviceSettings/AppsMenu/~/overview) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Deploy Microsoft Defender for Cloud - Enterprise Cloud Application Protection](https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction) 💡 [Configure Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/en-us/download/details.aspx?id=54431) 💡 [Deploying Application & Authorization Azure App Services](https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization) 💡 [How to create and deploy a custome Authorization Manager](https://learn.microsoft.com/en-us/dotnet/framework/wcf/extending/how-to-create-a-custom-authorization-manager-for-a-service) 💡 [Configure with Entra Identity Platform](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow) 💡 [How-to Manage Apps Remove User Access with Entra](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/methods-for-removing-user-access) 💡 [Setup Protecting Apps w. Entra Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps) 💡 [Role Based Access Control Configuration with Intune](https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control) |\r\n| | 3.5 Continuous Monitoring and Ongoing Authorizations | Entra ID - Conditional Access (CA) Microsoft Defender for Cloud Apps (MDA) Microsoft Senitnel Playbooks Entra ID - Privileged Identity Management (PIM) | 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [Application Insights](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.insights%2Fcomponents) 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Application Security Groups Portal](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FapplicationSecurityGroups) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) | 💡 [How-to-Build a Successful App Security Program](https://www.microsoft.com/en-us/security/blog/2021/03/29/how-to-build-a-successful-application-security-program/) 💡 [Setting up Hybrid Continuous Monitoring with Sentinel](https://learn.microsoft.com/en-us/azure/architecture/hybrid/hybrid-security-monitoring) 💡 [Deploy Adaptive Appliation Conrols Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls) 💡 [Configure Azure Security Management & Monitoring](https://learn.microsoft.com/en-us/azure/security/fundamentals/management-monitoring-overview) 💡 [Leverage Security Baselines for M365 Apps Enterprise](https://learn.microsoft.com/en-us/deployoffice/security/security-baseline) 💡 [Utilize Application Control for Windows](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/wdac) |\r\n| Data 4.x | | | | |\r\n| | 4.1 Data Catalog Risk Alignment | Purview Data Catalog Purview Data Map Microsoft Sentinel | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Azure Data Classification Service](https://portal.azure.us/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/30ea52ed-e5a7-4e51-a4ea-6c3b96a8be36/appId/7c99d979-3b9c-4342-97dd-3239678fb300) | 💡 [Create a Azrure Data Catalog](https://learn.microsoft.com/en-us/azure/data-catalog/data-catalog-get-started) 💡 [Use the Service Catalog](https://learn.microsoft.com/en-us/system-center/scsm/service-catalog?view=sc-sm-2022) 💡 [Azure Data Catalog FAQ](https://learn.microsoft.com/en-us/azure/data-catalog/data-catalog-frequently-asked-questions) 💡 [Establishing Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) 💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) 💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Set up Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) 💡 [Discover Data & Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) |\r\n| | 4.2 DoD Enterprise Data Governance | Purview Data Governance Purview Data Estate Insights Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Implement Microsoft Purview - IRM & Compliance - DoD Deployments](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) 💡 [Implement a Data Governance Maturity Model Framework](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) 💡 [Deploy Azure Data Governance](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) 💡 [Leverage Microsoft Defender for For Cloud Goverance Rules](https://learn.microsoft.com/en-us/azure/defender-for-cloud/governance-rules) 💡 [Implement Purview Data Governance](https://learn.microsoft.com/en-us/purview/?view=o365-worldwide) 💡 [Purview Data Lineage Machine Learning](https://learn.microsoft.com/en-us/samples/microsoft/purview-machine-learning-lineage-solution-accelerator/purview-machine-learning-lineage-solution-accelerator/) 💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Azure Collaboration Governance](https://learn.microsoft.com/en-us/microsoft-365/solutions/collaboration-governance-overview?view=o365-worldwide) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) 💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/en-us/azure/azure-sql/database/sql-insights-overview?view=azuresql) 💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) |\r\n| | 4.3 Data Labeling and Tagging | Purview Information Protection | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Create Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) 💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/en-us/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) 💡 [Deploy with Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Utilize Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) 💡 [Use the Service Catalog](https://learn.microsoft.com/en-us/system-center/scsm/service-catalog?view=sc-sm-2022) |\r\n| | 4.4 Data Monitoring and Sensing | Purview Data Loss Protection (DLP) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) Microsoft Sentinel | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Azure Monitor Control Service](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/512ba5b8-8ced-42b9-8a94-c93befaf66a1/appId/e933bd07-d2ee-4f1d-933c-3752b819567b) | 💡 [Leverage Data Monitoring & Self Healing](https://learn.microsoft.com/en-us/compliance/assurance/assurance-monitoring-and-self-healing) 💡 [Deploy Microsoft 365 Monitorning](https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-monitoring?view=o365-worldwide) 💡 [Senitnel Data Collection Best Practices](https://learn.microsoft.com/en-us/azure/sentinel/best-practices-data) 💡 [Deploy Microsoft Purview](https://learn.microsoft.com/en-us/purview/purview) 💡 [Utilze Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Configure Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) 💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources) 💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/en-us/azure/azure-sql/database/sql-insights-overview?view=azuresql) |\r\n| | 4.5 Data Encryption & Rights Management | Purview Data Loss Protection (DLP) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) | 🔀 [Azure Encryption](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/21426118-88fd-4b5e-b106-3bd5f098f31a/appId/dbc36ae1-c097-4df9-8d94-343c3d091a76) 🔀 [Azure Rights Management Service](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/5f0c1df8-5bab-4fb3-b1a5-19bdba46c704/appId/00000012-0000-0000-c000-000000000000) 🔀 [M365 Data At Rest Encryption](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/882ab41e-90f7-4f4e-8b24-3503495a83e6/appId/c066d759-24ae-40e7-a56f-027002b5d3e4) 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Utilize Azure Encrption](https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview) 💡 [Deploy Azure Rights Management](https://learn.microsoft.com/en-us/azure/information-protection/what-is-azure-rms) 💡 [Deploy Purview Information Protection](https://learn.microsoft.com/en-us/purview/information-protection) 💡 [Configure Dynamic Key & Encrption Delivery](https://learn.microsoft.com/en-us/azure/media-services/latest/drm-content-protection-concept) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) |\r\n| | 4.6 Data Loss Prevention (DLP) | Purview Data Loss Protection (DLP) Purview Information Protection | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Endpoint DLP](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/780e77f3-df11-4525-b201-973a1b691cab/appId/c98e5057-edde-4666-b301-186a01b4dc58) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Implement Data Loss & Prevention (DLP)](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp) 💡 [Informaiton Protection & Data Loss and Prevention- GITHUB LAB](https://microsoft.github.io/ComplianceCxE/dag/mip-dlp/) 💡 [Deploy Adaptive Protection- Data Loss & Protections](https://learn.microsoft.com/en-us/purview/dlp-adaptive-protection-learn) 💡 [Apply Rules for DLP Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/data-loss-prevention/dlp-rule-application) 💡 [Utilize Trainable Classifiers](https://learn.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/en-us/azure/information-protection/aip-classification-and-protection) |\r\n| | 4.7 Data Access Control | Microsoft Defender for Cloud Apps (MDA) Entra ID Conditional Access (CA) Purview Insider Risk Management Purview Information Protection Purview Data Loss Prevention (DLP) Microsoft Intune | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Entra ID Privileged Identity Management](https://portal.azure.us/#blade/Microsoft_Azure_PIMCommon/CommonMenuBlade) 🔀 [Entra ID Conditional Access](https://portal.azure.us/#blade/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade) 🔀 [Azure Internal Access Scope Portal](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/a0779651-4c07-4392-a11f-a1694cb497b1/appId/c29427db-9ecc-4750-ad93-d256863f2e37) 🔀 [Virtual Network Terminal Access Points](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.network%2Fvirtualnetworktaps) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Azure Data Explorer](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Kusto%2Fclusters) | 💡 [Configure Conditional Access in Azure Active Directory](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview) 💡 [Use Conditional Access Microsoft Intune](https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access) 💡 [Use Conditional Access APIs](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-apis) 💡 [Deploy Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access#deploy-conditional-access-policies) 💡 [Use Conditional Access With Data Explorer](https://learn.microsoft.com/en-us/azure/data-explorer/security-conditional-access) 💡 [Deploy Common Conditional Access Policies](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common?tabs=secure-foundation) 💡 [Build Conditional Access](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policies) |\r\n| Network & Environment 5.x | | | | |\r\n| | 5.1 Data Flow Mapping | Azure Monitor Net Insights Network Watcher Microsoft Defender for Endpoint (MDE) | 🔀 [Network Security Perimeters](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FnetworkSecurityPerimeters) 🔀 [Network Interfaces](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2Fnetworkinterfaces) 🔀 [Azure Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) 🔀 [Azure Firewall](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FazureFirewalls) 🔀 [Web Application Firewall](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FFrontDoorWebApplicationFirewallPolicies) 🔀 [DDoS Protection Plans](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FddosProtectionPlans) 🔀 [Firewall Manager](https://portal.azure.us/#view/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/~/firewallManagerOverview) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Use Data Flow Mapping Power Platform](https://learn.microsoft.com/en-us/power-query/dataflows/create-use) 💡 [User Azure Network Traffic Analytics](https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics) 💡 [Azure Blue Print ](https://learn.microsoft.com/en-us/azure/governance/blueprints/overview) 💡 [Leverage Azure Data Visualization with Data Explorer](https://learn.microsoft.com/en-us/azure/data-explorer/viz-overview) 💡 [Use Power Automate for Event Tagging](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-microsoft-flow?view=o365-worldwide) 💡 [Secure & Govern Workloads with Network-level Segmentation](https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/network-level-segmentation) 💡 [Deploy Software Defined Netoworking](https://learn.microsoft.com/en-us/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) 💡 [Manage Software Defined Netoworking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/manage-sdn) 💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) |\r\n| | 5.2 Software Defined Networking (SDN) | Secure Access Service Edge (SASE) Microsoft Network Secuirty Groups (NSG) Entra ID App Proxy | 🔀 [Manage Virtual Network](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks) 🔀 [Network Security Groups](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FNetworkSecurityGroups) 🔀 [Network Managers](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FnetworkManagers) 🔀 [Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) 🔀 [Network Security Perimeters](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FnetworkSecurityPerimeters) 🔀 [Entra App Proxy](https://portal.azure.us/#view/Microsoft_AAD_IAM/AppProxyOverviewBlade) | 💡 [Use Secure Access Service Edge SASE - Software Defined Networking Zero Trust](https://www.microsoft.com/en-us/security/business/security-101/what-is-sase) 💡 [Software Defined Network Monitoring using Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/software-defined-monitoring-using-automated-notebooks-and-azure/ba-p/2587775) 💡 [Plan Software Defined Netoworking](https://learn.microsoft.com/en-us/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) 💡 [Implementing Software Defined Networking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/) 💡 [Manage Software Detined Netoworking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/manage/manage-sdn) 💡 [Deploy Software Defined Networking](https://learn.microsoft.com/en-us/windows-server/networking/sdn/deploy/deploy-a-software-defined-network-infrastructure-using-scripts) 💡 [Secure the Network Controller](https://learn.microsoft.com/en-us/azure-stack/hci/manage/nc-security) 💡 [SDN for Win Server 2019 and 2022](https://learn.microsoft.com/en-us/windows-server/networking/sdn/sdn-whats-new) 💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/en-us/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) 💡 [IPV6 Config Interface](https://learn.microsoft.com/en-us/javascript/api/%40azure/arm-databoxedge-profile-2020-09-01-hybrid/ipv6config?view=azure-node-latest&wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Leverage IPV6 for Azure Virtual Networks](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Segementation Security Strategies](https://learn.microsoft.com/en-us/azure/well-architected/security/design-segmentation) 💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) 💡 [Utilize Microsoft Packet Monitor](https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon) |\r\n| | 5.3 Macro Segmentation | Azure Subscription Azure VNet(s) Azure VNet Manager Network Security Groups (NSG) Azure Firewall | 🔀 [Impletment Network Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) 🔀 [Azure Features for Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation#azure-features-for-segmentation) 🔀 [Network Service](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.HybridNetwork%2Fpublishers%2Fnetworkservicedesigngroups) 🔀 [Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) | 💡 [Impletment Network Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation) 💡 [Azure Features for Segmentation](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation#azure-features-for-segmentation) 💡 [Segementation Security Strategies](https://learn.microsoft.com/en-us/azure/well-architected/security/design-segmentation) 💡 [Network Service Designs](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.HybridNetwork%2Fpublishers%2Fnetworkservicedesigngroups) 💡 [Network Watcher](https://portal.azure.com/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) |\r\n| | 5.4 Micro Segmentation | Azure Security Groups (ASG) Entra ID App Proxy Microsoft Tunnel | 🔀 [Virtual Networks Termal Access Points](https://portal.azure.us/#view/HubsExtension/BrowseResourceBlade/resourceType/microsoft.network%2Fvirtualnetworktaps) 🔀 [Conditional Access](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Overview) 🔀 [Cloud Access Routers](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Orbital%2FcloudAccessRouters) 🔀 [Entra ID Conditional Access](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Overview) 🔀 [Azure Monitor Networks](https://portal.azure.us/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/networkInsights) 🔀 [Azure Connection Monitor](https://portal.azure.us/#view/Microsoft_Azure_FlowLog/ConnectionMonitorV2ViewModel) 🔀 [Azure Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview/menuId~/%7B%22target%22%3A%7B%7D%7D) | 💡 [Enabling JIT Access Controls](https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Conditional Access Block Access by Location](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-location?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Secure Networks with Zero Trust](https://learn.microsoft.com/en-us/security/zero-trust/deploy/networks) 💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/design-network-segmentation?wtmc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Microsoft Packet Monitor](https://learn.microsoft.com/en-us/windows-server/networking/technologies/pktmon/pktmon) |\r\n| Automation & Orchestration 6.x | | | | |\r\n| | 6.1 Policy Decision Point (PDP) & Policy Orchestration | Entra ID Conditional Access (CA) Azure Policy Azure Automation Azure ML Azure Firewall Microsoft Sentinel | 🔀 [Azure Automation](https://portal.azure.us/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/d2175af3-6958-4008-83ac-ac2b81eafac7/appId/fc75330b-179d-49af-87dd-3b1acf6827fa) 🔀 [Azure Machine Learning](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.MachineLearningServices%2Fworkspaces) 🔀 [Azure Policy](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyMenuBlade) 🔀 [Azure Virtual Desktop](https://portal.azure.us/#view/Microsoft_Azure_WVD/WvdManagerMenuBlade/~/overview) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) | 💡 [Visibility,Automation and Orchestration with Zero Trust](https://learn.microsoft.com/en-us/) 💡 [Azure Orchestration for Azure Security Policy](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/azure-policy-security-baseline) 💡 [Configuration Analyzer for Security Policies](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies?view=o365-worldwide) 💡 [Azure Automation Overview](https://learn.microsoft.com/en-us/azure/automation/overview) 💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/automation-security-baseline) 💡 [Azure Policy](https://learn.microsoft.com/en-us/azure/governance/policy/overview) 💡 [What is Azure Firewall?](https://learn.microsoft.com/en-us/azure/firewall/overview) 💡 [Apply Zero Trust principles to a hub virtual network in Azure](https://learn.microsoft.com/en-us/security/zero-trust/azure-infrastructure-networking) 💡 [Management of Role Permissions and Automation](https://learn.microsoft.com/en-us/azure/automation/automation-role-based-access-control) 💡 [Using Azure Machine Learning to assign roles](https://learn.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler) 💡 [Azure AD Seccurity Groups ML](https://learn.microsoft.com/en-us/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler#use-azure-ad-security-groups-to-manage-workspace-access) |\r\n| | 6.2 Critical Process Automation | Microsoft Power Automate Azure Logic Apps Microsoft Sentinel Playbooks Microsoft 365 Defender Automated Investigation & Response | 🔀 [Azure Automation](https://portal.azure.us/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/d2175af3-6958-4008-83ac-ac2b81eafac7/appId/fc75330b-179d-49af-87dd-3b1acf6827fa) 🔀 [Microsoft Sentinel Automation Blade](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_Security_Insights/MainMenuBlade/~/Automationl) 🔀 [Azure Logic Apps Blade](https://portal.azure.us/?feature.msaljs=true#view/HubsExtension/BrowseResource/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Azure Automation Overview](https://learn.microsoft.com/en-us/azure/automation/overview) 💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/automation-security-baseline) 💡 [Visibility, Automation, and Orchestration with Zero Trust](https://learn.microsoft.com/en-us/) 💡 [Automation in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automation) 💡 [Automate Threat Response with Playbooks](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) 💡 [Automated Investigation & Response M365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) 💡 [Power Automate U.S Government](https://learn.microsoft.com/en-us/power-automate/us-govt) |\r\n| | 6.3 Machine Learning | Microsoft Sentinel Fusion ML Microsoft Sentinel Bring Your Own Machine Learning (BYOML) Microsoft Defender for Cloud (MDfC) Azure ML | 🔀 [Azure Machine Learning](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.MachineLearningServices%2Fworkspaces) 🔀 [Power Automate](https://make.gov.powerautomate.us/) 🔀 [Power Platform Admin Center](https://admin.appsplatform.us/) 🔀 [Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Defender for Cloud](https://portal.azure.us/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0) | 💡 [Advanced multistage attack detection in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/fusion) 💡 [Bring your own Machine Learning (ML) into Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/bring-your-own-ml) 💡 [Azure Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/?view=azureml-api-2) 💡 [Enterprise Security & Governance w. Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/concept-enterprise-security?view=azureml-api-2) 💡 [Azure Government Isolaiton Guidelines using AI & ML](https://learn.microsoft.com/en-us/azure/azure-government/documentation-government-impact-level-5) 💡 [Quick Start Azure Machine Learning](https://learn.microsoft.com/en-us/azure/machine-learning/tutorial-azure-ml-in-a-day?view=azureml-api-2) 💡 [Azure security baseline for Azure Machine Learning](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/machine-learning-security-baseline) |\r\n| | 6.4 Artificial Intelligence | Microsoft Sentinel Fusion ML Microsoft Sentinel Tailored AI Azure ML | 🔀 [Azure AI Services](https://portal.azure.us/#blade/Microsoft_Azure_ProjectOxford/CognitiveServicesHub) 🔀 [Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Defender for Cloud](https://portal.azure.us/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0) | 💡 [AI Security Services](https://learn.microsoft.com/en-us/azure/ai-services/security-features) 💡 [Senintel Automation](https://learn.microsoft.com/en-us/azure/sentinel/automation) 💡 [AI ID & Access Risk Based Controls](https://azure.microsoft.com/en-us/products/category/identity/) 💡 [Implement Sentinel & M365 Defender for XDR - AI Driven Zero Trust ](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) 💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) |\r\n| | 6.5 Security Orchestration, Automation & Response (SOAR) | Microsoft 365 Defender Automated investigation and response Microsoft Sentinel Playbooks Microsoft Defender for Cloud (MDfC) Azure Logic Apps | 🔀 [Sentinel SIEM-SOAR](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Logic Apps](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [Microsoft Defender for Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) | 💡 [Security Ochestration, Automation & Response (SOAR) In Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automation) 💡 [Sentinel SOAR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/how-to-use-azure-sentinel-for-incident-response-orchestration/ba-p/2242397) 💡 [Microsoft Sentinel SOAR Content Catalog](https://learn.microsoft.com/en-us/azure/sentinel/sentinel-soar-content) 💡 [Automate Threat Response with Playbooks in Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) 💡 [Automated investigation and response in Microsoft 365 Defender](https://learn.microsoft.com/en-us/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) 💡 [Workflow Automation in Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation) 💡 [SOAR Best Practices](https://www.microsoft.com/en-us/security/business/security-101/what-is-soar#SOARbestpractices) 💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) |\r\n| | 6.6 API Standardization | Azure API Management Azure Monitor Log Analytics Azure Logic Apps Azure Policy | 🔀 [API Management Services](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.ApiManagement%2Fservice) 🔀 [API Connections](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Web%2Fconnections) 🔀 [API Playground](https://portal.azure.us/#blade/Microsoft_Azure_Resources/ArmPlayground) 🔀 [Azure Logic Apps](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Logic%2Fworkflows) | 💡 [Microsft API Management & Security](https://azure.microsoft.com/en-us/products/api-management/) 💡 [Mitigate OWASP Top 10 Security Threats Using Microsoft API Management](https://learn.microsoft.com/en-us/azure/api-management/mitigate-owasp-api-threats) 💡 [Security Baselines for API Management](https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/api-management-security-baseline) 💡 [Secure and Compliant APIs for a Hybrid and Multi Cloud World](https://azure.microsoft.com/en-us/blog/secure-and-compliant-apis-for-a-hybrid-and-multi-cloud-world/) 💡 [Web API Design Best Practice](https://learn.microsoft.com/en-us/azure/architecture/best-practices/api-design) 💡 [Monitor & Protect Your APIs](https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-use-azure-monitor) |\r\n| | 6.7 Security Operations Center (SOC) & Incident Response (IR) | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) Microsoft 365 Defender | 🔀 [Sentinel SIEM-SOAR](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Logic Apps](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [Microsoft Defender for Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Security Operations In Azure](https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-security-operations) 💡 [Microsoft SOC Best Practices Landing Page](https://www.microsoft.com/en-us/security/business/security-101/what-is-a-security-operations-center-soc?ef_id=_k_ce7dcd6e8f2d1919667ca9a72f733870_k_&OCID=AIDcmmdamuj0pc_SEM__k_ce7dcd6e8f2d1919667ca9a72f733870_k_&msclkid=ce7dcd6e8f2d1919667ca9a72f733870) 💡 [Playbook for Modernizing Security Operations Centers](https://www.microsoft.com/en-us/security/blog/2021/02/11/a-playbook-for-modernizing-security-operations/) 💡 [CISO Series Lessons Learned from Microsoft's SOC](https://www.microsoft.com/en-us/security/blog/2019/10/07/ciso-series-lessons-learned-from-the-microsoft-soc-part-3a-choosing-soc-tools/) 💡 [Integrating Microsoft 365 Defender into your security operations](https://learn.microsoft.com/en-us/microsoft-365/security/defender/integrate-microsoft-365-defender-secops?view=o365-worldwide) |\r\n| Visibility & Analytics 7.x | | | | |\r\n| | 7.1 Log All Traffic (Network, Data, Apps, Users) | Azure Monitor Log Analytics Microsoft Sentinel | 🔀 [Log Analytics Workspace](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.OperationalInsights%2Fworkspaces) 🔀 [Log Query Packs](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.OperationalInsights%2Fquerypacks) 🔀 [Sign-in Activity Logs](https://portal.azure.us/#blade/Microsoft_AAD_IAM/SignInEventsV3Blade) 🔀 [Activity Logs](https://portal.azure.us/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/activityLog) 🔀 [Audit Log](https://portal.azure.us/#blade/Microsoft_AAD_IAM/AuditEventsV2PillsBlade) 🔀 [Operation Log](https://portal.azure.us/#blade/Microsoft_Azure_Resources/OperationLogsBlade) 🔀 [Microsoft Azure Log Search Alerts](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/c134d63b-957f-4cf7-8a34-d744aa8804df/appId/f6b60513-f290-450e-a2f3-9930de61c5e7) | 💡 [Azure Log Analytics](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-overview) 💡 [Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/overview) 💡 [Audit Logging and Monitoring](https://learn.microsoft.com/en-us/compliance/assurance/assurance-audit-logging) 💡 [Maturity Model for Log Management M2131](https://techcommunity.microsoft.com/t5/public-sector-blog/microsoft-sentinel-maturity-model-for-event-log-management-m-21/ba-p/3074336) 💡 [Device Log Capture - Intune](https://learn.microsoft.com/en-us/mem/intune/remote-actions/collect-diagnostics) 💡 [Application Logging](https://learn.microsoft.com/en-us/sql/relational-databases/performance/view-the-windows-application-log-windows-10?view=sql-server-ver16) 💡 [User Access Logging](https://learn.microsoft.com/en-us/windows-server/administration/user-access-logging/get-started-with-user-access-logging) 💡 [Azure Infrastructure Logs](https://learn.microsoft.com/en-us/azure/well-architected/scalability/monitor-infrastructure) 💡 [Network Logging](https://learn.microsoft.com/en-us/azure/azure-web-pubsub/howto-troubleshoot-network-trace) 💡 [Supported Logs for Network](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/supported-logs/microsoft-network-networkmanagers-logs) |\r\n| | 7.2 Security Information and Event Management (SIEM) | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) Microsoft 365 Defender | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Microsoft Defender for Cloud](https://portal.azure.us/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0) | 💡[Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/overview) 💡[Implement Sentinel & M365](https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview) 💡[Unified SIEM & XDR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-unified-microsoft-siem-and-xdr-github-community/ba-p/3249533) 💡[Stream Alerts Defender for Cloud to SIEM](https://learn.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem#stream-alerts-to-azure-sentinel) 💡[Azure Sentinel Github Repo](https://github.com/Azure/Azure-Sentinel) 💡[Sentinel & SOC Analysis Process](https://learn.microsoft.com/en-us/azure/sentinel/migration-security-operations-center-processes) 💡[Microsoft Sentinel Skill Up Training](https://learn.microsoft.com/en-us/azure/sentinel/skill-up-resources) |\r\n| | 7.3 Common Security and Risk Analytics | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Security Baselines](https://endpoint.microsoft.us/#home) | 💡[Microsoft Security Response Center Security Updates Guide](https://msrc.microsoft.com/update-guide) 💡[Explore Risks to Sensitive Data Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/data-security-review-risks) 💡[Identify & Analyze Risks Across Your Environment](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-attack-path) 💡[Cloud Security Posture Management](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management) 💡[Microsoft Cloud Security Benchmark](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-regulatory-compliance) |\r\n| | 7.4 User and Entity Behavior Analytics | Microsoft Sentinel UEBA Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Identity (MDI) Entra ID Conditional Access (CA) Purview Insider Risk Management | 🔀 [Behavior Analytics Insights](https://portal.azure.us/#@jubradfogov.onmicrosoft.us/asset/Microsoft_OperationsManagementSuite_Workspace/Solution/subscriptions/3ab4869f-acc9-49ec-a399-12efd162502f/resourceGroups/fedlogana/providers/Microsoft.OperationsManagement/solutions/BehaviorAnalyticsInsights(loganalytics) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [ID Threats with User and Entity Behavior Analytics](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [Enable Entity Behavior Analytics to Detect Threats](https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics) 💡 [Microsoft Sentinel UEBA Reference](https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference) 💡 [Investigate Incidents with UEBA](https://learn.microsoft.com/en-us/azure/sentinel/investigate-with-ueba) 💡 [Discover and Protect Sensitive Information in your Organization](https://learn.microsoft.com/en-us/defender-cloud-apps/tutorial-dlp) 💡 [Purview Insider Risk Management](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) |\r\n| | 7.5 Threat Intelligence Integration | Microsoft Sentinel Threat Intelligence (TI) Microsoft Graph Security Indicators Microsoft Defender Threat Intelligence (MDTI) | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Microsoft Threat Intelligence Portal](https://ti.defender.microsoft.com/) | 💡[Microsoft Threat Intelligence](https://learn.microsoft.com/en-us/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti) 💡[Microsoft Security Graph API](https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview?view=graph-rest-beta) 💡[Create Threat Intelligence Indicators](https://learn.microsoft.com/en-us/graph/api/tiindicators-post?view=graph-rest-beta&tabs=http) 💡[Threat intelligence integration in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/threat-intelligence-integration) 💡[Bring Your Own Threat Intelligence Feeds](https://learn.microsoft.com/en-us/defender-cloud-apps/additional-integrations) 💡[Accessing the Threat Intelligence Portal](https://learn.microsoft.com/en-us/defender/threat-intelligence/learn-how-to-access-microsoft-defender-threat-intelligence-and-make-customizations-in-your-portal) |\r\n| | 7.6 Automated Dynamic Policies | Entra ID Protection Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel Fusion ML Microsoft Sentinel Bring Your Own Machine Learning (BYOML) Microsoft Sentinel Playbooks Microsoft Intune Azure Automation Purview Insider Risk Management | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Logic Apps](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Azure Automation](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/d2175af3-6958-4008-83ac-ac2b81eafac7/appId/fc75330b-179d-49af-87dd-3b1acf6827fa) 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) | 💡[Automate Threat Response with Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks) 💡[Adaptive Protection - Microsoft Purview](https://www.microsoft.com/en-us/security/blog/2023/02/06/introducing-adaptive-protection-in-microsoft-purview-people-centric-data-protection-for-a-multiplatform-world/#:~:text=With%20Adaptive%20Protection%2C%20DLP%20policies%20become%20dynamic%2C%20ensuring,efficient%20and%20empowered%20to%20do%20more%20with%20less.) 💡[Adaptive Policy Scopes M365](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/using-adaptive-policy-scopes-to-apply-m365-retention-to-shared/ba-p/3053641#:~:text=Back%20in%20October,in%20Microsoft%20365.) 💡[Adaptive Application Controls](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls) 💡[AI-Driven Adaptive Device Controls Microsoft Defender for Endpoint](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/ai-driven-adaptive-protection-in-microsoft-defender-for-endpoint/ba-p/2966491) 💡[AI-Driven Adaptive Protection Against Human Operated Ransomeware](https://www.microsoft.com/en-us/security/blog/2021/11/15/ai-driven-adaptive-protection-against-human-operated-ransomware/) 💡[Microsoft Defender for Cloud Automated Security Posture Management](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management) 💡[Improve your network security posture with adaptive network hardening](https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-network-hardening) 💡[What is Microsoft Entra ID Protection?](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection) 💡[Azure Automation update management](https://learn.microsoft.com/en-us/azure/architecture/hybrid/azure-update-mgmt) 💡[Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/windows-update-for-business-configure) |"
+ "json": "| DoD Zero Trust Pillar | DoD Zero Trust Capability | Recommended Microsoft Solution(s) | Recommended DoD Portal(s) | Recommended Resources |\r\n|--------------------------------|------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\r\n| User 1.x | | | | |\r\n| | 1.1 User Inventory | Entra ID Microsoft Sentinel UEBA Microsoft Defender for Cloud (MDfC) | 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Microsoft Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Microsoft Identity Platform Entra (formerly AAD)](https://learn.microsoft.com/azure/active-directory/develop/v2-overview) 💡 [Microsoft Hybrid Identity with Entra/AAD/AD](https://learn.microsoft.com/azure/active-directory/hybrid/) 💡 [Using the Inventory in Secure Score - Microsoft Defender for Cloud](https://learn.microsoft.com/azure/defender-for-cloud/asset-inventory) 💡 [Identity Decision Guide](https://learn.microsoft.com/azure/cloud-adoption-framework/decision-guides/identity/) 💡 [Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/download/details.aspx?id=54431) 💡 [Identity Security Monitoring](https://github.com/Cloud-Architekt/AzureAD-Attack-Defense/blob/main/IdentitySecurityMonitoring.md#identity-security-monitoring-in-a-hybrid-environment) 💡 [Collect Azure Active Directory (Azure AD) Logs](https://learn.microsoft.com/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics#send-logs-to-azure-monitor) 💡 [Enable User Entity Behavorial Analytics](https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics#how-to-enable-user-and-entity-behavior-analytics) 💡 [Deploy Microsoft Defender for Identity](https://learn.microsoft.com/defender-for-identity/deploy-defender-identity) 💡 [Secure with Azure Active Directory](https://learn.microsoft.com/azure/active-directory/fundamentals/secure-with-azure-ad-introduction) 💡 [AAD Hybrid Identity](https://learn.microsoft.com/azure/active-directory/hybrid/connect/plan-hybrid-identity-design-considerations-overview?WT.mc_id=DT-MVP-5001664) 💡 [Azure AD Reports](https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports?WT.mc_id=DT-MVP-5001664) 💡 [B2B Collaboration](https://learn.microsoft.com/azure/active-directory/external-identities/what-is-b2b?WT.mc_id=DT-MVP-5001664) |\r\n| | 1.2 Conditional User Access | Entra ID Conditional Access (CA) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel Microsoft 365 Defender Microsoft Intune | 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) 🔀 [Conditional Access Policy Templates](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Microsoft Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [What is Conditional Access](https://learn.microsoft.com/azure/active-directory/conditional-access/overview) 💡 [Conditional Access Learning Path](https://learn.microsoft.com/training/modules/plan-implement-administer-conditional-access/) 💡 [Conditional Access Licensing- Need at least AADP1](https://www.microsoft.com/security/business/identity-access/azure-active-directory-pricing?rtc=1) 💡 [Conditional Access Design Principles](https://learn.microsoft.com/azure/architecture/guide/security/conditional-access-design) 💡 [Templates -Secure Foundation & Work Toward ZT](https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common) 💡 [Conditional Access Trends and Changes](https://github.com/Cyberlorians/Workbooks/blob/main/ConditionalAccessTrendsandChanges.json) 💡 [Implement Authentication Strengths](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/authentication-strength-choose-the-right-auth-method-for-your/ba-p/2365674) 💡 [Intune Conditional Access](https://learn.microsoft.com/mem/intune/protect/conditional-access) 💡 [Using Locations in Conditional Access Policies](https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition) |\r\n| | 1.3 Multi-Factor Authentication (MFA) | Entra ID Entra ID - Certificate Based Authorization (CBA) | 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Entra ID - AuthN Methods Activity](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthMethodsActivity/menuId/AuthMethodsActivity) 🔀 [Entra ID - AuthN Methods Policies](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods) 🔀 [Entra ID - AuthN Strengths](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthStrengths) 🔀 [Defender for Cloud Recommendations](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_Security/SecurityMenuBlade/~/5) | 💡 [How MFA Works](https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks) 💡 [Setup Multifactor Authenication for Users M365](https://learn.microsoft.com/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) 💡 [Configure the MFA Azure Active Directrory Registration Policies](https://learn.microsoft.com/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy) 💡 [Deploy Passwordless Solution](https://learn.microsoft.com/azure/active-directory/authentication/howto-authentication-passwordless-deployment) 💡 [Configure Azure AD CBA](https://learn.microsoft.com/azure/active-directory/authentication/how-to-certificate-based-authentication) 💡 [Conditional Access Policy - MFA](https://learn.microsoft.com/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy?WT.mc_id=DT-MVP-5001664) 💡 [Plan AAD MFA](https://learn.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted?WT.mc_id=DT-MVP-5001664) |\r\n| | 1.4 Privileged Access Management (PAM) | Entra ID Entra ID - Privileged Identity Management (PIM) | 🔀 [Entra ID DiagnosticSettings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Entra ID - PIM](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_PIMCommon/CommonMenuBlade/~/quickStart) 🔀 [AAD PIM - Audit History](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_PIMCommon/MyAuditsMenuBlade/~/aadmigratedroles) | 💡 [Plan a Privileged Identity Management Deployment](https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan) 💡 [Privileged Identity Management - Why use it with Defender for O365?](https://learn.microsoft.com/microsoft-365/security/office-365-security/use-privileged-identity-management-in-defender-for-office-365?view=o365-worldwide) 💡 [Implementing PIM - Micrsoft Entra](https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-getting-started) 💡 [Secure Roadmap - PIM](https://learn.microsoft.com/azure/active-directory/roles/security-planning#use-azure-ad-privileged-identity-management) 💡 [PIM for Groups](https://learn.microsoft.com/azure/active-directory/privileged-identity-management/concept-pim-for-groups) 💡 [Configure Approve or Deny Request for AD Roles in PIM](https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-approval-workflow) 💡 [Azure Security Benchmark Defender for Identity](https://learn.microsoft.com/security/benchmark/azure/baselines/defender-for-identity-security-baseline) |\r\n| | 1.5 Identity Federation & User Credentialing | Entra ID - Certificate-Based Authorization (CBA) Entra ID - Guest Access | 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Entra ID - AAD Connect](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/GetStarted) 🔀 [Entra ID - Enterprise Apps](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null) 🔀 [Entra ID - Identity Governance](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_ERM/DashboardBlade/~/GettingStarted) | 💡 [Azure Governement - Planning Identity for Azure Government Apps](https://learn.microsoft.com/azure/azure-government/documentation-government-plan-identity) 💡 [Federated Identity Credentials](https://learn.microsoft.com/graph/api/resources/federatedidentitycredentials-overview?view=graph-rest-1.0) 💡 [What is Hybrid Identity](https://learn.microsoft.com/azure/active-directory/hybrid/whatis-hybrid-identity) 💡 [Azure AD Certificate Based Authentication](https://learn.microsoft.com/azure/active-directory/authentication/concept-certificate-based-authentication) 💡 [Azure AD SCIM](https://learn.microsoft.com/azure/active-directory/app-provisioning/use-scim-to-provision-users-and-groups) 💡 [Provisioning with Google Cloud](https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on) 💡 [Provisioning with Amazon Cloud](https://learn.microsoft.com/azure/active-directory/saas-apps/aws-single-sign-on-provisioning-tutorial) 💡 [Azure AD Application Roles](https://learn.microsoft.com/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps) 💡 [What is Identity Governace?](https://learn.microsoft.com/azure/active-directory/governance/identity-governance-overview) |\r\n| | 1.6 Behavioral, Contextual ID, and Biometrics | Microsoft Sentinel UEBA Entra ID - Identity Protection | 🔀 [Azure Face APIs](https://portal.azure.us/#view/Microsoft_Azure_ProjectOxford/CognitiveServicesHub/~/Face) 🔀 [Sentinel - UEBA](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Verified ID](https://portal.azure.us/#view/Microsoft_AAD_DecentralizedIdentity/InitialMenuBlade/~/setupBlade) | 💡 [User Entity Behavorial Analytics - What is it?](https://learn.microsoft.com/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [Windows Hello Biometrics](https://learn.microsoft.com/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise) 💡 [Identify Advanced Threats with UEBA](https://learn.microsoft.com/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [UEBA Reference](https://learn.microsoft.com/azure/sentinel/ueba-reference?WT.mc_id=AZ-MVP-5004810#ueba-enrichments) 💡 [UEBA Sentinel Content Hub](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/ueba-essentials-solution-now-available-in-content-hub/ba-p/3651074) 💡 [Guided UEBA Investigation Scenarios](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/guided-ueba-investigation-scenarios-to-empower-your-soc/ba-p/1857100) 💡 [Combatting Risky Sign-ins in Azure Active Directory](https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/combatting-risky-sign-ins-in-azure-active-directory/ba-p/3724786) 💡 [Securing Workload Identities](https://learn.microsoft.com/azure/active-directory/identity-protection/concept-workload-identity-risk) 💡 [Reprise99 UEBA](https://github.com/reprise99/Sentinel-Queries/tree/main/UEBA) |\r\n| | 1.7 Least Privileged Access | Entra ID - Permissions Azure Policy Entra ID - Privileged Identity Management (PIM) | 🔀 [Entra ID - Enterprise Apps](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null) 🔀 [Entra ID - Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) 🔀 [Entra ID - Identity Protection](https://portal.azure.us/#view/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/~/Overview) 🔀 [Microsoft Defender for Cloud Apps](https://security.microsoft.us/cloudapps/) 🔀 [Application Security Groupss](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FapplicationSecurityGroups) | 💡 [Implementing Least-Privileged Administrative Models](https://learn.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models) 💡 [Enhance Application Security with Lease Privilege Access Controls](https://learn.microsoft.com/azure/active-directory/develop/secure-least-privileged-access) 💡 [Identity Protection](https://techcommunity.microsoft.com/t5/itops-talk-blog/what-s-the-difference-between-azure-active-directory-identity/ba-p/1320887?WT.mc_id=itopstalk-newsletter-abartolo) 💡 [Continuous Access Evaluation Monitoring](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-continuous-access-evaluation-troubleshoot#continuous-access-evaluation-sign-in-reporting) |\r\n| | 1.8 Continuous Authentication | Entra ID - Continuous Access Evaluation (CAE) Entra ID - Privileged Identity Management (PIM) Entra ID - Identity Protection | 🔀 [Entra ID - Device Inventory](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Entra ID - Connect Sync (Hybrid Join)](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_Connect_Provisioning/AADConnectMenuBlade/~/ConnectSync) 🔀 [Entra ID - Enterprise Apps](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null) 🔀 [Entra ID - Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) 🔀 [Entra ID - Identity Governance](https://portal.azure.us/#view/Microsoft_AAD_ERM/DashboardBlade/~/GettingStarted) 🔀 [Entra ID - PIM Insights](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/aaddiscovery/resourceId//resourceType/tenant/provider/aadroles) | 💡 [Implement Continuous Access Evaluation Microsoft Entra](https://learn.microsoft.com/azure/active-directory/conditional-access/concept-continuous-access-evaluation) 💡 [Implementing Primary Refresh Token](https://learn.microsoft.com/azure/active-directory/devices/concept-primary-refresh-token) 💡 [Privileged Identity Management Insights](https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-security-wizard#discovery-and-insights-preview) 💡 [Entra Permissions Managment](https://learn.microsoft.com/azure/active-directory/cloud-infrastructure-entitlement-management/permissions-management-trial-user-guide) 💡 [Session Management with Conditional Access](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime) |\r\n| | 1.9 Integrated ICAM Platform | Entra Entitlement Management Entra ID Certificate Based Authentication (CBA) | 🔀 [Entra ID - AuthN Methods](https://portal.azure.us/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods) 🔀 [Entra ID - AuthN Strengths](https://portal.azure.us/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthStrengths) 🔀 [Entra ID - AuthN Insights](https://portal.azure.us/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthMethodsActivity) 🔀 [Entra ID - Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/CaTemplates.ReactView) | 💡 [Microsoft Integrated Identity Platform Entra](https://learn.microsoft.com/azure/active-directory/develop/v2-overview) 💡 [Implement Passwordless Auth with Microsoft Entra](https://learn.microsoft.com/azure/active-directory/fundamentals/auth-passwordless) 💡 [Configure Passwordless Key with Microsoft Entra](https://learn.microsoft.com/azure/active-directory/authentication/howto-authentication-passwordless-security-key) 💡 [Entra Certificate Based Authorization](https://learn.microsoft.com/azure/active-directory/authentication/concept-certificate-based-authentication) |\r\n| Device 2.x | | | | |\r\n| | 2.1 Device Inventory | Microsft Entra ID Microsft Entra ID Conditional Access (CA) Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Defender for Identity (MDI) Microsoft Intune | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_DeviceSettings/DevicesMenu/~/overview) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡[M365 Defender Device inventory](https://learn.microsoft.com/graph/api/resources/intune-graph-overview?view=graph-rest-1.0%22%20%EF%BF%BDHYPERLINK%20%22https://learn.microsoft.com/microsoft-365/security/defender-endpoint/machines-view-overview?view=o365-worldwide) 💡[What is a device identity (Azure Active Directory)?](https://learn.microsoft.com/azure/active-directory/devices/overview) 💡[Manage device identities by using the Azure portal](https://learn.microsoft.com/azure/active-directory/devices/device-management-azure-portal) 💡[Manage your devices and control features with Microsoft Intune](https://learn.microsoft.com/mem/intune/fundamentals/manage-devices) 💡[Hybrid Azure AD joined devices](https://learn.microsoft.com/azure/active-directory/devices/concept-azure-ad-join-hybrid) 💡[Conditional Access policy: Device Compliancy](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡[ZT Guide: Endpoint Zero Trust Deployment Objectives](https://learn.microsoft.com/security/zero-trust/deploy/endpoints#endpoint-zero-trust-deployment-objectives) 💡[Intune Reporting](https://learn.microsoft.com/mem/intune/fundamentals/review-logs-using-azure-monitor) ** not yet availble in DoD cloud 💡[Provide Additional Intune Reporting](https://www.linkedin.com/pulse/provide-additional-intune-reporting-data-wmi-iren%C3%A4us-becker/) 💡[Working with Intune in Microsoft Graph](https://learn.microsoft.com/graph/api/resources/intune-graph-overview?view=graph-rest-1.0) |\r\n| | 2.2 Device Detection and Compliance | Entra ID Conditional Access (CA) Microsoft Defender for Endpoint (MDE) Microsoft Intune | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) | 💡[Device compliance policies in Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/device-compliance-get-started) 💡[Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/mem/intune/protect/advanced-threat-protection-configure) 💡[Configure Conditional Access in Microsoft Defender for Endpoint](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) 💡[Scenarios for using Conditional Access with Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/conditional-access-intune-common-ways-use?source=recommendations) |\r\n| | 2.3 Device Authorization w/ Real Time Inspection | Microsft Entra ID Microsoft Intune Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡[Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/mem/intune/protect/advanced-threat-protection-configure) 💡[Device discovery overview](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/device-discovery?view=o365-worldwide) 💡[Learn about Conditional Access and Intune](https://learn.microsoft.com/mem/intune/protect/conditional-access) 💡[Device compliance policies in Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/device-compliance-get-started) 💡[Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/actions-for-noncompliance) 💡[Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡[Conditional Access insights and reporting workbook - Microsoft Entra](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-insights-reporting) 💡[Plan an Azure Active Directory Conditional Access deployment - Microsoft Entra](https://learn.microsoft.com/azure/active-directory/conditional-access/plan-conditional-access) 💡[Azure Samples for Conditional Access (PowerShell) - GitHub](https://github.com/Azure-Samples/azure-ad-conditional-access-apis/tree/main/01-configure/powershell)
Additional References: 💡[Track changes to system files and registry keys](https://learn.microsoft.com/azure/defender-for-cloud/file-integrity-monitoring-overview) 💡[Connect Microsoft Defender for Cloud alerts to Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/connect-defender-for-cloud) 💡[Deploying and Managing Microsoft Defender for Cloud as Code](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/deploying-and-managing-microsoft-defender-for-cloud-as-code/ba-p/3649653) 💡[Collect data in custom log formats to Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/connect-custom-logs?tabs=DCG) 💡[Azure Monitor Agent overview - Azure Monitor](https://learn.microsoft.com/azure/azure-monitor/agents/agents-overview) 💡[Use entity behavior analytics to detect advanced threats](https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics) |\r\n| | 2.4 Remote Access | Microsft Entra ID Microsft Entra ID Conditional Access (CA) Microsoft Intune Microsoft Defender for Endpoint (MDE) | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) | 💡[Require compliant, hybrid joined devices, or MFA - Microsoft Entra](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device) 💡[Conditional Access APIs and PowerShell - Microsoft Entra](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-apis) 💡[Device compliance policies in Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/device-compliance-get-started) 💡[Configure compliance policies with actions for noncompliance in Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/actions-for-noncompliance) 💡[Configure Microsoft Defender for Endpoint in Intune](https://learn.microsoft.com/mem/intune/protect/advanced-threat-protection-configure) 💡[Configure Conditional Access in Microsoft Defender for Endpoint](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide) 💡[Enhance security with the principle of least privilege](https://learn.microsoft.com/azure/active-directory/develop/secure-least-privileged-access) 💡[Best practices for Azure AD roles](https://learn.microsoft.com/azure/active-directory/roles/best-practices) 💡[Least privileged roles by task in Azure Active Directory](https://learn.microsoft.com/azure/active-directory/roles/delegate-by-task) |\r\n| | 2.5 Partially & Fully Automated Asset, Vulnerability and Patch | Microsoft Intune Microsoft Endpoint Configuration Manager (MECM) Mircosoft Defender for Endpoint (MDE) Threat & Vulnerability Management (TVM) Azure Arc-enabled Servers Azure Automation | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Azure Arc](https://portal.azure.us/#view/Microsoft_Azure_HybridCompute/AzureArcCenterBlade/~/overview) | 💡 [What is Windows Update for Business?](https://learn.microsoft.com/windows/deployment/update/waas-manage-updates-wufb) 💡 [Microsoft Configuration Manager MECEM](https://learn.microsoft.com/mem/configmgr/core/understand/introduction) 💡 [Update rings for Windows 10 and later policy in Intune](https://learn.microsoft.com/mem/intune/protect/windows-10-update-rings?source=recommendations) 💡 [Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/mem/intune/protect/windows-update-for-business-configure) 💡 [Deploy software updates with Configuration Manager](https://learn.microsoft.com/mem/configmgr/sum/deploy-use/deploy-software-updates) 💡 [Use Intune to remediate vulnerabilities identified by Microsoft Defender for Endpoint](https://learn.microsoft.com/mem/intune/protect/atp-manage-vulnerabilities) 💡 [Remediate vulnerabilities (Defender for Endpoint)](https://learn.microsoft.com/microsoft-365/security/defender-vulnerability-management/tvm-remediation?view=o365-worldwide) 💡 [Choose how to deliver updates for the Microsoft 365 Apps](https://learn.microsoft.com/deployoffice/fieldnotes/choose-how-to-deliver-updates) 💡 [Windows Release Health](https://learn.microsoft.com/windows/release-health/) 💡 [Manage updates and patches for your VMs](https://learn.microsoft.com/azure/automation/update-management/manage-updates-for-vm) 💡 [Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) |\r\n| | 2.6 Unified Endpoint Management (UEM) & Mobile Device Management (MDM) | Microsoft Intune Azure Arc-enabled Servers Azure Autiomation | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Azure Arc](https://portal.azure.us/#view/Microsoft_Azure_HybridCompute/AzureArcCenterBlade/~/overview) | 💡[What is Microsoft Intune](https://learn.microsoft.com/mem/intune/fundamentals/what-is-intune) 💡[Manage your devices and control device features in Microsoft Intune](https://learn.microsoft.com/mem/intune/fundamentals/manage-devices) 💡[Zero Trust with Microsoft Intune](https://learn.microsoft.com/mem/intune/fundamentals/zero-trust-with-microsoft-intune) 💡[Supported operating systems and browsers in Intune](https://learn.microsoft.com/mem/intune/fundamentals/supported-devices-browsers) 💡[Enrollment guide: Microsoft Intune enrollment](https://learn.microsoft.com/mem/intune/fundamentals/deployment-guide-enrollment) 💡[Manage iOS/iPadOS software update policies in Intune](https://learn.microsoft.com/mem/intune/protect/software-updates-ios) 💡[Manage macOS software update policies in Intune](https://learn.microsoft.com/mem/intune/protect/software-updates-macos) 💡[Microsoft Intune How-To Guides](https://learn.microsoft.com/mem/intune/#how-to-guides) 💡[What is Azure Arc-enabled servers?](https://learn.microsoft.com/azure/azure-arc/servers/overview) 💡[Automate your patching using Azure Arc and Azure Automation](https://techcommunity.microsoft.com/t5/manufacturing/automate-your-patching-using-azure-arc-and-azure-automation/ba-p/3214141) |\r\n| | 2.7 Endpoint & Extended Detection & Response (EDR & XDR) | Microsoft 365 Defender Microsoft Defender for Endpoint (MDE) Microsoft Defednder for Identity (MDI) Microsoft Defender for Office 365 (MDO) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us) | 💡[What is Microsoft Defender for Endpoint?](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide) 💡[Zero Trust with Microsoft Defender for Endpoint](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/zero-trust-with-microsoft-defender-endpoint?view=o365-worldwide) 💡[What is Microsoft 365 Defender?](https://learn.microsoft.com/microsoft-365/security/defender/microsoft-365-defender?view=o365-worldwide) 💡[Zero Trust with Microsoft 365 Defender](https://learn.microsoft.com/microsoft-365/security/defender/zero-trust-with-microsoft-365-defender?view=o365-worldwide) 💡[Overview of endpoint detection and response (EDR) with Microsoft 365 Defender](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response?view=o365-worldwide) 💡[Implement Microsoft Sentinel and Microsoft 365 Defender for Zero Trust](https://learn.microsoft.com/security/operations/siem-xdr-overview) 💡[Manage endpoint detection and response (EDR) policy for endpoint security in Intune](https://learn.microsoft.com/mem/intune/protect/endpoint-security-edr-policy) 💡[Set up your XDR tools](https://learn.microsoft.com/security/operations/setup-xdr-tools) 💡[Architect your Microsoft Sentinel workspace](https://learn.microsoft.com/security/operations/siem-workspace) 💡[Ingest data sources and configure incident detection in Sentinel](https://learn.microsoft.com/security/operations/ingest-data-sources) 💡[Respond to an incident using Microsoft Sentinel and Microsoft 365 Defender](https://learn.microsoft.com/security/operations/respond-incident) |\r\n| Application & Workload 3.x | | | | |\r\n| | 3.1 Application Inventory | Entra ID Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) Microsoft Intune | 🔀 [Entra ID Applications - Useage & Insights](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_AAD_IAM/EnterpriseApplicationsInsightsMenuBlade/~/ApplicationActivity) 🔀 [Application Security Groups](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FapplicationSecurityGroups) 🔀 [Microsoft Defender for Cloud Apps - Discovery](https://security.microsoft.us/cloudapps/discovery) 🔀 [Virtual Network Gateways](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FvirtualNetworkGateways) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Cloud Discovery Setup](https://learn.microsoft.com/defender-cloud-apps/set-up-cloud-discovery) 💡 [Deploy Intune Softare inventory & Security Policies](https://learn.microsoft.com/answers/questions/67892/can-we-use-intune-to-inventory-software-on-devices) 💡 [Configure Blocking Unwanted or Unapproved Applications](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus?view=o365-worldwide) 💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) 💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) 💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) 💡 [Active Directory Federation Services Health](https://learn.microsoft.com/azure/active-directory/hybrid/connect/how-to-connect-health-adfs) 💡 [Azure Active Directory Application Audit](https://github.com/jsa2/AADAppAudit#azure-ad-application-analytics-solution) 💡 [Azure Active Directory Application Proxy](https://learn.microsoft.com/azure/active-directory/app-proxy/what-is-application-proxy) 💡 [Using Microsoft Defender for Cloud Asset Inventory](https://learn.microsoft.com/azure/defender-for-cloud/asset-inventory) 💡 [Working with Discovered Apps](https://learn.microsoft.com/defender-cloud-apps/discovered-apps) 💡 [Software Inventory](https://learn.microsoft.com/microsoft-365/security/defender-vulnerability-management/tvm-software-inventory?view=o365-worldwide) |\r\n| | 3.2 Secure Software Development & Integration | Azure Policy Microsoft Defender for Cloud (MDfC) Microsoft Defender for Endpoint (MDE) | 🔀 [Azure DevOps](https://portal.azure.us/#view/AzureTfsExtension/OrganizationsTemplateBlade) 🔀 [Azure Dev Test Center](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.DevTestLab%2Flabs) 🔀 [Azure DevTest Lab](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.DevTestLab%2Flabs) 🔀 [Intune App Security](https://endpoint.microsoft.us) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | |\r\n| | 3.3 Software Risk Management | Microsoft Defender for Cloud Apps (MDA) Mircosoft Defender for Endpoint (MDE) Threat & Vulnerability Management (TVM) Microsoft Intune | 🔀 [Azure Enterprise Apps Portal](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview) 🔀 [Intune Application Security](https://endpoint.microsoft.us/#view/Microsoft_Intune_DeviceSettings/AppsMenu/~/overview) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Manage and Secure Apps In Intune](https://learn.microsoft.com/mem/intune/fundamentals/manage-apps) 💡 [App Protection Policies in Intune](https://learn.microsoft.com/mem/intune/apps/app-protection-policy) 💡 [Microsoft Container Registry](https://mcr.microsoft.com/) 💡 [GitHub Actaion For Vulnerability Scanning](https://github.com/marketplace/actions/anchore-container-scan) 💡 [Code Scanning with CodeQL](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql) 💡 [Keeping your supply chain secure with Dependabot](https://docs.github.com/en/code-security/dependabot) 💡 [Secure Supply Chain Consumption Framework](https://www.microsoft.com/securityengineering/opensource/osssscframeworkguide) 💡 [Generating Software Bill of Materials (SBOM)](https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/) 💡 [Microsoft Open Source Software Bill of Materials SBOM](https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-software-bill-of-materials-sbom-generation-tool/) 💡 [Github Software Bill of Materials - SBOM-Tool](https://github.com/microsoft/sbom-tool) |\r\n| | 3.4 Resource Authorization & Integration | Entra ID Conditional Access (CA) Entra ID Application Proxy Azure Policy Entra ID Privilleged Identity Management (PIM) Microsoft 365 Defender Microsoft Intune Microsoft Defender for Cloud (MDfC) | 🔀 [Azure Identity Governance](https://portal.azure.us/#blade/Microsoft_AAD_ERM/DashboardBlade) 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Azure Application Proxy](https://portal.azure.us/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppProxy) 🔀 [Managed Service Identity](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/6f3afa5d-4b81-4f10-8806-fb75689672da/appId/c75517e9-05c9-49e9-9990-94f68b04ffc4) 🔀 [Intune Application Security](https://endpoint.microsoft.us/#view/Microsoft_Intune_DeviceSettings/AppsMenu/~/overview) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Deploy Microsoft Defender for Cloud - Enterprise Cloud Application Protection](https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction) 💡 [Configure Microsoft Cloud Identity for Enterprise Architects](https://www.microsoft.com/download/details.aspx?id=54431) 💡 [Deploying Application & Authorization Azure App Services](https://learn.microsoft.com/azure/app-service/overview-authentication-authorization) 💡 [How to create and deploy a custome Authorization Manager](https://learn.microsoft.com/dotnet/framework/wcf/extending/how-to-create-a-custom-authorization-manager-for-a-service) 💡 [Configure with Entra Identity Platform](https://learn.microsoft.com/azure/active-directory/develop/v2-oauth2-auth-code-flow) 💡 [How-to Manage Apps Remove User Access with Entra](https://learn.microsoft.com/azure/active-directory/manage-apps/methods-for-removing-user-access) 💡 [Setup Protecting Apps w. Entra Conditional Access](https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps) 💡 [Role Based Access Control Configuration with Intune](https://learn.microsoft.com/mem/intune/fundamentals/role-based-access-control) |\r\n| | 3.5 Continuous Monitoring and Ongoing Authorizations | Entra ID - Conditional Access (CA) Microsoft Defender for Cloud Apps (MDA) Microsoft Senitnel Playbooks Entra ID - Privileged Identity Management (PIM) | 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) 🔀 [Application Insights](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.insights%2Fcomponents) 🔀 [Entra ID](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 🔀 [Application Security Groups Portal](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FapplicationSecurityGroups) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) | 💡 [How-to-Build a Successful App Security Program](https://www.microsoft.com/security/blog/2021/03/29/how-to-build-a-successful-application-security-program/) 💡 [Setting up Hybrid Continuous Monitoring with Sentinel](https://learn.microsoft.com/azure/architecture/hybrid/hybrid-security-monitoring) 💡 [Deploy Adaptive Appliation Conrols Microsoft Defender for Cloud](https://learn.microsoft.com/azure/defender-for-cloud/adaptive-application-controls) 💡 [Configure Azure Security Management & Monitoring](https://learn.microsoft.com/azure/security/fundamentals/management-monitoring-overview) 💡 [Leverage Security Baselines for M365 Apps Enterprise](https://learn.microsoft.com/deployoffice/security/security-baseline) 💡 [Utilize Application Control for Windows](https://learn.microsoft.com/windows/security/application-security/application-control/windows-defender-application-control/wdac) |\r\n| Data 4.x | | | | |\r\n| | 4.1 Data Catalog Risk Alignment | Purview Data Catalog Purview Data Map Microsoft Sentinel | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Azure Data Classification Service](https://portal.azure.us/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/30ea52ed-e5a7-4e51-a4ea-6c3b96a8be36/appId/7c99d979-3b9c-4342-97dd-3239678fb300) | 💡 [Create a Azrure Data Catalog](https://learn.microsoft.com/azure/data-catalog/data-catalog-get-started) 💡 [Use the Service Catalog](https://learn.microsoft.com/system-center/scsm/service-catalog?view=sc-sm-2022) 💡 [Azure Data Catalog FAQ](https://learn.microsoft.com/azure/data-catalog/data-catalog-frequently-asked-questions) 💡 [Establishing Sensitivity Labels](https://learn.microsoft.com/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) 💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) 💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Set up Azure Rights Management](https://learn.microsoft.com/azure/information-protection/what-is-azure-rms) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/azure/information-protection/aip-classification-and-protection) 💡 [Sentinel Data Connectors](https://learn.microsoft.com/azure/sentinel/connect-data-sources) 💡 [Discover Data & Apply Sensitivity Labels Automatically](https://learn.microsoft.com/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) |\r\n| | 4.2 DoD Enterprise Data Governance | Purview Data Governance Purview Data Estate Insights Microsoft Defender for Cloud (MDfC) Microsoft Sentinel | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/machines?category=endpoints) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Implement Microsoft Purview - IRM & Compliance - DoD Deployments](https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) 💡 [Implement a Data Governance Maturity Model Framework](https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) 💡 [Deploy Azure Data Governance](https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/govern) 💡 [Leverage Microsoft Defender for For Cloud Goverance Rules](https://learn.microsoft.com/azure/defender-for-cloud/governance-rules) 💡 [Implement Purview Data Governance](https://learn.microsoft.com/purview/?view=o365-worldwide) 💡 [Purview Data Lineage Machine Learning](https://learn.microsoft.com/samples/microsoft/purview-machine-learning-lineage-solution-accelerator/purview-machine-learning-lineage-solution-accelerator/) 💡 [Get Started with Trainable Classifiers](https://learn.microsoft.com/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Azure Collaboration Governance](https://learn.microsoft.com/microsoft-365/solutions/collaboration-governance-overview?view=o365-worldwide) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/azure/information-protection/aip-classification-and-protection) 💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/azure/sentinel/connect-data-sources) 💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/azure/azure-sql/database/sql-insights-overview?view=azuresql) 💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) |\r\n| | 4.3 Data Labeling and Tagging | Purview Information Protection | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5) | 💡 [Create Sensitivity Labels](https://learn.microsoft.com/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide) 💡 [Create and Publish Sensitivity Labels](https://learn.microsoft.com/microsoft-365/compliance/create-sensitivity-labels?view=o365-worldwide) 💡 [Deploy with Trainable Classifiers](https://learn.microsoft.com/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Utilize Rights Management](https://learn.microsoft.com/azure/information-protection/what-is-azure-rms) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/azure/information-protection/aip-classification-and-protection) 💡 [Apply Sensitivity Labels Automatically](https://learn.microsoft.com/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide) 💡 [Use the Service Catalog](https://learn.microsoft.com/system-center/scsm/service-catalog?view=sc-sm-2022) |\r\n| | 4.4 Data Monitoring and Sensing | Purview Data Loss Protection (DLP) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) Microsoft Sentinel | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Azure Monitor Control Service](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/512ba5b8-8ced-42b9-8a94-c93befaf66a1/appId/e933bd07-d2ee-4f1d-933c-3752b819567b) | 💡 [Leverage Data Monitoring & Self Healing](https://learn.microsoft.com/compliance/assurance/assurance-monitoring-and-self-healing) 💡 [Deploy Microsoft 365 Monitorning](https://learn.microsoft.com/microsoft-365/enterprise/microsoft-365-monitoring?view=o365-worldwide) 💡 [Senitnel Data Collection Best Practices](https://learn.microsoft.com/azure/sentinel/best-practices-data) 💡 [Deploy Microsoft Purview](https://learn.microsoft.com/purview/purview) 💡 [Utilze Azure Rights Management](https://learn.microsoft.com/azure/information-protection/what-is-azure-rms) 💡 [Configure Azure Information Protection](https://learn.microsoft.com/azure/information-protection/aip-classification-and-protection) 💡 [Configure Sentinel Data Connectors](https://learn.microsoft.com/azure/sentinel/connect-data-sources) 💡 [Monitor Your SQL Deployments](https://learn.microsoft.com/azure/azure-sql/database/sql-insights-overview?view=azuresql) |\r\n| | 4.5 Data Encryption & Rights Management | Purview Data Loss Protection (DLP) Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Endpoint (MDE) | 🔀 [Azure Encryption](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/21426118-88fd-4b5e-b106-3bd5f098f31a/appId/dbc36ae1-c097-4df9-8d94-343c3d091a76) 🔀 [Azure Rights Management Service](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/5f0c1df8-5bab-4fb3-b1a5-19bdba46c704/appId/00000012-0000-0000-c000-000000000000) 🔀 [M365 Data At Rest Encryption](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/882ab41e-90f7-4f4e-8b24-3503495a83e6/appId/c066d759-24ae-40e7-a56f-027002b5d3e4) 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Utilize Azure Encrption](https://learn.microsoft.com/azure/security/fundamentals/encryption-overview) 💡 [Deploy Azure Rights Management](https://learn.microsoft.com/azure/information-protection/what-is-azure-rms) 💡 [Deploy Purview Information Protection](https://learn.microsoft.com/purview/information-protection) 💡 [Configure Dynamic Key & Encrption Delivery](https://learn.microsoft.com/azure/media-services/latest/drm-content-protection-concept) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/azure/information-protection/aip-classification-and-protection) |\r\n| | 4.6 Data Loss Prevention (DLP) | Purview Data Loss Protection (DLP) Purview Information Protection | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Endpoint DLP](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/780e77f3-df11-4525-b201-973a1b691cab/appId/c98e5057-edde-4666-b301-186a01b4dc58) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Implement Data Loss & Prevention (DLP)](https://learn.microsoft.com/purview/dlp-learn-about-dlp) 💡 [Informaiton Protection & Data Loss and Prevention- GITHUB LAB](https://microsoft.github.io/ComplianceCxE/dag/mip-dlp/) 💡 [Deploy Adaptive Protection- Data Loss & Protections](https://learn.microsoft.com/purview/dlp-adaptive-protection-learn) 💡 [Apply Rules for DLP Exchange Online](https://learn.microsoft.com/exchange/security-and-compliance/data-loss-prevention/dlp-rule-application) 💡 [Utilize Trainable Classifiers](https://learn.microsoft.com/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide) 💡 [Deploy Azure Information Protection](https://learn.microsoft.com/azure/information-protection/aip-classification-and-protection) |\r\n| | 4.7 Data Access Control | Microsoft Defender for Cloud Apps (MDA) Entra ID Conditional Access (CA) Purview Insider Risk Management Purview Information Protection Purview Data Loss Prevention (DLP) Microsoft Intune | 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Entra ID Privileged Identity Management](https://portal.azure.us/#blade/Microsoft_Azure_PIMCommon/CommonMenuBlade) 🔀 [Entra ID Conditional Access](https://portal.azure.us/#blade/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade) 🔀 [Azure Internal Access Scope Portal](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/a0779651-4c07-4392-a11f-a1694cb497b1/appId/c29427db-9ecc-4750-ad93-d256863f2e37) 🔀 [Virtual Network Terminal Access Points](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.network%2Fvirtualnetworktaps) 🔀 [Microsoft Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Entra ID - Diagnostic Settings](https://portal.azure.us/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/DiagnosticSettings) 🔀 [Conditional Access Policies](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Azure Data Explorer](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Kusto%2Fclusters) | 💡 [Configure Conditional Access in Azure Active Directory](https://learn.microsoft.com/azure/active-directory/conditional-access/overview) 💡 [Use Conditional Access Microsoft Intune](https://learn.microsoft.com/mem/intune/protect/conditional-access) 💡 [Use Conditional Access APIs](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-apis) 💡 [Deploy Conditional Access Policies](https://learn.microsoft.com/azure/active-directory/conditional-access/plan-conditional-access#deploy-conditional-access-policies) 💡 [Use Conditional Access With Data Explorer](https://learn.microsoft.com/azure/data-explorer/security-conditional-access) 💡 [Deploy Common Conditional Access Policies](https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common?tabs=secure-foundation) 💡 [Build Conditional Access](https://learn.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policies) |\r\n| Network & Environment 5.x | | | | |\r\n| | 5.1 Data Flow Mapping | Azure Monitor Net Insights Network Watcher Microsoft Defender for Endpoint (MDE) | 🔀 [Network Security Perimeters](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FnetworkSecurityPerimeters) 🔀 [Network Interfaces](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2Fnetworkinterfaces) 🔀 [Azure Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) 🔀 [Azure Firewall](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FazureFirewalls) 🔀 [Web Application Firewall](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FFrontDoorWebApplicationFirewallPolicies) 🔀 [DDoS Protection Plans](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FddosProtectionPlans) 🔀 [Firewall Manager](https://portal.azure.us/#view/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/~/firewallManagerOverview) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Use Data Flow Mapping Power Platform](https://learn.microsoft.com/power-query/dataflows/create-use) 💡 [User Azure Network Traffic Analytics](https://learn.microsoft.com/azure/network-watcher/traffic-analytics) 💡 [Azure Blue Print ](https://learn.microsoft.com/azure/governance/blueprints/overview) 💡 [Leverage Azure Data Visualization with Data Explorer](https://learn.microsoft.com/azure/data-explorer/viz-overview) 💡 [Use Power Automate for Event Tagging](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/api-microsoft-flow?view=o365-worldwide) 💡 [Secure & Govern Workloads with Network-level Segmentation](https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/network-level-segmentation) 💡 [Deploy Software Defined Netoworking](https://learn.microsoft.com/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) 💡 [Manage Software Defined Netoworking](https://learn.microsoft.com/windows-server/networking/sdn/manage/manage-sdn) 💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) |\r\n| | 5.2 Software Defined Networking (SDN) | Secure Access Service Edge (SASE) Microsoft Network Secuirty Groups (NSG) Entra ID App Proxy | 🔀 [Manage Virtual Network](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks) 🔀 [Network Security Groups](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FNetworkSecurityGroups) 🔀 [Network Managers](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FnetworkManagers) 🔀 [Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) 🔀 [Network Security Perimeters](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FnetworkSecurityPerimeters) 🔀 [Entra App Proxy](https://portal.azure.us/#view/Microsoft_AAD_IAM/AppProxyOverviewBlade) | 💡 [Use Secure Access Service Edge SASE - Software Defined Networking Zero Trust](https://www.microsoft.com/security/business/security-101/what-is-sase) 💡 [Software Defined Network Monitoring using Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/software-defined-monitoring-using-automated-notebooks-and-azure/ba-p/2587775) 💡 [Plan Software Defined Netoworking](https://learn.microsoft.com/azure-stack/hci/concepts/plan-software-defined-networking-infrastructure) 💡 [Implementing Software Defined Networking](https://learn.microsoft.com/windows-server/networking/sdn/) 💡 [Manage Software Detined Netoworking](https://learn.microsoft.com/windows-server/networking/sdn/manage/manage-sdn) 💡 [Deploy Software Defined Networking](https://learn.microsoft.com/windows-server/networking/sdn/deploy/deploy-a-software-defined-network-infrastructure-using-scripts) 💡 [Secure the Network Controller](https://learn.microsoft.com/azure-stack/hci/manage/nc-security) 💡 [SDN for Win Server 2019 and 2022](https://learn.microsoft.com/windows-server/networking/sdn/sdn-whats-new) 💡 [Key Components of Software Defined Networking Data Sheet](https://learn.microsoft.com/windows-server/networking/sdn/technologies/Software-Defined-Networking-Technologies) 💡 [IPV6 Config Interface](https://learn.microsoft.com/javascript/api/%40azure/arm-databoxedge-profile-2020-09-01-hybrid/ipv6config?view=azure-node-latest&wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Leverage IPV6 for Azure Virtual Networks](https://learn.microsoft.com/azure/virtual-network/ip-services/ipv6-overview?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Segementation Security Strategies](https://learn.microsoft.com/azure/well-architected/security/design-segmentation) 💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/azure/well-architected/security/design-network-segmentation) 💡 [Utilize Microsoft Packet Monitor](https://learn.microsoft.com/windows-server/networking/technologies/pktmon/pktmon) |\r\n| | 5.3 Macro Segmentation | Azure Subscription Azure VNet(s) Azure VNet Manager Network Security Groups (NSG) Azure Firewall | 🔀 [Impletment Network Segmentation](https://learn.microsoft.com/azure/well-architected/security/design-network-segmentation) 🔀 [Azure Features for Segmentation](https://learn.microsoft.com/azure/well-architected/security/design-network-segmentation#azure-features-for-segmentation) 🔀 [Network Service](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.HybridNetwork%2Fpublishers%2Fnetworkservicedesigngroups) 🔀 [Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) | 💡 [Impletment Network Segmentation](https://learn.microsoft.com/azure/well-architected/security/design-network-segmentation) 💡 [Azure Features for Segmentation](https://learn.microsoft.com/azure/well-architected/security/design-network-segmentation#azure-features-for-segmentation) 💡 [Segementation Security Strategies](https://learn.microsoft.com/azure/well-architected/security/design-segmentation) 💡 [Network Service Designs](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.HybridNetwork%2Fpublishers%2Fnetworkservicedesigngroups) 💡 [Network Watcher](https://portal.azure.com/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview) |\r\n| | 5.4 Micro Segmentation | Azure Security Groups (ASG) Entra ID App Proxy Microsoft Tunnel | 🔀 [Virtual Networks Termal Access Points](https://portal.azure.us/#view/HubsExtension/BrowseResourceBlade/resourceType/microsoft.network%2Fvirtualnetworktaps) 🔀 [Conditional Access](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Overview) 🔀 [Cloud Access Routers](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Orbital%2FcloudAccessRouters) 🔀 [Entra ID Conditional Access](https://portal.azure.us/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Overview) 🔀 [Azure Monitor Networks](https://portal.azure.us/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/networkInsights) 🔀 [Azure Connection Monitor](https://portal.azure.us/#view/Microsoft_Azure_FlowLog/ConnectionMonitorV2ViewModel) 🔀 [Azure Network Watcher](https://portal.azure.us/#view/Microsoft_Azure_Network/NetworkWatcherMenuBlade/~/overview/menuId~/%7B%22target%22%3A%7B%7D%7D) | 💡 [Enabling JIT Access Controls](https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-usage?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Conditional Access Block Access by Location](https://learn.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-location?wt.mc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Secure Networks with Zero Trust](https://learn.microsoft.com/security/zero-trust/deploy/networks) 💡 [Implement Network Segmentation Paterns On Azure](https://learn.microsoft.com/azure/well-architected/security/design-network-segmentation?wtmc_id=searchAPI_azureportal_inproduct_rmskilling&sessionId=a3b01375fbf840fe9b8065377eabbd7d) 💡 [Microsoft Packet Monitor](https://learn.microsoft.com/windows-server/networking/technologies/pktmon/pktmon) |\r\n| Automation & Orchestration 6.x | | | | |\r\n| | 6.1 Policy Decision Point (PDP) & Policy Orchestration | Entra ID Conditional Access (CA) Azure Policy Azure Automation Azure ML Azure Firewall Microsoft Sentinel | 🔀 [Azure Automation](https://portal.azure.us/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/d2175af3-6958-4008-83ac-ac2b81eafac7/appId/fc75330b-179d-49af-87dd-3b1acf6827fa) 🔀 [Azure Machine Learning](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.MachineLearningServices%2Fworkspaces) 🔀 [Azure Policy](https://portal.azure.us/#blade/Microsoft_Azure_Policy/PolicyMenuBlade) 🔀 [Azure Virtual Desktop](https://portal.azure.us/#view/Microsoft_Azure_WVD/WvdManagerMenuBlade/~/overview) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) | 💡 [Visibility,Automation and Orchestration with Zero Trust](https://learn.microsoft.com/) 💡 [Azure Orchestration for Azure Security Policy](https://learn.microsoft.com/security/benchmark/azure/baselines/azure-policy-security-baseline) 💡 [Configuration Analyzer for Security Policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/configuration-analyzer-for-security-policies?view=o365-worldwide) 💡 [Azure Automation Overview](https://learn.microsoft.com/azure/automation/overview) 💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/security/benchmark/azure/baselines/automation-security-baseline) 💡 [Azure Policy](https://learn.microsoft.com/azure/governance/policy/overview) 💡 [What is Azure Firewall?](https://learn.microsoft.com/azure/firewall/overview) 💡 [Apply Zero Trust principles to a hub virtual network in Azure](https://learn.microsoft.com/security/zero-trust/azure-infrastructure-networking) 💡 [Management of Role Permissions and Automation](https://learn.microsoft.com/azure/automation/automation-role-based-access-control) 💡 [Using Azure Machine Learning to assign roles](https://learn.microsoft.com/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler) 💡 [Azure AD Seccurity Groups ML](https://learn.microsoft.com/azure/machine-learning/how-to-assign-roles?view=azureml-api-2&tabs=labeler#use-azure-ad-security-groups-to-manage-workspace-access) |\r\n| | 6.2 Critical Process Automation | Microsoft Power Automate Azure Logic Apps Microsoft Sentinel Playbooks Microsoft 365 Defender Automated Investigation & Response | 🔀 [Azure Automation](https://portal.azure.us/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/d2175af3-6958-4008-83ac-ac2b81eafac7/appId/fc75330b-179d-49af-87dd-3b1acf6827fa) 🔀 [Microsoft Sentinel Automation Blade](https://portal.azure.us/?feature.msaljs=true#view/Microsoft_Azure_Security_Insights/MainMenuBlade/~/Automationl) 🔀 [Azure Logic Apps Blade](https://portal.azure.us/?feature.msaljs=true#view/HubsExtension/BrowseResource/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Azure Automation Overview](https://learn.microsoft.com/azure/automation/overview) 💡 [Azure Security Baseline for Automation](https://learn.microsoft.com/security/benchmark/azure/baselines/automation-security-baseline) 💡 [Visibility, Automation, and Orchestration with Zero Trust](https://learn.microsoft.com/) 💡 [Automation in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/automation) 💡 [Automate Threat Response with Playbooks](https://learn.microsoft.com/azure/sentinel/automate-responses-with-playbooks) 💡 [Automated Investigation & Response M365 Defender](https://learn.microsoft.com/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) 💡 [Power Automate U.S Government](https://learn.microsoft.com/power-automate/us-govt) |\r\n| | 6.3 Machine Learning | Microsoft Sentinel Fusion ML Microsoft Sentinel Bring Your Own Machine Learning (BYOML) Microsoft Defender for Cloud (MDfC) Azure ML | 🔀 [Azure Machine Learning](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.MachineLearningServices%2Fworkspaces) 🔀 [Power Automate](https://make.gov.powerautomate.us/) 🔀 [Power Platform Admin Center](https://admin.appsplatform.us/) 🔀 [Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Defender for Cloud](https://portal.azure.us/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0) | 💡 [Advanced multistage attack detection in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/fusion) 💡 [Bring your own Machine Learning (ML) into Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/bring-your-own-ml) 💡 [Azure Machine Learning](https://learn.microsoft.com/azure/machine-learning/?view=azureml-api-2) 💡 [Enterprise Security & Governance w. Machine Learning](https://learn.microsoft.com/azure/machine-learning/concept-enterprise-security?view=azureml-api-2) 💡 [Azure Government Isolaiton Guidelines using AI & ML](https://learn.microsoft.com/azure/azure-government/documentation-government-impact-level-5) 💡 [Quick Start Azure Machine Learning](https://learn.microsoft.com/azure/machine-learning/tutorial-azure-ml-in-a-day?view=azureml-api-2) 💡 [Azure security baseline for Azure Machine Learning](https://learn.microsoft.com/security/benchmark/azure/baselines/machine-learning-security-baseline) |\r\n| | 6.4 Artificial Intelligence | Microsoft Sentinel Fusion ML Microsoft Sentinel Tailored AI Azure ML | 🔀 [Azure AI Services](https://portal.azure.us/#blade/Microsoft_Azure_ProjectOxford/CognitiveServicesHub) 🔀 [Sentinel](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Defender for Cloud](https://portal.azure.us/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0) | 💡 [AI Security Services](https://learn.microsoft.com/azure/ai-services/security-features) 💡 [Senintel Automation](https://learn.microsoft.com/azure/sentinel/automation) 💡 [AI ID & Access Risk Based Controls](https://azure.microsoft.com/products/category/identity/) 💡 [Implement Sentinel & M365 Defender for XDR - AI Driven Zero Trust ](https://learn.microsoft.com/security/operations/siem-xdr-overview) 💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) |\r\n| | 6.5 Security Orchestration, Automation & Response (SOAR) | Microsoft 365 Defender Automated investigation and response Microsoft Sentinel Playbooks Microsoft Defender for Cloud (MDfC) Azure Logic Apps | 🔀 [Sentinel SIEM-SOAR](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Logic Apps](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [Microsoft Defender for Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) | 💡 [Security Ochestration, Automation & Response (SOAR) In Sentinel](https://learn.microsoft.com/azure/sentinel/automation) 💡 [Sentinel SOAR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/how-to-use-azure-sentinel-for-incident-response-orchestration/ba-p/2242397) 💡 [Microsoft Sentinel SOAR Content Catalog](https://learn.microsoft.com/azure/sentinel/sentinel-soar-content) 💡 [Automate Threat Response with Playbooks in Sentinel](https://learn.microsoft.com/azure/sentinel/automate-responses-with-playbooks) 💡 [Automated investigation and response in Microsoft 365 Defender](https://learn.microsoft.com/microsoft-365/security/defender/m365d-autoir?view=o365-worldwide) 💡 [Workflow Automation in Microsoft Defender for Cloud](https://learn.microsoft.com/azure/defender-for-cloud/workflow-automation) 💡 [SOAR Best Practices](https://www.microsoft.com/security/business/security-101/what-is-soar#SOARbestpractices) 💡 [Become a Sentinel Automation Ninja](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377) |\r\n| | 6.6 API Standardization | Azure API Management Azure Monitor Log Analytics Azure Logic Apps Azure Policy | 🔀 [API Management Services](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.ApiManagement%2Fservice) 🔀 [API Connections](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Web%2Fconnections) 🔀 [API Playground](https://portal.azure.us/#blade/Microsoft_Azure_Resources/ArmPlayground) 🔀 [Azure Logic Apps](https://portal.azure.us/#view/HubsExtension/BrowseResource/resourceType/Microsoft.Logic%2Fworkflows) | 💡 [Microsft API Management & Security](https://azure.microsoft.com/products/api-management/) 💡 [Mitigate OWASP Top 10 Security Threats Using Microsoft API Management](https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats) 💡 [Security Baselines for API Management](https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline) 💡 [Secure and Compliant APIs for a Hybrid and Multi Cloud World](https://azure.microsoft.com/blog/secure-and-compliant-apis-for-a-hybrid-and-multi-cloud-world/) 💡 [Web API Design Best Practice](https://learn.microsoft.com/azure/architecture/best-practices/api-design) 💡 [Monitor & Protect Your APIs](https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor) |\r\n| | 6.7 Security Operations Center (SOC) & Incident Response (IR) | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) Microsoft 365 Defender | 🔀 [Sentinel SIEM-SOAR](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [Logic Apps](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [Microsoft Defender for Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [Security Operations In Azure](https://learn.microsoft.com/azure/well-architected/security/monitor-security-operations) 💡 [Microsoft SOC Best Practices Landing Page](https://www.microsoft.com/security/business/security-101/what-is-a-security-operations-center-soc?ef_id=_k_ce7dcd6e8f2d1919667ca9a72f733870_k_&OCID=AIDcmmdamuj0pc_SEM__k_ce7dcd6e8f2d1919667ca9a72f733870_k_&msclkid=ce7dcd6e8f2d1919667ca9a72f733870) 💡 [Playbook for Modernizing Security Operations Centers](https://www.microsoft.com/security/blog/2021/02/11/a-playbook-for-modernizing-security-operations/) 💡 [CISO Series Lessons Learned from Microsoft's SOC](https://www.microsoft.com/security/blog/2019/10/07/ciso-series-lessons-learned-from-the-microsoft-soc-part-3a-choosing-soc-tools/) 💡 [Integrating Microsoft 365 Defender into your security operations](https://learn.microsoft.com/microsoft-365/security/defender/integrate-microsoft-365-defender-secops?view=o365-worldwide) |\r\n| Visibility & Analytics 7.x | | | | |\r\n| | 7.1 Log All Traffic (Network, Data, Apps, Users) | Azure Monitor Log Analytics Microsoft Sentinel | 🔀 [Log Analytics Workspace](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.OperationalInsights%2Fworkspaces) 🔀 [Log Query Packs](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.OperationalInsights%2Fquerypacks) 🔀 [Sign-in Activity Logs](https://portal.azure.us/#blade/Microsoft_AAD_IAM/SignInEventsV3Blade) 🔀 [Activity Logs](https://portal.azure.us/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/activityLog) 🔀 [Audit Log](https://portal.azure.us/#blade/Microsoft_AAD_IAM/AuditEventsV2PillsBlade) 🔀 [Operation Log](https://portal.azure.us/#blade/Microsoft_Azure_Resources/OperationLogsBlade) 🔀 [Microsoft Azure Log Search Alerts](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/c134d63b-957f-4cf7-8a34-d744aa8804df/appId/f6b60513-f290-450e-a2f3-9930de61c5e7) | 💡 [Azure Log Analytics](https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-overview) 💡 [Azure Monitor](https://learn.microsoft.com/azure/azure-monitor/overview) 💡 [Audit Logging and Monitoring](https://learn.microsoft.com/compliance/assurance/assurance-audit-logging) 💡 [Maturity Model for Log Management M2131](https://techcommunity.microsoft.com/t5/public-sector-blog/microsoft-sentinel-maturity-model-for-event-log-management-m-21/ba-p/3074336) 💡 [Device Log Capture - Intune](https://learn.microsoft.com/mem/intune/remote-actions/collect-diagnostics) 💡 [Application Logging](https://learn.microsoft.com/sql/relational-databases/performance/view-the-windows-application-log-windows-10?view=sql-server-ver16) 💡 [User Access Logging](https://learn.microsoft.com/windows-server/administration/user-access-logging/get-started-with-user-access-logging) 💡 [Azure Infrastructure Logs](https://learn.microsoft.com/azure/well-architected/scalability/monitor-infrastructure) 💡 [Network Logging](https://learn.microsoft.com/azure/azure-web-pubsub/howto-troubleshoot-network-trace) 💡 [Supported Logs for Network](https://learn.microsoft.com/azure/azure-monitor/reference/supported-logs/microsoft-network-networkmanagers-logs) |\r\n| | 7.2 Security Information and Event Management (SIEM) | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) Microsoft 365 Defender | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinel) 🔀 [M365 Defender Portal](https://security.microsoft.us/) 🔀 [Microsoft Defender for Cloud](https://portal.azure.us/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0) | 💡[Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/overview) 💡[Implement Sentinel & M365](https://learn.microsoft.com/security/operations/siem-xdr-overview) 💡[Unified SIEM & XDR](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-unified-microsoft-siem-and-xdr-github-community/ba-p/3249533) 💡[Stream Alerts Defender for Cloud to SIEM](https://learn.microsoft.com/azure/defender-for-cloud/export-to-siem#stream-alerts-to-azure-sentinel) 💡[Azure Sentinel Github Repo](https://github.com/Azure/Azure-Sentinel) 💡[Sentinel & SOC Analysis Process](https://learn.microsoft.com/azure/sentinel/migration-security-operations-center-processes) 💡[Microsoft Sentinel Skill Up Training](https://learn.microsoft.com/azure/sentinel/skill-up-resources) |\r\n| | 7.3 Common Security and Risk Analytics | Microsoft Sentinel Microsoft Defender for Cloud (MDfC) | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Security Baselines](https://endpoint.microsoft.us/#home) | 💡[Microsoft Security Response Center Security Updates Guide](https://msrc.microsoft.com/update-guide) 💡[Explore Risks to Sensitive Data Microsoft Defender for Cloud](https://learn.microsoft.com/azure/defender-for-cloud/data-security-review-risks) 💡[Identify & Analyze Risks Across Your Environment](https://learn.microsoft.com/azure/defender-for-cloud/concept-attack-path) 💡[Cloud Security Posture Management](https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management) 💡[Microsoft Cloud Security Benchmark](https://learn.microsoft.com/azure/defender-for-cloud/concept-regulatory-compliance) |\r\n| | 7.4 User and Entity Behavior Analytics | Microsoft Sentinel UEBA Microsoft Defender for Cloud Apps (MDA) Microsoft Defender for Identity (MDI) Entra ID Conditional Access (CA) Purview Insider Risk Management | 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [M365 Defender Portal](https://security.microsoft.us/) | 💡 [ID Threats with User and Entity Behavior Analytics](https://learn.microsoft.com/azure/sentinel/identify-threats-with-entity-behavior-analytics) 💡 [Enable Entity Behavior Analytics to Detect Threats](https://learn.microsoft.com/azure/sentinel/enable-entity-behavior-analytics) 💡 [Microsoft Sentinel UEBA Reference](https://learn.microsoft.com/azure/sentinel/ueba-reference) 💡 [Investigate Incidents with UEBA](https://learn.microsoft.com/azure/sentinel/investigate-with-ueba) 💡 [Discover and Protect Sensitive Information in your Organization](https://learn.microsoft.com/defender-cloud-apps/tutorial-dlp) 💡 [Purview Insider Risk Management](https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments) |\r\n| | 7.5 Threat Intelligence Integration | Microsoft Sentinel Threat Intelligence (TI) Microsoft Graph Security Indicators Microsoft Defender Threat Intelligence (MDTI) | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Microsoft Threat Intelligence Portal](https://ti.defender.microsoft.com/) | 💡[Microsoft Threat Intelligence](https://learn.microsoft.com/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti) 💡[Microsoft Security Graph API](https://learn.microsoft.com/graph/api/resources/security-api-overview?view=graph-rest-beta) 💡[Create Threat Intelligence Indicators](https://learn.microsoft.com/graph/api/tiindicators-post?view=graph-rest-beta&tabs=http) 💡[Threat intelligence integration in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/threat-intelligence-integration) 💡[Bring Your Own Threat Intelligence Feeds](https://learn.microsoft.com/defender-cloud-apps/additional-integrations) 💡[Accessing the Threat Intelligence Portal](https://learn.microsoft.com/defender/threat-intelligence/learn-how-to-access-microsoft-defender-threat-intelligence-and-make-customizations-in-your-portal) |\r\n| | 7.6 Automated Dynamic Policies | Entra ID Protection Microsoft Defender for Endpoint (MDE) Microsoft Defender for Cloud (MDfC) Microsoft Sentinel Fusion ML Microsoft Sentinel Bring Your Own Machine Learning (BYOML) Microsoft Sentinel Playbooks Microsoft Intune Azure Automation Purview Insider Risk Management | 🔀 [Sentinel](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/microsoft.securityinsightsarg%2Fsentinell) 🔀 [Defender For Cloud](https://portal.azure.us/#blade/Microsoft_Azure_Security/SecurityMenuBlade) 🔀 [Logic Apps](https://portal.azure.us/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Logic%2Fworkflows) 🔀 [Entra ID](https://portal.azure.us/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/Devices/menuId~/null) 🔀 [Azure Automation](https://portal.azure.us/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/objectId/d2175af3-6958-4008-83ac-ac2b81eafac7/appId/fc75330b-179d-49af-87dd-3b1acf6827fa) 🔀 [Microsoft Purview Portal](https://compliance.microsoft.us) 🔀 [Microsoft Intune](https://endpoint.microsoft.us/#view/Microsoft_Intune_Enrollment/ReportingMenu/~/deviceCompliance) | 💡[Automate Threat Response with Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/automate-responses-with-playbooks) 💡[Adaptive Protection - Microsoft Purview](https://www.microsoft.com/security/blog/2023/02/06/introducing-adaptive-protection-in-microsoft-purview-people-centric-data-protection-for-a-multiplatform-world/#:~:text=With%20Adaptive%20Protection%2C%20DLP%20policies%20become%20dynamic%2C%20ensuring,efficient%20and%20empowered%20to%20do%20more%20with%20less.) 💡[Adaptive Policy Scopes M365](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/using-adaptive-policy-scopes-to-apply-m365-retention-to-shared/ba-p/3053641#:~:text=Back%20in%20October,in%20Microsoft%20365.) 💡[Adaptive Application Controls](https://learn.microsoft.com/azure/defender-for-cloud/adaptive-application-controls) 💡[AI-Driven Adaptive Device Controls Microsoft Defender for Endpoint](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/ai-driven-adaptive-protection-in-microsoft-defender-for-endpoint/ba-p/2966491) 💡[AI-Driven Adaptive Protection Against Human Operated Ransomeware](https://www.microsoft.com/security/blog/2021/11/15/ai-driven-adaptive-protection-against-human-operated-ransomware/) 💡[Microsoft Defender for Cloud Automated Security Posture Management](https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management) 💡[Improve your network security posture with adaptive network hardening](https://learn.microsoft.com/azure/defender-for-cloud/adaptive-network-hardening) 💡[What is Microsoft Entra ID Protection?](https://learn.microsoft.com/azure/active-directory/identity-protection/overview-identity-protection) 💡[Azure Automation update management](https://learn.microsoft.com/azure/architecture/hybrid/azure-update-mgmt) 💡[Manage Windows 10 and Windows 11 software updates in Intune](https://learn.microsoft.com/mem/intune/protect/windows-update-for-business-configure) |"
},
"conditionalVisibility": {
"parameterName": "isess3Visible",
From e3c168e975d298dc8894f8862f99a4c98d5f90da Mon Sep 17 00:00:00 2001
From: "Chhorn Lim (MSFT)" <50709199+ChhornGLim@users.noreply.github.com>
Date: Fri, 15 Sep 2023 12:34:50 -0500
Subject: [PATCH 08/12] Added DoD Zero Trust Strategy Workbook v1.0 inputs to
WorkbooksMetadata.json
---
.../WorkbookMetadata/WorkbooksMetadata.json | 22 ++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json b/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json
index 64ad99fb31b..9c7352bbefd 100644
--- a/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json
+++ b/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json
@@ -5568,5 +5568,25 @@
"title": "Dataminr Pulse Alerts",
"templateRelativePath": "DataminrPulseAlerts.json",
"provider": "Dataminr"
+},
+{
+ "workbookKey": "DoDZeroTrustWorkbook",
+ "logoFileName": "",
+ "description": "This workbook solution provides an intuitive, customizable, framework intended to help track/report Zero Trust implementation in accordance with the latest DoD Zero Trust Strategy.",
+ "dataTypesDependencies": [],
+ "dataConnectorsDependencies": [],
+ "previewImagesFileNames": [
+ "DoDZeroTrustWorkbookMain.png",
+ "DoDZeroTrustWorkbookTracker.png",
+ "DoDZeroTrustWorkbookCapabilityExample.png",
+ "DoDZeroTrustWorkbookCapabilityExample2.png",
+ "DoDZeroTrustWorkbookGettingStarted.png",
+ "DoDZeroTrustWorkbookAlignmentTable.png"
+ ],
+ "version": "1.0.0",
+ "title": "DoD Zero Trust Strategy Workbook",
+ "templateRelativePath": "DoDZeroTrustWorkbook.json",
+ "subtitle": "",
+ "provider": "Microsoft"
}
-]
\ No newline at end of file
+]
From 453724a8ed30a7941be63ad15df8c3e3fdd23cb5 Mon Sep 17 00:00:00 2001
From: "Chhorn Lim (MSFT)" <50709199+ChhornGLim@users.noreply.github.com>
Date: Fri, 15 Sep 2023 13:04:48 -0500
Subject: [PATCH 09/12] Updated with new filenames for B&W
---
.../V2/WorkbookMetadata/WorkbooksMetadata.json | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json b/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json
index 9c7352bbefd..571ec500e5d 100644
--- a/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json
+++ b/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json
@@ -5576,12 +5576,12 @@
"dataTypesDependencies": [],
"dataConnectorsDependencies": [],
"previewImagesFileNames": [
- "DoDZeroTrustWorkbookMain.png",
- "DoDZeroTrustWorkbookTracker.png",
- "DoDZeroTrustWorkbookCapabilityExample.png",
- "DoDZeroTrustWorkbookCapabilityExample2.png",
- "DoDZeroTrustWorkbookGettingStarted.png",
- "DoDZeroTrustWorkbookAlignmentTable.png"
+ "DoDZeroTrustWorkbook1Black.png",
+ "DoDZeroTrustWorkbook2Black.png",
+ "DoDZeroTrustWorkbook3Black.png",
+ "DoDZeroTrustWorkbook1Whitepng",
+ "DoDZeroTrustWorkbook2White.png",
+ "DoDZeroTrustWorkbook3White.png"
],
"version": "1.0.0",
"title": "DoD Zero Trust Strategy Workbook",
From 7598ae55394ae6f9f3c696317d9b0340dbba8174 Mon Sep 17 00:00:00 2001
From: "Chhorn Lim (MSFT)" <50709199+ChhornGLim@users.noreply.github.com>
Date: Fri, 15 Sep 2023 13:07:03 -0500
Subject: [PATCH 10/12] Added preview screenshots/images for DoD Zero Trust
Workbook v1.0
---
.../Preview/DoDZeroTrustWorkbook1Black.png | Bin 0 -> 183064 bytes
.../Preview/DoDZeroTrustWorkbook1White.png | Bin 0 -> 96350 bytes
.../Preview/DoDZeroTrustWorkbook2Black.png | Bin 0 -> 276503 bytes
.../Preview/DoDZeroTrustWorkbook2White.png | Bin 0 -> 218521 bytes
.../Preview/DoDZeroTrustWorkbook3Black.png | Bin 0 -> 196525 bytes
.../Preview/DoDZeroTrustWorkbook3White.png | Bin 0 -> 150441 bytes
6 files changed, 0 insertions(+), 0 deletions(-)
create mode 100644 Workbooks/Images/Preview/DoDZeroTrustWorkbook1Black.png
create mode 100644 Workbooks/Images/Preview/DoDZeroTrustWorkbook1White.png
create mode 100644 Workbooks/Images/Preview/DoDZeroTrustWorkbook2Black.png
create mode 100644 Workbooks/Images/Preview/DoDZeroTrustWorkbook2White.png
create mode 100644 Workbooks/Images/Preview/DoDZeroTrustWorkbook3Black.png
create mode 100644 Workbooks/Images/Preview/DoDZeroTrustWorkbook3White.png
diff --git a/Workbooks/Images/Preview/DoDZeroTrustWorkbook1Black.png b/Workbooks/Images/Preview/DoDZeroTrustWorkbook1Black.png
new file mode 100644
index 0000000000000000000000000000000000000000..fe0e94fc7a88f6327efac4c30a1132647a7f24cf
GIT binary patch
literal 183064
zcmeEtcQ~8x`?d~MRCUr;(WN$BC>pe?imDkZgtltN-Yc{eUHH^&sa>0xF=AD#uiIs#zlK1ibe2@42{qg?&{`KZK#PK|m$8+D$bzS#)o#%PKHGZrsz;}+1i;GJ@
z@8Nw@F0RA3xwsA-JA4Q@^V?K66Zo~y*Hrf&7h>T2GH`Iv>8{~jF0SeX{@rKXz%j4a
zLn~h{E+L7%pM83!SJr@&_Acg6{LDODybK-up1pYH_Y644#T9zV-p$3!*we+s&-ap=
zb?Bv_OKR8TE(HVcaJl~+-MD`3*8ly4%5A0pe&*kA>>Welm4$w9xwtsWdiU>|2idL?
zxPwk%v0dvYB@YIsnL_yFPf3~Pl7ZKQY1A%JpFki)%ecQ1^7NJ^o7O$Nz!;#A-NxON
z+w_#zSa$}$53Ifj+=~C=ONoO`~Ab$8UnK0Mqur
zUoSuD{{KG%v+@6ST7Xa(W+?Y3?Hw3)0|rxW>z<+PzEM;G8QSR8Eo|>M%B6hH_puj5sL0q|QYX~hnFsa>b`G$4P
zi)sf)M@EDR$T()-IL@tN-oH3RJ=>Y8F7AM=*Bnyr6LHK){eb*%der8E0*r8@cWO7A
ze`p_9&jpR)6Q(Oqo|6g{yycoqB+G_dnhTJGPR!u$PYa`+UzkUXvFt|1EJIvN&y62D
z2Hd|ExHRz~4|KA@9X|l6cXcpGQ}C~x?@hCQ@E}H$`=$F`AD0T34E2VE#&6m!_&^rYTXCEOt2-Zqi-DfR*yg>WADa=*tr=pp_IgP776g)8x{jw
zn)`r9G8colW|0>gU&K0Si#MFkx20*mH3Xho@nJM6{oGz0OQfXE7#BSj#Sb@oP1m{9
z8h*a<6H{Tm7_pzrdaS}4OPIqJe|$b#WLV2#zmJ1Jlb><@V^^Mvy<5^BP%p$YZLgYv
z#rMn_;TGo2SVlnkyim~n7~@5U$!ip(%Cnar8`!CJbFL_Ru>^B&{9q_40sr*a`x7f;
z2$m)X9_@l@Y4Ru4mln3ESwn-B(m3EW}h!POG
zIXO?{Dx=Q%siSe38}SultamK+?R~vdRo^)WxsJ)2E0_6aZvQZc!N0>&sngF5?1V)0
z_QJGSt~%^LVfv$#&$A=fFryx!+V%0WF0K?@wp-0*-0~pqoE2rN)ty#ur5wS&6X7y~GZ`aq+-zH8_eG!3CB`MU()A_vI6dT;8K0*M>^{VImq~jqc-B
z9pe045|(8a@UwZib5f>SCtOD839tMHBi)_r;6ISIFBds`#oUMe7?&w!m2a0D%sE9}RN_
zX8!`_CzGR_neI1<(B=_4!X+iF)L)D$;N)IAUHocD%1EupE
z;OcQFp!}5``_5P*%paT_0b<8kIR$FVqqG!IN=&^cuQK<-W2pGXQMsJ#8!(N7L6y%x2
z?9-Y6I|j?|MP{n*ktzqxsfWD+TvexyfqR8IH1}-x?4{Zhvx$FG&Hn`T-&C8lskN$g
z+_C4npyoL6Ww}Q<<>qN1wYYjJZ}bpz_JX{Zhv1Nr`gpC2i>p*UWmyIf{$+U!!P)nt
zw5O$T4^WgQ6<@tQR&3IV^K8g8{BnC(`~cT5P%f@m4ivY%RR*T@P1d`;$fdT8`zTj7
zDE*z@1TI!Dw0Ehp@=B?_q57wI|2tF_6GJa&e0`?8b$y>jr7bC;M2&a-twrTy-!ikZ
zlAocJeQu%_6_EM#cyRDZ_iFPPz30#0p)2t{Bd*F-jg7Y>*J~;?(>ZJi^eEj>~0DVT$jn_jY&Jb1PSdB@pZ4h8kEh7$(hn)BN##RpcZ5&Y?vX|_MEA=&VztqQL
zf;(B&!^dTT(HMVu_uog6Uo3IE&J~TjapR`@R7)`XQ%_1NWSX|(kMMWKcbSfyo9JN(
zxO;3`)R#U!&>NS~aOka4h5zUPrrcZCy8d~ggM&Mbb3)6%Hh9yq%(?*~At{N+Az`fQ
zc{8-br&})L9W=6UF47s5^b=j~*(-9ZzNsIAXQaCbiKjg^G+SwU9Xoc;-@VB)etu!&
z=>aXbvNs!Q#r@uj_>H@PkN}3v-r%m>ehLGB)4v@;WMJAS6%|cRm+U&!F-wqmR?ZA0wUp~l&2!qn;tZ$23s<#IX3HQQayfn1?}#@3>}rZ_#C#iVW5cH
z4fZ7ss8iOua%5W8888oZo3LRW_L=+mkpcr~(@A--RgB*ILa5syVc@z!nUi(^iI`$9
ziK91DJo8b04b!2k&+Jx18{uK!hU=@mZ^E#pMO311F7aK_B~ibbSITglIdeUh0_19*
zORQ)>m9SmVl;iGALaIFUx!F~tdN_Te3!a*q>WGDgRG!wQuJQv;H?
zLJ50$`}s#e@aA0dU#iN?3>$eHfR|U9P_ndh5&jZ^fQHR-2e6Qq_2Oa_bRqmp>^yKYooSVZ?qq>7URBMrAdlc_h|SPcW%eb6aN@QJtcf0
z^Jb{URLF?ID>H86k9KPdc8Vl}XwcF~)IO3Yenopf=!1Dv{zg$tY0Z%&h?2;J2h^xe
zC(e32mPZ_R6VgD}oX7*awt$d!C#{2izoMB{wpN4_QtNvk$L?gO#z&SO5DV=CJ%ZMG
z-EI48+O2ARKwfvrXBp|&{X7E%E0k@hL~ZmGrwn)8|7UI5`dUPm;iqd;wxQJ1c;5uj
zZpnMgae8!n-5n#1_17HBYKbQrI_Z=lEXGT0X*j5;AYnqK=lhHK}1}f!)Wo6C)ZrB5F05~EFx{D<5
z-thV1#oRiHn$udvN3^rtCmX$$U;I91mV_Jj+mu(qZ!M3KK09Ttcja6{BcQzlcUZUR
zxJK{%R!)a5ZIWMc;(#FNdBPo9W9#;YEUh=ku9esuAMkTN4fiZo><=XPjdIG43^TtV
z55c(%jd~FB({+FKf^3+rKXh|ZT$|+QDLyX5jn(tlXJ9rM6iqDX0!fmFHB3so
z;vZy5A*Wr$ql))$*SrK~#WTgNZ19+f%%A^2r(#52;*4=+INTcPngUC&sX@ZfovuZg
z+UXFgZ-1liNNzw2bn5!gwk1paxmyTWR3LtI1>@%I4q06>GEoDC(yA)k86#vA@v*R!
zc~WWwi`oz;s*Yg;wG=2fPEJ|gF(edhqRr0lvTFF`lV%nTzkA*KO8~A!VXXpl?mINB
zy8u(@uHL+u70S8}CT4|_>vhG0f2akL-S~wS{D^v$5$v5VWp~`1(P`tc8@liJ>sPkZ
zO5@IgN+Ac)xCT#8VQ5gUraAJKqU*c*mVk-i#o{|xOsb6L<9o6wslmd_pfCkabeGs
zl8^gj+fzAAiUpeE6%bI*|MFn3C^tm8u&8##n~D)!sP23;e!{UtBZEw)ue{$siPW87w8~^DaPAEn>!
zP-xnI9&x1JqJxW#wS&(mycK1x)+WTA-ArqqYMc9G006jUB^YK*p=s$JY_t#w-(Hub
zkpd66FO*x=KmW-W*#C(PwFHpBq1X_*PyLWZZ$-+CQu=D*M|Q%9mB*CP{!
zD5)zQYBRL6p3JG1_cY!%?Aqe^tj0=w7FujIGQ4FyQv8`^-O%QaRo>`a&Xc;mz3V$@
zRrEM>vh&S>qj!EYNUaH?;XjTCEIo^Dp82sOY~yTJ_{hHlS+j!k7lvWVt!%5Vn0LjC
z5)Q;Xl^=Y9>Y)vO_|r!O1ScsyRA=Mwch?%WOjR4q
z78PjY_6KaZv??Z&=l0Dm4co8IB^hG+S2@Wj8N)RonWn405io9D_luB#r-#
z@6Dj-iUp6M8At4NA&=!f9p3*6-WoAbsFp=EPJ+tEIv->XDm1QLQs3;WU0tyD@P4I3
z)kXZ39|^Z;ws5!X1mk^{hBR00C^l!mQp`E1yenU4J9QiB5=f;qY$C={5P!|{)BGNY
zzu)!x?a4`{htK3CNiDv@W#F<@1Dh2bvP?68-~BHzqVaSj4EpqNu?)|7ua{_`rzB!M
zt2CPF>s=O#C|k}RlfQ?rhma%T~5IQdiK(lkw^p&Xxa}2OKt2{C8l*CQDGWah;**w~NF=7k_nK
zg4QnY1%7J?-MhD7QKTyr8(2E`s%N;tQykxH*KP`GH@@U~?YQqyWjiYL1mOUDts~Y$
zM9gpK?v9Mf7jMRLz|1Qi)WH?cww+(izm^?&M8n<~rr+w8z>7spu9GJQ>YZWj|3Zq|
z;`@oCt_4jz;wcpm^hL|8%c}cb&;#Nptq^pzRl0vY0Sj}(MW}jAmRpc2!ZQ~X8lRZ*
z-JbO76hK%k5ItL-EoKF_@jrddWHTwilq59RMKJrtYu!x+%#~b9aqg(<2g_1R1%LGg
zZvutQ$MR&p4Ah^hl=><8MRo-HGjb#2kz!mHC=|y-X?FrL#e3hh^AN*iFM7c-dZQ0S
z37p!D25*kAoU4FQOpL?T@XncAAFMGx?J}-;dRN
zD=Er!Y-h2X4Sa4>CO3DD@{EYv!(C#v)*h|>5~{`O`;~6mS)@S&O8B>S$^A@qN*ggj
z$H9zicYk|8X?>X(L$-Pr@7eDE_Ncyw$-Vw>uMTV`o*zrsc9=--h3UCBl@Z^Aa90h}
z-H6!Ah5*~9p#lTph*cpRIb^$Xt`izCF(KZplQsY?_aLC^U#vgJs_`11PFL|H$In{b
zbi!?~|FtnLyG6M2^Bn-W@Q*VCYSN?YhJ;}!PA17Iy)%sIx_5&HOsLcPx;Ks1OuvJ|H>?N{+e$$97-u3nna#tnwG
z!|A?nd3_i9syQr*2fa`KZCwK)yxAb$;sgn}dNwxi+ia}3hqSb`!ttGty5hd0G99%3
zhAAIxlYoeFRd^`fchmz`Py0_#o}>0&KT_K@&fGGzx(2P!f2+T(-mzPZs~>;np~pW+
zmsjm2pCKECgk*GEMqpH)$d5F;@Soz=KCW#LxL7GgoBFCaTmU`x)Y&ezBfQr?N!rpT
zyopFLVI@xobqbIp;!Yao58i5JKaPZlPX#ZEdOX?Exc#{QRJ;hYfeEJ;>=1M8E-7bL
z1cOf|-(-I#vn@u$>7<5$h0jin!BU2tB%~`=p+>bWFI9E?NWSaamhJDG9$yxqiqybx
z_>+ENZt({R=ay|D2*vj8?-h#_o}+%mg(C5YDgb;uX$_&S0yWON{bZXQPHe^AytjN1
zd9+U95)~Xg{w%hMy^F@S6=tpw8mB@jAcgJY`cV5~UVC|`rF!XiVpqf1JHq5~Q+XwB
zWdnVpH8i|faC^qbS*&+7u+;UoXv8jWYEmZ2V+|>0AQNP-8NPc^owRk6&(Fxz0-_=l
z(Nk91b4{;o;+v0e>x~i%(TGR0%E3D0?HMUGr*qm%QgGkIWmM6SO6y8Lq=w%efnBnC
zgZSxyU2f{qFhQw64YqKkfwFwYJOU9o=^ffuqt)f)ymR_1MAz4GuqHc#aeaELy~d{5aN6g%^GZGEl-!(|tJd`gWAhU7*px{n&HNT{gwOR7c2ACWA_F9kG)a?aRE0FEq^j^<+#0zk!#j}AF8o@*umLg6SbcF;
zcE4e$ZW3z6#BP;u%5NoEGx!m&pnjOKimZO5am^>&+*{=&)!>a&mdw+|d`xmfr9tVr
z*_8FmF$q;Tr0WD3eXS!G6}<7bi_mo894k*eWGR;hWWA7-y-X6MY@)(RP-Khfsj#e;
zxH$;wItrS58X?tgRlC^eAxk4Sq-kDNGp7;H9}@rvv&3bBpgF{v8LIOV5_eqp{4BZC
zA5=(GB7~CLLhaIa+21z@n_xmv$)yOWt`6$4e7EnLKTD_wdf^`rR%%9JZ5ei0@!5(>
zbByoXncAqK_F+143REmdU;H`TvSNFeki(6Q4!0&QB%3{^72)m?<+rRN3q_TDUN^wB
z-x7d@Eun_%hp0%D7MhJ1yhq{Hcl|$W$(7qzBqS}nJ72xt*0Q5cyyYcxMt*NFn~WYE
zzO@f}qLlTO=a43AmGD~O$xMR$Sym=P?G9zq*PVn@qS5e_MvVrr`r<1lCD0Js`$O*}
zlz6P8FfR6psB2{lqqLPZpsqY1Qp8bud@D|4bc@maXSHQ>AYi#54fo;mO#)>wTXULF
zJO!t7Hk59jU8-G|SEo<B?@32BPo
zgi4DYvKIUECw(>z1NyFaHGa!lfNq*ymiUQiW5{6V!fz8^mrX!GyC%M)rSPw$!ggr&
z^8y30?WOz#0wru`KD8|gDOv|QcguOn^-t+pUGAF$8qD(jaInl7`ef~3qkmEQF~}kA
zngO-VN5m$)2itr;-$H9FwkG|$=E9QwlpsJ*+3N5cK0?baf1gAVZK}oT1
znqn_AhNKJ1f81|?cb;^8m-p9H@RLW|a$%U@&bz$W$q*?>dpIcY(T6kFM*ykjvY~(ec-LwXr&w=}-&`nC^7Nl)Lm>*HvYK>hFA8
znGBZ1@|23TEI0QOfr?+<XYxRY-gvdOuM&Gi{`Pa1$P#QFMy66g_4F(=5yii~79}{T9Uwt@MAP8R
zFJ`ZPsU4&hjsKZ&$_f}=t_A8yKd4Ilde|o_zHIHnEZ7pdTqts5JJ9m7*)7c#73;r+
zkFs8v6+No|csZu|ui8UaF)VzG^HwrzCQ>flLQ#S@S~6QN_Nb`aH~Rz>Wh8Kg+6B-7
zHz8Y%Vo3L>Djh({ew+CY;P+B$oD%$HmW9`6
z&$ju6u+H2|{nJ&?I#-=38kZhY(0{TPbVr@xZNyBvHoaklvGg|qdI{gF*!~6k)7Wb1
zjM%lOFIiOjG}*SI)Q^aIudZVF>2|lc+0Zxfa4%^1>4m{(ofY1HH|S7teTVjeeZ$5n
zSdK)>A873~kW|GfAv9_qfk?I1XbAJ({`#X5fmzUL_WOV15uBd;q
zZ0{}2&KSW!>|KE3D!+$#7Byy?feLq?Zi7!zvk=w(mHCSobLU^Ip`gTjeicP56X?ZT
zKxay!MDZr!+Rg=F-;3}Wbiz@M)EqX}!iOEHz{8lR}3mr1bicSQ-w~qI+-uyo;
z@?8~o)Nh1a#!XB!2j(sZzez;0+9&Fo=Jp*RxDg#~1%>nt1kY`8{mBfR@@Ji$3K}&G
z7-(9Y;1Gh6nkQ6=yMto;lkKXU2%AFh6OXS{xc2UU&KhqdX^-N0F>@HI+ed5!w2-peY8H4;5*pL9{)4H
zFgI>y1e#BOYi@W%0(>e^8-csF$CXekOL)Gwwu-PZ?l_bJIQdh4EJ8BND=&1&Sg7=;
zcMF})_pL;;XDHTq*3X_pv-X@Pj0;;FC@08@-rj7){UOBsp{Lm(Hapu1;SAI)IaG6%z+5*Cr9rrJq_G-iLfN{gj@?4>fqTi
zP~0W-#pa$$#FXQCgPtnJ4=g
zUIo(ak(W}E^3HklRTax7L_q?8OZG1j&Y(vtRVboockErCv}Cr8+xLY17WzWtfRIh#e2YSS
z_=iWlaXJpmF1Y_#LPlB&jRMQkgNq+$sx^I8Aq|R$ZRf_FQ5}&8hx+!T6?QHr$HOJM
zmY=mpy7Qfooi%qD`|R{(*64JO&wV9nrB=-QLhSXnupOT=sFMK^78^9*2d7UFN!g;%
z{VxX;`2vf6cAs@YNpg{OnFKj|3eC#qV?2G1C{z0
z*(Pt({#iJSWNEoj?~Wair5u2F@+_ar38ZKM1=oS2G957>CU;LbWs)KR$$6_
zwrceHsCi0MhUtIwO-yMETTvS7xuizEO~K7D*sM+Rw7+2sliVCi?`l91Z?*b)mS1Re
zZH=8$Ox;qwZ?Xl~zhPVz_SLff;7J`F`WH>sR;{T2)^&0ySZJxuY_r67S%bMsGHTM%
z(MW4t{v|@7XzZ?C4#uuCLlF_-jR(X(x}&vO3d0zO&~k4C4(I8R
zLu?oGTIo}GR^fs+5xkj8-AxI6EM+i(LjG4Mv_iJY*fx874%E(cs7T|E9Ez(eQ8gNz@baq==bJdbfCMqnFTxRJccCETQ(r6{irTj}dUqhDL!s!S()|MI9#Uv*
ztH(odC>Y5LND)P**p|^KUi1%vf(x$~%r`Bpx;|Sws4-|z
zeoVf>b!o*BBA9ev&~}S!4{-3^GDOV$e9bFS$!l{SG`S6spObNo9#i0xxz}71eE@#S
zTV*pnwwWCmIHf#xfLfFljsx8{)=XyxsjwUhw4y!M{PQ^zMcIw94`aqI&_(VWwQ~p)58^RNMa2fh)mZ*2sLyn?59bs>
z@HfC7hXyXY!Y~N`eHrh7`dxfP|Bu@2_DP%3ooIhUlk^Q)DN|LeF;%Uxkk@T?#Nt58
z2+t&c{*KwkZ~2BP$c&1Cf#B|Urh;Xa)Te94wtREk^qs`*z@2t7F1OSzZr=ZSoLXvY
z(;TZK?bn=i5>#GOLRQMEzBu~Z(VSfp57oM^(kg=$d)=HZk9k^{~
zc)~N_)s+fsiSaKHY;FuEhEtm|Rj*1Ox92}7;&+sSE^C0(30m}PZAQ}s0#fU?#37ro
z^`8n_^m0pOV6jN>Xo+0l^DFCX1nM5p2R1ZKTN)UbN{c)uRF)8xBrsCd2AhEtIK7D&
zefg;79Xr()w;iA6#i>xzC;Nn24guZ(o#q@0rJ}JmcGKzE7bGNXe5qiCkJ{Y@v7+Ix
zGi*2WF6^!Cq(ZZ``IRz+-z$;ijOj89&4-&hlta4n-lVdqi0{;u}H+9Xetb6jdryeK;DK_ukNISf|Sv(iRHC>+m|lDV0uw+G+xd{9`#4jLQWRg3uO$5C*d*Y2_%T07oJ
zP_?TN;Les!rmDV?o)D5mQkNt^s&K_=!T*^{v99#+X
z=M>MMQ`-{6p7$lkkk@9Nb5@d;E_D?-F5N3>t>1LE89}EkSp`3Xp0Ed
z5z($eEfdW;oO{HRJ1|n|jqE#DT8wr3#UZ{2RS&XVgGz!m2`xIV`)ySgJ4DtJO^uEB
zfzdJ+?t-8o_|`{VKGNm7Yp&iiXDJI$y05HgZc(vzzDm4X$0Tq4z7TTe)~|?dGt<(J
zGsQ^JC4SJBzcz>Mf#<;{6{4%eEMi9mwt7!w^fX4;
z&BYvi_G%eMu4>DW=(ZSfwdregA})OPyg`3oosO-lg;0ob`iWL%0GF?v1s
zHlL)wj{aqMuDQmV`Po&~BD$iaC16a)>haGpH_UZq&#ADqYhM-iUl~{HJmJX^uRO@3
z$$L+bfHrR|J~HZEXrUEpE@G|sG^AMkk;Y+D1OE2i-S;rwd&pUBmxy8S!u$IrUg_k0
zjS^wlQ7W*fLT96eNv-s0z`1d+BPso2f1qscJ-q7VSG^?YiF?IB$bbJ8+?xk0hc>(O
z9+cj9PhRe|=>_RKv*t=~@JQGqq$OyhyJ)wXyM%f+#aAh7yoZkLlk%#?3|^4cKf}G4s&}B)syO_yKh8eBO!OI>aUJVn0Lp
zw^uwN4$Ke{+Tyi{@`;=f}J;
z%E`E?I5q8EUJg2hqVb5}{5rhogx0M)TM3#yVPfNymn<88JLR!G$z43)e>yWNgD%v
zwtRJBXIml!+Z!xzK)0!SR@vIl%s^_-5oj8*;D-q^z99A3y^{iw<}oD&50FQSJl>po
zWcd_2U4be44j%L6wKZu*|(gmm`qLIjQOT+H`#hlS$vh
zP{C6cVy`t9cNk@g1dY@Bi-({FF5=kMTvY!_sCLOJ*8ej?r?MO`b)evT8vgAeXo^$l)r8HmxlE9VOA@H5x-?BfE(H3K!qe+-Wjp3xt^t7D=7a=
ziZ(Hfd3rOMuRJpx=Mqi(c}8EQAv>J$ww1Ob8?aj4)hOZwPw74=c07*%O9kPxCR0I3*atOJ}rgb3?WgMFo~hS>d%0SH^#QJ=M^P-tr1w
zzWZGd5NIRsio>^ZLqC+Z8fU*XGq(c65OOoDPPVhnQf@SSk6Ng~J+{^p)_4XhADJsl|
za1qC7k3M~Rc^s@&#hK7(Wj1m}xz0%K+!gHI`plRIr}2fHd4ieIy$zZ(&-;#|65TO<
zT5&lwa@u;*7q#B*`zSUdw6ME5cvGprOi1FAzu|H7e<9b|J9g5=;PJ2lde3EUpUc!x
z8;cOGGbL7&Bc|?J=wsN-P8#bLRnZqZY3B|*gO?x
z8L9nM=)Jkc1N|D)$k&+Wp3m3q>#w|Dx})yjbBf-|qzE_3nQsu2rFRxRI~fAx-AZ>6
z+;rmrd_|Z2Q`olZ)d3zZi(2oTk~5;g
zKBdJ%R^OCLU2O!UGP0B-0;!I6n(98d9xgB3^kMiPBRWE#lZmgkZ1arJe&UV-X7b%&;@40TjR=PllH$
zX!gR&Q2)9PssSV8S5N)H=FcT^0)S6eo4)MX8VH&o)YUyfem^R%{M*$-X7^$#B=~mN
zxFTk|U5Q5js_5SND>2aMB42&?KA!W&rQcFL&iHE=anKG?4Cc`YZYC%GG%joQ?tt^K
z+F@m<@~ct-rf(u5i?lj)wGaGUJKAw|V~(v^ABq
z5#$?V`cXX)G{dA!0;j;YMi~RBwyH;had{3Al-s8J(W_Rqn~-R!-W$oUd(5~~{la8|
zASYZ`m~%;w1KKxNZ+>hpJS^kB1O5a6kPhT`NU^cIttdVvWd;m!McEpT%dQ&>2A=*B
zzOr0oW4P`-e88+i61`teCiq?jKb3^jpO5NPIQ7IXSOyI)pME
ziA)qW*H|7G5a0qh_zviS)tXHO1oaSFY%Eym)|-kSmn*O-vK9>c4eJ)?>gIS}_Z_WU
z9up(q2ZvqH-tBPZ<{BHhcU$7r63SFwe(8zD#ulq+=dZlv2-I%
z>Q~Y5?Pq|ma3K$zp?PPv4lsFnWa_M7VX&@F;r6XCqk}alU)Q`ku_Y6KZ4J(d7Iw*C;7ot;Ihs
zqeVK8mZVA;Q|w}Ur{V9vE3yuj_{RdEJ-eAU6cS8f(O1h9+v|Y-6q|iXEqTrhkokh~
z`IfnQNA)+1eL7bsd{-xZ2jp*@Ev}LNWM%VRU(Y%F!_^d)8qa-gFqC6ixS~?h
zjbv8PcY*A{sV0O@>;;JusNZn3!r7IcGDMANE0L;w6x7E((rH~TT{dzj&G@|=WU9P;
z^$k!gQ1AFiM=wJB>~a<6%`q$66hcv@`?NO?v4O4uAjvxsrSg890;=Ekaa|M)3of&0
zb^wtZ|CUE^*lhFR0@CS6_ig5&QBu$DIxHNjTpfnLPV~`s!96WI@)M+f_^SS?2Xu?s
zLCG=hlmRF%Vk&G?9`BDOV_b>`0;oz@6yj8;bccBbzaFrI#fCpZ|J@MfD9hftZSxb#
zY|?3(wHnE
zQgZ;|=bi`~;kIs$2dg-*q~}%@KI=T~?|UZ9*yOm7qSYT)y;~lWKh#K#`I-Um2_Ynl
z9M8=fr=<64U+_nc5E&=|d|pntq$N%`eb*tOM?^xt*fD2d
znU7Xdxp4uxkmFwhd4+mBOta|a%_Sr|I4w46>2^L40KBg*EgE*U^?u#=(lsRxI=7MA
zIc;zB_+8x>$f4xwsH1A*)SnfwsLKg=M#REq_E~OLUjYm;b2P#X^)roX+e}&zo1rvQ
z!U2&ab{rtx+^54f-EDmw{y{Xn(--0&@#7;8X5H-K&b-um$_7YA-~A48>D%#Rrm<2k
zkGl79D*DCiDonnUu5?%&J9Qy@CgrC7sl#x<={i6<096a@HjtCzr*>3^eh!?5V_8!j
zJmPM9?rMR}0TbM`!ShBHk}JhlJEC%jJX(~1w@m(RBQ`O$W7B1p|LbEygRv{g8DKN&
zL_AxD(MP5y)Emm$gCrmiMgh{?9uU|h9@JIBwtvs!9sX
z&fm1LLRVOKNxaob>Iu(0ke4fi;K*8AWoh5f+k69gVqz)0XVy|*d<&^Jhdtn%iC`={
zdDs}U7y`S24rZx~CtN=o%GV;-5XVpNA|AaWE4nsq&WcCuE|V+ncOxLW(ZldTf2^Hn
zQC2`Y?3Hep4V}zQ(e|6pK9+jH7!oTU@X6qxu{(!)Z9v#33wF&*;j(qG!^nHNu!~Sh
znWh}6j{Ce56^kCh%r{GLfX|)W(MU#J8f(o?e3Y%w(?H5+ywr+uSzK8U@VeTQBk*GZ+(mOJap^M=!r|W
z4DUQ!p(_VYc@Z^sJk^O^gR7CA8eWw*BX%cIhN7^|#e^Dh9>J;tPO7}U-DftXO=Ky5
zdr#tNz2`X@`Q3B!RFG-yN~uoZx{mOCv&$*a72^xC$zl&4R@CjXI(yoC4%pY_VkLvt#1n#UJw@pfb$4xwiNUxVnr@~n~0kVf&-B98&2=JH(+DNxY%=HN5(GgM?rAculzVHvV=Y<;O{^2Nyg
z*H)P7>08FEBc2(>?MB>kGEqIEd;QU8hfgTXM8W7YOw-?eY_D+rZ;IVREz~*dkP>aBO9wCI2~i{S*BGsRtfb!a$*
zHg3wa7~=%q=9W;Zh|hicJeJ{uW#^^0F{W~!<~=BWdcvWKnfu*YO*DHY#u@hYT;Hp&
z)xQu030{0_vL-rMe?GtWJs^QHamK@a-OyIw;Gl|4I317WemADyx9s%gS(kW3SR1yw
zOKkB3zj;P@!il;pi!-d4{U+@!Mh0Fb@)EjF{=*3xV1ixBw1YG;_i-~82eX~pIkaX?
z9j$AsU%%E(`LzH>>uzS1CG1pDWcdPy>jlT
zgi3KaU=OIBL>iT!)qEDof3TE0qsEj!Y}n%g^j`}{6P5$cmm9pux4Fx&*tq#7{f{8U
z(Uhsb1Zqd*1`?1Nn&!$5!3w#dv1d7bUi*BYT`}yqscE0yeln!(lJt(nd~3MTAPCV+
zOW#j~>iyW;fh2M4pv2XybD0LCqYZxGlaG4P^pfbTMB_3C&vt5|sP~WK9#1xNVF1(H
z*3+L2>18r9JSUw{iaYB?*^@iaw?XkFGV@Fo*rIwi#HT`;8`3@VpbQ$&)@y7h?e{%?*Fowu2wc9;;4}
zTW+o~@2Yvq=-nrpEsi^v{CD5A|6b8jDzj|Pz>Q!E6)S!T;Hl&)NVUx
zDwKTaaYtd|P=6s~37q}qvhI;VYhCS_Bi=-3z*i8=d)ajShV0WytzpzA)FOLTfJ$7m&^`x6V%v#2`3VEBLEv6
zqGScwX|=4u`QvMOQ~GuVX4JF&sE=USsqMoBkU_f$YD#~$3YOrO*2Oc`QXF&dnIK#|
zeC{}tNvS5^t=%7){~*4KdvmdgbzjhOON$XLY%5p)Ajry@Q(P_*3c7#^FyF&vfI}U?
zWly>SK8ml+&Aq^Hq|~~PeQH?Eup|3AU|+jvj@zAV_j14qw%>Wm>D%edK&%oQI|J}d
z_RfsDl3)ky(8Vayo+XO7Rnah|;9FZ!nu#DgnX?JrT_iHo|47O1_I7@PP3;P$l@s3f
z*Y;OJ_DsA3906(RfRJ&P)X!q3rRakxXA5%ewFK`YKZLl1*G;OCsY9z34b$}^o~Z6@
zwVd+a3;M@+*{QZNbaQrz9JtB1Q-I^7`M=nE^M9z<|BqivP9&wGvUN^L_BIJ+NRnhJ
zTlOUTzQhujRN
zYp&Pzx|YZD@w`7%kINh%Qhplmx0b|c12HMaSWoKKl@zdv`vM|E7Pd!odEpS|MqcCU
z1V1vI5!9o!7=@B}G8V#)*o?M5tb>p!QVR7d2kBfxow0Uml5SahXa%!qqBrVno-URe
z1j3z|wd^MngSq^OVY8u7Q$5XpJ-~Bm4vH_MzbfIDU&48>Trd-Q-$dcKuNmAKPr^UF_EPH%5H@
zHIfAY3IVO2=E1>H)UiBhh&r`qySZeg8`4c}sdnxR-cfKoxip7RwuMMCyj-jq{iP>I
z+m^1@2wkfJ^Up^~>z=#iWqznl=xW7ES10VdOpiagk#2ss^lq{i=}wWkOJ|zfnA#Px
z6#l6i(dU3e`_E$JUXkR`^UmJ`37&jSF=`7HEnel3P=>bkDwWh~+wy8TiS*YdNuA&`
zQq#6R5>W0RbS0bYHWIGSFFTK(sB=tE@Z+v|C8p7*j&vV-qbp8LbOTrbDyIC8{3rT@
zeS@^YqTAsr+*UAmo*&Oo#Md}BY|6Zf_T;PMaf@)X4|?JIzE|KYuT0wykcsC_=SIc?}C|nrPGn3PvwcwTo;J>5sEpJn<#>P
z2*PvDC(sA!Ga=j26FJNA9x`SCC{i`EIQRY|Je$%0tlALXUmr+oWDJLpBR$T$Y&)`VWjWhNEU#*$yTb=--wpzI9mKbbYQNFs8PlS@_g7QtE7`{z|?#f|KIg3CD!?t3`lFYHTB9
zAP}QyF10_RyM88fGGgWu-S#H({ee4`Qa5nLUPX?-KxiO>K7*t?e8
zzCdkYSRs^9Wx^#OcWiNF(#HqxN}7kF;)1ReGWGUQdrdR`&0y!8V8iaNlVKitW4oN{
z@Cum2MTny{_XlmPE7f{z(9usyK?1|@itcb(=!pe#ax2SC|#~RoM*I
zqs1FaS$t?+=lX^Olny7WMd0M>eI_8f$ekRvvEQ>zOJ!=Fw&dq?G$^l;kO{?%=WstR
zxgFVosKv}hON7ljKtTX$G<=Qdp`Lf2~)V@QvF87DX
zyvsiM99X*Y?+`5HUji7#T>@fd;2l@>?CE3BEIEkTbz3M^
z**m06%?$--{-
zfaCa@MR2FG1$M4xL9Ho>S~&hSW-KUsT5Dw)tZt#L&RGo~>)jh7A-~iajPkRG?RM5)
zu&Q;Nv~7vB8_!<^tLHjOFzlL%!9!OwC;Q~j_d_>fK
znr#BvUK+~E2g;Anf=6r`51$6R&Paa+sc!}K#Y3lC@|`Fso43EO)yP{
z&_U2NREZj}Cz;0uIwQl3Ln9XH9O=$t^BR5erYZ7|Gy~>Cv1ujR&*FK+ml4
z6ohO)$Hw;tXduorsS#tSt6N_+Lqy)ZT1D!bL#K*nZF0TDZyt6r{c(+AN-?M0?O6LF
zVn3uhlPQuMQC)J4@lPDIYr+ccYS;AqeK~;gm}3paMX#v&E5y6bR<2ayk!D6P*H|Yx
z=aJ_)a_vI;OB&7Fx{!BQ*d@eAa%HRdOahN=R@xTRhiXMA^SfYr{pcxPIu`Gqe|SMM
zZ2mjB!D7y1iCeQQHaJu~>#e&j%cr0-yr6XIfiR1!p#eA)52wn1xRxKQRDVIKNAiQP
zrbNWTZI7YsD1IRx>kYm_#Yb;_KYXl;ZsDr}$qHY1UVhq%b&txo$3wJpD2ISUleY9&DA9rn)K;;Gn$p8Z(s46cuqI8-i7I_1)cLN>R)wOi8rI38zo(=gd9AZsgE5*VTM=(s4Ibaq6}enZm_2)Jb#M9_-+wN#
z2)TIgQ6rnh>m43C8r15=ab_{J^Q*yRL7X(YycjM0rie$3=hZcmWRX;AOTwj32z8za
zJc7|3$)JWnfy!|L?`f8cM-l8ORu6mBEK%;L2j^UAvAdPZ0m*z&n}3G@$5@Eq;K;js?p6=byl5Y
zV?=(uzUL;BPWIfc+Y?M$BMd|O3uhvXKHvlor>EXNp*t*d0MnJo(e|ZI7AYT~wq`|a
zy(cYDiD7Q_+62GX+_fUMft4O+dN0n8WX*ifq(-~mEUTlg6Bph&#&;6;@o~kQaL+m>
z3}5nrAzi@}j`8S3R$QBM4IO7O78ap2dQ7_^V^P&5%MIS(xZFsG1h$3ixRH?=8UD*J
zkZWnRWPyRI1d#imhGv=_^jyv(LY-iNY46I*D6ngi-BM^<_o)>CsqiDE7BRZuKJ{PN
z4=5tk-+7%@(T^pp)`?I_2KbOG=f312{2o(1%k5^SJ-#^f_O)FM`y^dpE^53a5%x=q
zFggx$TTHUuLb9u7cQC*`n8BF;LFFsBEStACDFaO=LwPXpJ!xmCP`IkfmhCfuEdz8J
ztC6hj6a-^N-C9MVC+5OUr3=kD6+d4gY(s^_O4>oj6R*G
zv)s_$PfwA0pI$E0N`@~kl!tgurSYK8M#LGgW?V#-Stk-jWnZLKo0?3OXaUyGewe)R
zCSX}Cw8LG;hAhCN?Vj&2u`21s{Az{{qh1v~yS_6~l*!{#QcjFuEM4Vzksv}k2q14;Ew%cK|J>f>8b(LN#HDxkqrF~
z%+LJr3!yIsB$i_um**+#zw&l2V57*`CbnF3d)VKE6hsx0eLL)Os%DR9InEiJ7%FG7
zp!gtzvmuK%(DnM6ZKK-A!=eAssVo4U3OMYOD3hiUKXbQ$C%7tPrEUNuIk~9Mq*s$l
zO#r0Jsr?Xvwg~c6ri}KOHi4w=FUjX+eRAUfRx7vguMQ8(O*-5h2VG5*<-PxOOIY%v
z=etJ67&MrEC4>m#1n!)}F?L^fTN}^=!>dQ6b}s;D@cNc$Ine_&urSmArGiae4{+sb
zvrSB;kG_8ol;z8!XZ=4guLPGV*j0VFYUTMyewCe5q|W#jBzVb&TdVopsS_t!SgTzL
zB6fk5OyG?39z|#WkAYRPXWu!OE>Hbiw<^}DM24d=38WsT1_O_jC4;I4kcOS4QUhXe
z@VA_pVE}UYX~bjNv`<{^?$xUeaxSubPDi-j+B>}^$X#!mNRu~myV^f7gt>JD(#&%<
zm@?eor9tuJBmp8qV}&pJ58S|Rm6TF}r;lD(W{07TkU-9BZRfkQE#8>TQ&v8jFN$7S
zSeBo|<@z!u;SUv~j!Ru|Wz>5240L7Cxe9?>|A@
zt^5R-a!!Q>uNbRyj*iz8ssIh4ThjV0hoHA0TixJ2z_?#Zid3@R9+YAo$^N;BnY@Ty
zLlc>Q-lHsiWYUMhriUhI=A#fF+J^7kY%zZoHY{m!wvNTS-$QogpNHBzcP#qx>?dgZ
z+ctcug_6F${z@yi=I}s?Sx2(8tcC34*GvvWt)QyIgQsD_#ND#d+hxO%i_4lnnJPOe
zr&h1Uc{_dCfA<02vL~ChQWPyGww@EgY>x=0jofc1)j9{#zhO3?H{qw5;2U2s+
z)GV}dqfi~uwj;zE!1e%J>e0NR6Q(^lc`5lRK;Y>#6z$v04PXLU
z%3dP_9N1o-zxGs2`+;QXWX^cJSs>d%S0q}e@P|H{|Lb2|n#FT~4gm-=xF^9j1eKmH#vuW*_i!CTg49tw%EJP#7W5LJ40|N4
zH#t4;T4`)os04qo$4vlnJFCN!2_aj18y2wl7}rUVLQpX0t{Q*_*l>I_U#{0*fDbLq
z@cjJkHtXHIltys@>hiRdwfc&S_1XEuzlna&lUn-P4(wYxmym*1HHSz(+&9i#@hGb9I|Cr5-uW2(W7}@6G->w{tvGN9y^=CS;
z;VQD^a;v!jpy8RO+zsE&4I1jPW}C-b(NGS0i8*?OL!MHPtHwPj4(7!xsOs7tJp^rm)>xU`Ud10K?=&+
z2+S?SL|VU8Ho>8%w0CbfI_?BKIN7T~q5m`{_ok8W
z>to99cZq0fnNz7bI&kieHQMt%)ak*44bVNpC#9u_@1j&_)0^FpP#MzH2f|w5cD_A!eLeF*9Fc}U8`|60o5d^Y%9J@zS)S5G%1qRpt
zaS?lzoNWH{w2Vv}AX7LPz?D&ILGzdwK*_RX8Y!Ap)
zrPhT=K%J`|I98nUHr;b+X-QZ_WX6amTdlpblQW<@zJCLL-#N4cbGJ2xG*E8Y7*<+b
zta)_zJ&y|I6vDsMQ6CQMw6wL!>8P9wryV6%{eg=hk{(dD9FMv88pO&SMZxlEsIyj8;&b?e|OTIJh5Wv&pPs-VdP1Xg*4~PxHVVs_6}(O_+i}nZNdM5$3Nl~xAyFdQ+sE-`V?XuWq0|L=Nk8aLF8PXofAxU
zp0sKw%%u4ah2iu2KLua^`Q!h*z;)X^;-Hv+98Tg@2LuI5P)EtP(?b9
zLcf0kz8pff{(&N;fkggOVm!{c6Vl^9vu*xi=4r9V_@sd~fSsM=yl32?j3$
zXpYVLN=>dD?hoM30%BgqOoEQyXn04bH)$@PUitH@s85ZINx={RFuC!H2fl^~e*_tn
zUNH6*eB)}9{Qb=#T`j-jHF;_kt!&-)Jc)fQSja?vZ9}>YFWx`OKBkD+*i9|N3!ET@
z6lSiWA!yG#`*0l*MhI(Zt554thU4!}{D>~PDI_M;Xiv(~iY5)!7D!3$`Z{>yRW&@=
zC}46e^g;x4&>~c;wub;=Z#!zo>_fr5n}&h!X4WVUF>D82bSo|{#^>trQ|hgaVDgWy
z&_`S53FR|(VF_Lq;Th8@6(k8^k*rx3;mq$|(UdP5*u^V#VK3;<&iaNo%&@Qs^%kGT
zKW7&*JOE|OrhkoQ($78_J-Qrn`_0?84-i%;AZXNo9(%ZAKBI*97=@LRIQ~^_x3e
z$ByhVx6wTWnrdMA=J1gNQhcK%a1#O0PGkt=tvZ0)R&z~c?Ph%Gd
zsTl5+D{68)&^V%YCs*!bhZYCP6k$IPf8O*s6$FnRj;cN=CjW
zJZ*DIwRPrXp%N9t1jN;9de*2I_QQFZ+RQcEG&^$X<}Gl7DU==MP#UK_QjxYKUkV;U
zrIh1>Cs!>`dv((x56Pzt(`PjZ`ZQ(3tmJ3tIS|ft0mMFk;!Scs8x>KLag~RjH-6de
z3WulT&F;CxET`QGIg?Yf4M>}}o4k#r*88iQBZ=f*)mIXKGz
z;7|-THc!GlKk9<>rH1Ia2RE8Nr)-qRzcL{qcG5Iu3urC}yy7)sGRR#TFoMir&27BcehZ0Wq(cG+Y
z;H2$Mem(A2-W|9%My_oM>3@~zzO_2X;XtSZpU47;V74(jckJA~0YiPsgf9GucZ^_x
zuE0!QE~@jtr7%^5JsKhGMm`+Z?~-<^&p-KwO}f-#1uoxq_5EN|#LK}ZkAlIb6-j-p
zbA{BR|69oI2melbqvTnbz>G;e4Noo*3rlo*(A$W4kbwfi6CqmYlQ?}|p25SPMbC`;se@oL>C){AK;QDI1w_5O)R7wz|y-93h;ns9<|<~QCk}u4@>QFnJBlx5dmIO;7aE@pp9a2
zf`+A=z2U`j&p@2JCr+-sPf`1%l~1ZocqPi4^cAEWdi8)94$nS)tfAZpi&yNPg-xhV
zHk{wbQW*l$@PjC(<={??S=G4yK*!qgjRFr2A{c}RH_7|6e}s&Mw#I90xu$C7()w1n
z#sa#p5O!Z)zxyIl?B-R*rxm5kK3F=5?7j$wV8Q@4wpIvkSDLnxfCHzI2Q<-69*DpkrQD+t{PvPd}E%QUqk
zcdf2vpLp!8y>jzIO1FILTVO^+U}M2AvRzdtp0|)#@6*#4B6W#w!0Zb`!co^6yvJA{
zsKO-{S!4L@$OwAmP=$k{Ti%DMp+qTt&w-*|Z(CQ@t%pwfm%wnIo10r_yl!R<-MMkA
z@|g5xx8lO4pWJIHuf>i?&Lmr|Sy^4BNJRapIz1C29X#5dh!LMjFQsZI~wbg4pVoloBm>Nxhx@K8IHKVsPcHla`H7%VX8-c
z=j10Te8qsHMAc_><2Jd6ELE3~7?ydzSR}&X1(D|A*T#yRMeI!7?>8-~xb(jPZJG`S
z^f$1xQh7riI07P4bzt5dg$$o|pBdX=G_Wt!)8)*|DnfzXhW-@Hld;raC*pmz
zD!^HH*bf9yxXT40tFQU5E4vz#K|VB}g}#a_sMfI#qNpQLyb`koW(vz>7@NdXcWAXg
z(``XL%
z-Iw~=vESk~rjOL_Jt%$4w*|m|efJzZR@i+q(7s2_?6_5bdgRC)ayJa@N%))W!iJsD
zA-KpzpO;C=8KAm}U_eI^xv#Lk&Y?fp(533{)~2@D*t3%?;wT%
zVatcCc_swMT(53iAL)<^|4xsu59rb$G7TX`UgNX;Oz``lW^8zKs#7@iA5I8xoRm=fac-JjH%=E<{lW3hMeYa%zZ
z0M4fiX3rgq%*>Et-YCp@XMO{2e81`t*oiu+>kn`@1O9IiV8KOww-r}+Y;-VZ2Bh>!>SeT*e
zth4@ncpWqg8`hK$^G6|I6>zVIxmjKk+cm=lxz@L3O;vH~O>^<)li#4WrF`|26w56U
zCa4g=$L^o_B9(7-C$&YvaXS_5plMIs=)0X#ec8A1fJNbZDQeZ!(16dtrD=y)pB}uw
zN_nk;J?Q~uan6+@IWkz~vNw1oYjpB~{^$=bwi5bzIia1QQNF?%9{rv_`&$)_$xR
z=WO}Q9!;Xp?54wd_N~S0`5s}vXBRA(QkvKTOe)*Eu9rvbu%@Yj&EPSmSJ8M~@zA&Y
z_Y`a~1B*CXq)5d<9)B2XPMY3iiw(w?lkFB8F@cw+-kR7PKeIt9p>jyDL_lA=rG-OB
z8mw-u&Cd+pvTJzw2JAZNi_DkFa#Rpx4U9T>y8__I41L+>>dgf!~GR)f6I{a5N
zL$R*(aq?@bu3O5VLOiK}_57fA>`;Y?S18Z>e0fSuZm}G#9jJWH!t|Mr>lvqvCjwHV2m3r9dONn~I!446!$y{6g$xWS3d
z?64rJ1lk+lZ#6N}aAGsaY@1S^7TvueQFA`HO?;ulq};wh
zQ)>Eke{9{tUkemO0W{zdNy&%5w4jWPT2jr3i*CZvNez8{6McSl4BdVBxT@;@bc;vf
z-+FQu8`t@%JDZ=pT^ehu7_pw|^J6HGxK0miwYFC|b&OUi`}AHehdf$D@-lBXkDE<
zRZ-C^TL^lCqurj{X$c%4-_M;vh5K!~e09VbI&K5mISj~^h&+n(HK*+DjTXUR0Me;P
zp3K#9B7A>;p8tC)n$QDb`F50<8;7mUPr>dZOW%rz3^g}qorlIVr;`Qq6NS(GrBO)mK(tKXjhVijI2I`i5UAh>qCjL*j$SNm;qptNwMdfF3QYlM}
ze)J|mdb?P^@G_Yyv@ae*o^V$YI4KqmjhT{{i>SJfUvNN&j@xwGqx%ZY06%}J7T>E)3^0Fgj9av>$jA0cEQPKIMNq(
z@Q8?uUPO0*t=Z|}KbfVX3JkI)|9RC|>97uF-PH60OB*IWr6RJzXK{Z~wNMe#OT@k9X0;n`V`qL|L6<$0sZ1!}
z1nxj8!0iRvLQcP4rIQ`0;IOt{`05r4`WSKL^v0F@53;Add(uH9PV-jtU@(=t*_&sY
zQ#)nr7i{^3v`t*t;OEH2`Wc%L!8>HQ(q_mPTquI)bOk^jBVsoXM>F}RcPDYZ%+qYZOx014*o8bnh<_WzO3D3&
z=7925FCXGFllxsoZ%#0C9u=Du*0B#BOe!-ZeI$Pem`)Dxe~bnkB*AQElrys>Ze{(2
zRIG44eLnaq$;j1yyNwZ8J{f#@?RGG7fovxkd0E)E8E=^UO;At1Yk25qG*dI}&UMsLxnTTMyZ-
zOjna($b;F}&-Fy|bQ6O27>uN1LR$lV(V>B~_k^p@6OWskzeS7nlZ#6Cp^!qEn!SZa
zk_4&P_V`aix-W&u1*xE_isT;)36Zs?3MUVNk(|*0gXtTm3ah?HZ`Ml7Q?jC+%>3SJ
zzE)o92)DKRS@zDc9;5i{bD^^Do<93WCJ8J4CN
zU66PWio=d*WT1!rx7*)rvGa=Ip5-Ct#Fi5mcVEALZrjXfV)lX&ay-So53KFP;5jJ~
z-M#)#?{MiGq;+r-Acdr^+7oOd;`kF~j|*q*zl#Dut8xLcjf~Q@^5YrYWT5!_HIsnm
zu43@oorK$*hAVF5k1*%EG*Ms8JT^ZcG+He@Cvrq!y|J9@Lz=c=Mgj;zo-CJo{`rXl
z!s)FUn94^%5ZKXcq$X&`Pf%y2xrrT_&DPVj#JlOVcXhRSy!rFAv`Q;guFB1k6%o*1
z&>7k$=;ybD++DltpvGI%mHE>0Y3l;}$W1AwcamFw56Lo{%5&vU9~rMqcXv~wPyX4o
z5mbaXxX=w8)0vd}IU!&_U1oW{cHg1b3OBz_zY-d}WO0zmVIDIycp{7-%s@snu^YnL
zI0&kHC?Kq6@4lN2*_oSNg~=KkB+kHVJ?E@~jdT0v2TN^U-+l2{7|MhA)u0^LPfn#j
zw5$$8sbADDxlB=di*emAt{%%gnP6OMjwt!Hix>4F`yN)_vf+a%C5JNx-Pbe~#AfTr
z4z1$0_Xo$DwHNS2?;wRY*J9&I`T8ka+M6=<_W%q)fSH1@nn6|d28Z8ID@#MVIQO2)~>s_U5<>yZ*s4pzWF4?JB_{5=+*
zmreZjbv_nKy$?Hnla=AHPKaS?&K2VVfr0rHeobvQ`?1X#J%cS?xTaDuIKyF%p`SJ$
z+P0{ePxC;w@h{6{L$}-tvD4oHQD@|Na~mM+3baYZj9sc8@3-@
z$;N*@!DJcp3j|RH{1nu;SqvW##1B^~w{6%Yjxib{nY+Ein6`BSw}rA9lNft%VX;flt6v*;NKn
zisygdG|g2ro9M^UlJ;cJX+n6yOCQ>q4jE|HimGZo+V#g@gjYDbH||&w9j&2z29Z2j
zm>`PzETs*2$aZuB1bsk%0>FlQ*ZtTns&T(g)UY&pI#J}W+bh#98KDK@z8`n216X>!
zFwddwD@&gbE_^$YP~+(%zH3H1qE~l|IZolg2j|*L$~yL6@EzAAh%|Cn@`^poUZau8
z?339wlp4&pb!)USeUF80P|)Y8UJ5X@`w}b4K(_LOqmiXt2Jj2Pdt`o$pxq{|5?`;b
z<|bV`^aLnzwWVGh0wVNRGp|kR$(vk#A<~7r+>3QPfXT(9RRWq$SHnkw4ON4%co%Mb
zyJ69?z%avEu8~a8`0(>t7cj16hgLj&Rtb`0I@z_Jy`LCmu^w?+{S?}Va|x+0@4{qc
zl*L84XJ+!-OBzW
z*l3A{lk?p8rKxJ|J{fZGNfx6W>b6U=EdheBW-u$BYWh}eqq<#
z|Lnxut|N8E^WoYqYxZ5*^YS>K42OF7OP@VbDg?RywdJ4RMa7q}(dC`EeZKv_b=^m^
zrFFY_EiZN5(u#B4V9HeIM>TDizDz^gH-@30WRyp31DB_RX~!k7r~TYEl#W{u08Crk
z>MfnykBp)kfrj5NK*4fi!|d&q1d5qtzvt(5xVwwoc=5fdNQTdxe@=t@hXN~cTnE=tmB4EOO^tw@E^V6K1k
zqRBa3TqEPK>kci%wSf|pll>o7wUPRAI}Fk;1|jb6ntQmoP^)Pyltb~xQq_h4(Tz5i
zdd;sjQcvcE&I`NprsWck!Rvbt-ducrSkC-s(1CumEiru05g?7BE=Gn(IVp#&9)X`z
zt^g%7TK1vAGHZSF=1Xg7fXjN5;n=Egnd*J=
z9de}y6BUZPhi@C4Jl!2qYW?!nSxL-?*3VQr>g{9ii$0E9S=a6Hqd%f{b)>B+xV1js
zu5?OekneO@suCL$e8z^QI7Jr!z8tc>$Zq>Z}_e66C_soTDQsi4qWnF^1A9
zF697R$NzCR&O{5dPTk4Oba~*3230HwDe{*0aeKGE3?4&TlxKpthIsJ0rOV8kLHYOy
z2=6$SH`;9lp(9%3y)_=+#O{6L+Ss_VjzvoG4R+xcmOH2wE&I9|Wfv$l7Y@k}s3G_O
z(yF=?RsM0RxG?>`pvJH4pud&tsfLZ*Sn6Z~#IM8R*jghs0+i#K^77z;LD&=gwcdvx
zHZGUQ*~*D-DNuQhu55k~4;^^ptuFI=3;YQNC-;2;6fj*Y(Il?`Ww1J_fr=ojZHzzu
zdjt9D`h|4=_O^B4_WEhf+9{~^E$xE9E@W~=MVP_yd-9V&o9SGadqe_fx^RUHw?MH{
zR7!S4sblLtMHx+m+Ag!7OG1ii6rW$T$0YwYpklivKv;Efi=d=mL%;*7C!KLK&d2$}>!_4~qv6jg6qaX7GbF?cEHMhs4N)
zE1metRMY=L{CcV_r#$|k)KdH7|WRUBekrrUZV7>c2#Zdk?1hbHjvM3`($z!zQJ
z2z$|1wT3l6?OZnh7md^mH4Tq`yuEFFTrWrd6wGCvNn&XZLbqSE+E!EgDjju2YVJ^N
zd9nbz!a!u8WQrFB@(&#Pw~u>1-n~Zc1r)!2JHO4t7yTwqTGuW@=$6L!?`Xq$DgFF6K^-jUd-@NP*2ODch@C)7(DU+ZSU5M6X_R?6e
zZKE?n|48rh6Le2@Xdk&W|M3WlQs=F8%J3U5z4x-+OQB9c?T0Z@1d_%F+MUEF(`%gY
zm4eJGadpLsrNYpSMXV2r4Cr#rLClQyM4-$OB_m_cNUgDWX+#k1n@Z7REboy{AOGqG
zG3OWfLTv@A#?#xWVk%<~^B8gCXY)SrC?q_?ZT#h{aXYcO8@HWa+k~>Kp+Q!@pU3wQ
zGjkZmmI9(0--8lv=Uo>_J)RdNAs?fij1uEi6h$npdr`4l0;q>e3?CdLE6r;rnGLGu
z`RkoJaXo&uRrpVjYA=b0sZ;WTC+~f(U2s?Kj%;-&UmWg3in_}%Y`o0#R&C*zrnVQ;
z*W~1xv8)t;wWYV}rBsoFQtGr
z$#~%`)2p}tx9EP)+FW(dzWRFSowReJYe-1$lT+bt>z#-(GVfMnJkR{aiHTT6e=R4T
zxa5b&`6`Nop3-oVu0Xyn5G~Z46b~75fP}Lf`7iEnjaXSDD2^v59h|Mc;@bR)2U&pO
zcIEs0GTMsorN-*G_BssMs2R{+Hq)oBSwiwxoxWiYEq2;vZC;sEBoVs!RAjVnqDZ(>
zNCfP$(&$&VY*C}e01E!nU5WSc_nR7E#Zb5Ln&~U+pE#XeOzsWYjniF0Oci_bft8Pn
z^3J>p1LLe{FiONe{A@Y==|sc!a>sg$pfx%Q-}!7cZn5!nPdEs{j67MIT#3{NTKVQ+
zs{II1>K5^idZ&+$*8|2otkf%?d<+tqP6F{F&paGEneYn6@}p={{`wZA{-YC@qTO*&
zwni@gm+-L%%WvDf8{};tVSo8b;Z3L
z5Sh1U^$3Hl!EQkb&x5CSx9{j=12xC?z1RnDv$q=+&Yj2L7m8N
zC2P}_$NVO5fsX)QbMFWN*9A
zm1nqGo`;33h8
z{KW0alq$KEazPSs<=v_+tIP_M#s>it<-b>U+20v7%YOu2Sn$hv?;a{FMS$o3*_|c;
z{UW)8>km#5JgoW7fuK)7^0e^~FNz$9`{DuWrbTS6R{{g86`RHM0!lrraM~*8wuL&#
z&aN^syz&LO9RIy4yh_rA#jXlK2Nz1==z;LPwUJMUp)+qrxwwYr#UJ));p_EX=&UT5
zbDeio^uU$d9l{DW9s4Fv?ZV)GzX#V)idkgz<6E0!3saNdrxTWRH>MNLL8%X`c{br$
zyr4F5U$u*%I;~-40dMVH2{yM_q$bEPKTn6f#w-DvM-IXsH+IS({bvHt@An)EHj5NF
z`~xHAfT!_Q?cm={w9sCV_}11r7^dO7&Xpc>!!u?ok2G=(<4r?=aweW@y7
zxmub;{%WriU=?bvei?MXuiVY}DCaV=<;Y#bmhrW_^EAS!n42+H`8w>YXv&a-66~7h
zg~Xk*2lwo&e7x)TQ>}T@Y(z)L#@`@T-{amM1jgE*R&8^<4v#n}zxG{)ROhawICdpF
zp`1J-6mq$T$Dj`>>5W1%S`rzy-k@3Adq9o&Cl|4nBZncDh|=Ab?HU%=;r)if7J2df
zv(NgL#5nOvV4N8Q!Aj0X9C+`)e6z)k0z<({4EnjxP*(=@rfk#uS|ft@grL`(pBu;OA0nml2xT7tEcyB^~SG_$}>^=89*(xQm5mS?p`{0ltOOi>)$f1RLmm0muvJ`EX`;fZXA$a!L9{|vzz
z55a9YmKc6u)d!e=N3SYv!M&_z680D)d=%`jQZkVpadl~HOe4Pbv?Vxrg!1Xm)sTXP
z8u6R`mqSnUoJ!s
zAk7_Nx3YyJKe&}9wU1ohrD`bW}f3i=t=>sME^c!SCptk{ggRdh~^|Rz-;{$}@
zXUXWLH4}N4K^sug{h#ZewTXfwpbGFsZhJTmN4(hZ@CgD|R?e{lOnECF
zsW7ALR*r8VOu(m&(w`qyeV>92(~5F3y{h?DQps|QR|MKYAYN?pD{)dfHWU5fhfpn<
zaAzN8*m`JL<#85V!XYAc+(}PazL@B@nJ9YFV|zw%$Ikpzc#@Oqf%Uka)c6GMs`Dod
zMYl%qiK6MpP|G|$a?#w4de{uBvLcgu=#7z0y1wF#QEwyIH7WgDm2X=X+bv3MX4ANdX&a~1
zA5Iw@gq_xWA$!yPn;6})vNgJ(GyRuNrGhV4Z{ih~w{)XtkVE?|3hTjv2Q*PJhiSK&
z7+S-gHmQ9|w>4l!eVb4=pgOaRH5V~cDb;~#|DSdyjqiV3?VjlsPPge`g%m)XV}UjS
zEpK8OD<{J};4vC507GMU{Pl+v*+fRVg_NFH8#c@3g;(%O47cgdkdQ{iqC#qxe11zo>Es1+nDpl;*?94RcJ13j
zX(5$$$AY$V9;G|=%ZD)iVgDptfNnglc3-hs%b%c7{mNd#Z^yc^A4uY;S?L8W13h>&
zZw$SldSd&4_2=4=L7`(lAm1&1Ll}E^c~K-x?$QV7ULT3`t&ukghaNp}vGNAs89B{Y
z-z>31{uZ5}=>xLb;8AB8Klq`bRD_L9*O^?&fUaFxQowF%zxh&2O=55VXiHP?gZ*Ae
zxb|Q1Q?R~}U`5_pB4D*LN|$eHi)X!iWI!Hsdk<@*2__p~ts1;M#iKu4mjLD#o4vEMtzZ+;BYyYu!2Mb&Xt9k>Wcimy|K
z{2=S}m;BKUJ~@92#(XuJxrVJ}!5!!ZU@-PZ1s~IQ{%*3*eNw
zh&lc(eLKSvKmE}q`FLNIbEky!94(zHsAHZPbZG9bneln%q?|l-dOz&e1DP1IQ(I%#
zat!x!WbGeI25MIRbd%Au;uxR0HJl&H3Cgg+KPg{EusOc@=}k#X8!K%Un>$kPvp$^+
zQpW?`{xqzbX&3s2^+PJf_G`A+yrmCE*xJyRI%tQyW+jr-KfChtv9~{Iv@Qsq;Q;4_
zI3Cru|5do}hdBL(_`qmHHrspK>1)qCc}r5Nc_J=2bZ7Uj)R3+-#BIvK
zF;!>prPi1(BbP>pJ$wr>-_q7%@^K+{FQ(=CB2!eUF2vQPseC&{JU^D4Dnb&uPKKWHR8tD(~
zw|u8lJD`iFmuV-Smk)l+(4K?`FSqWRg{m}#G{Ipqdhg-2uwb=s6O@be>l+N_v%_Pm
zKa4t#Y^M_;`W;f(hXheQQan8#Au)EAB5pEPrLOvZ%x{Xy296Jcn$pauOJM-NnLJ
zQl<{l9=0E0BE4A6M5NOt^uMzpSEbY`YhT~0^YQ`hAGrlbCf${*o}ALD_01OEf5^8e
zh`L{Yc*b4i;U5Ox`vt&6O4A?&7E43y=QTn375NRKzxns|81xO#ej?0b>CSpn)jh%?
zIDrVx?n<`)+V@`$URp3L9fZ~8FTfsK*M{yeNf^VfQ6o}}zGh
zU4-a$j??r1VehTt;(E3)(GWriPH-m#2rj{0gS$H2mZWux0xU0bjPZS_WQQdCdXon9v&H
z(UiYLv8J%}r@*oL85b6^F(=dsoarQ#sGCwpho8G`whq;(Rsl
zMt7_KsdzTjuo<#N>0-I>+TX^%sjKW$8#vgLhzl|YeC9_|^vh|*95Px!!qBz~RDjH|$eHtxBFo@%RmBbE`^-&L(WniN=Pe*4w=+%LKpsb}C
zFZmMa8GN5w-#9`qf5hsq9o?_>d5APPopx|1m>RbQLc6mMkMxPtb#EN7dXaI27OZKPrz2t}3~s=Zse~IBKL10TX@?(^rCa
zHBncu-}GGM$}Aszm1(*!`kr(h_6bhd9!KFku+|nPYuX*E*dt}Ov;=lfIe>hX{6Nk*
z2lz}%g{3sU?3z*TX(@t2YQO8F*>Jn%xvxi`+w@*PhGwst)?2C5!?B0g&nYXob}j+D
z<>VoIyJzi$CA|k_jRXZVas{(Wa1O$k4y!ITzhs(9illGbSQ$(+G;aNs(5K*bIx&0;
zwLPbZ8E*37=}X@TFK&C4Rs(Szjv0F{wf5T{>#AV{kUxTR5@xkct2yR-;q+Agrd>zp3K0f)Wrh&!WH78l~zB8zlI
zZVMc(QD5NbJlLU6F=;ruth2;Q)9zccj+_hk-QDncuuKUD^weXO8YKHur*s^LK!n1K
zyYsf?m{R3Rn}jAk_+KL6MBiW$s`#Hq9s|hxp7UGd6ePW`trSmtr?{GzWOWT~biuQc
zvucAKb#E{Nq$Quk4((uJt%oYw=alt`CU4{JQtHhl=j*kdyjNPGnXkQm1ZyE+225|NT#Xk{@#}fE
z(+6X{L&S}n&F{n{!g?dgz2E!#NLp^y6xFM=o1GY2HQ#Qr2(Gbye645+joqc>6lc2H
zQ^3wH7O1fJq#Gjid`-l)tF~yzhMbE9zU;1!YA=1>d7GIdsuhq*$El+*$P>}e;7pO}37
zQ9a;ZH#Bg^vfohYyj(+TPft&*AmscEhWkh+WWp8OE2EB(pMmhESZ`Df4v$XHz8{eu
zAL_f8*+qiQF?g;W*3|T(O^DU1yBP!F6SdJcZbQ+S?5?UVMy41bkPyqR5Q)V{_{K#b
zJSl7E=+|m#=MVtpFM+NH0gvuw00*#w6lYiK7FT7k&k950Frb;vFuYfPLeQ#7Y@vPX
zSKu<(j)srEKf%xgcDJio=t50wQq8~%#RrSkc+ab{x!$_b-|?$EYnR^VQ8*+Vm3;Xq$l9+Ha8S_BTYhZ)5<%=+36R
zaTlYp=M_>~Udkx!dFvnF$V5imo#e3GTai!HKPp?G2dzGcFi`Jgy+QN>QQM@capFd*
zsx=Uu*egjz0O4nykOfT62_o6(QXhEQ*T;o%+WwH}V75cF>20Y-^TYHrjwJecL)D#D
zBqq}HmAy~4XgD3YKr5f3_&#SdME~gP)q38_=g9Coejew4WkmYNYT|ACPv9`;tHWL%
zW;mK{<4c-M;m;C_0-p@JO4UNjjqL_v;hzmQq@;T;c3G7%qQVN4oiP7>4L6_TJ5NUj
z^9H-Y3hb#@sVzh@(7t2(j;T^^ZTV0evp?!zv0{CD0+Lw(961)AS#3Ywg?5KmSC*GZ$0o`csmb5m
zU7tF`OsBktvivuxx2qRXZh@DgvP3owVYg{vxCNBrGIr>^E
zZ?$*(>z)x{H!G|3I_G|wqLz<{raC=|apB@UpUP{52&yWrU`1<@8M^>klcqPJ=MO61
zdvnLis*-nDpFfkF@nZ0jYMl?PVL(OVe_B_L>?Kj4n|vGj8A;ucoJP{3b1lN$Y<#&?mW=RQ-j
zI*bNFs1pMHgR8NVZpt%5K=+)rrQNpyqQhEp7pwkwSqQMVoob?R+emvtYGdoWV1T++n+Ht5OkL2
znm5^(eEH35?b}0cS1}Q)_`Jb?EE~Wn`=tkZ4i+fQL?elQZSwoln4rvE6$H!;_WYRj%7><<5X%%1V40z*uVGH=A4~L5)(|2P
zyn9%tM5!K4Q%#SBi~b1?A4O{8GvN-XX8w>cFc*G%LI_FIdZ?bS!BbkDG98EZ=GNE(5>*u{;Gmad;OG=dX}``e1N>s2&ACrAcA
z5<_>B@N7M_>|ez?)0)MI0nmK#rv*6kqM9|uBx;;xrIVHxM@Jkgq&*_obgCnKh_
z2BccKcL1+SUuEvgCfY;unbe`DYX^=&hf1rp$iLmD8JQYc+jllRyx*Q$
zkltuj#z73VFxxHz5%Yu$cH_|yXTvNP2R45M)L$v39e)}0nKdzPB`X7Ww%9z&CNUVw!tgegvJ?-^XQO!#4!l}}KKFyP}KRGzNT
z+igR?wfVlafM1?Q@rrx4VCLtw%UA`V
zmOH*@0hhP@Hz5XB$8~g0_*Evzj4TDzY07UV^yHq;PaQg6=j~t@9FHclvw=c*-`9V&
z5tju2(xxy=ZPS%8Yf93Rc1@q-Ws-ea0Fs;9m`VV|XF}n7QuV8r{3{8cQ<~XC_%S{9IeT@c>p;Xf%-KA5
z&(K924PFt0&2RQlpj|TL)4gb<*bf#x;l|^0f~Fj0xwQQax?#zgrjb
z<0q~x(c;8p>HPrsuBCC&@oB@XEuOcNL%=2fs7t`K=lJ!Lq#}?^Q@{E%M{D{p?c4sR
z11hwT@A3N{XN4YU-%;Q4rz+lsO9Nu+KFvdOChYxHvPDEkLuJjMe1E|5_A&2pKDH{s
zzvu~dUv)MsQSvb5dyp?_R=$CEB9CCF0-f`>T07K{`iD&O2S7RIjYZgunC^?(?c&A@
zJzDJzf?yuN^y(uHC4&BgK)ed1aRGyl(E_0;Bf4&760jt0dQ(dYH$DJ4b#t;&Bl_Xkxiu(@4q
zA`#4{3$d*!dKh0)cA<(teR;X*OrJ!1La>Gh)y}DMHenZkT=KJxQ#25&N9O|wOVsm;
zl`l7Njk&gR8fb2_q_hoy7sSA5F7s6kWAWIe#wP81%~_(>Hr?OSo57oCN4>pLz2lN3
z5G12NnmWTjNRc~fR_nAe)51S+P^+rlzKY{Pv^5*c1_sHw0o~&7=F045+c5Boj9hcs
z=;R$c)a2+14pZ_{oZ74U7=BPMuvDU>Buo|TuGx=haSZ0H{F>?a+J;7gU-82`JgbI6
zx3-VPy-s%1a0+8nCBV(thOHX)myKBG2~+jI_hQZWvUHhs^%h(SdtUs4Gfb|x4*hE!
zH%iKYY-W(AwSVhm>0{64B*7zS8_BAq<0$@b&0Pjx))A%K*Jo{b2
zp?yR1&Ua5~Js`#T0+98#Y_%@yk-07ja?)>ySS;P2h)${9$48d?}gWO{Y<#DXQa}|Aw(%MY809kH#D@wu-9)Swgl_
z4T(7k53uHT=Ao~J*YGqlom90dIe;pL^}A|R4D-~@O@`J9=UDe=%vk3Y^tgS+g(uYn
zx1lXU@8l@wMn`XD_J&Y~q?+OzAzP6a~sweTxtz
zIYj!*nLot~U6;g7(mbknI2Z-kq&2^=E;P$F|FtRK=dxO^OeH|nA3QExhw!e=8d^0<
zBJ$b67#Fos0aUK8#%8TIiTfva-;TKZc*g>%%CIQ!+9&~C2r8RlesM>Yag9i>p;S=t=7nDH6i>vY*c0Xn@Xtf@`g*4)HoTRoW`QB
zTGkC28n}k175D7Ag-g_&J!?!?#%d^~X-qSF@C|xQVR4jGis@{s%~x&UUZownfd8%$
zQ=0V-xLm6J=&=V}Wt{`A)&;<~PrG;?+J);J7BFF(8B^rC^(g@f%6Y&ibwCh(pvYDA
zoD`?=?f&uIKu^(34>tm6H9vZB(&I7;dm8>*fa7>^1^Eb3eVnQtOJo@*Mf_bfHN2VV
zbQ>70iJswsSXRs=6^Eab=?`ba`)ksTEn`9c)T>#0KVPY@1(!H$A)wk4pf^tv(MC~J
z=A^K0WW*6zZ
z-zpjuIg%JOtdw@!CQq=~)V!cM+DJ1&y75CX5pd42ozl(W?Z3T9MU&4->*={=n7pTF
zKq)&%U^>Ly?gOJh$0k^MwdIR$Xd@2ps*Tg^ry>2iVbVf8DZTJ2p!sUrfup$kxScdOLRE-XwYIBxF!Nc0F0;l
zd1KHAxa4c`U9fND?iX%&wbPwT#lK=wn^fzh*2aOqO%n?-k&-y0OH9{Gk%K{-`U&J~
z*KOH9jDU8D7|bFFnT^Zspf2SBT!4#0hItj07f{@Y!$9ebQo&fdMtyEuAvx7V8q{Jh
z8{a0sOSnUf0SfyvmXelpeWaKXO+bSieabFcj1W6*T$Rc5Zev!zhDk4#)}Z%X14|K0
zch2l+T>M8$bC{2e6FPl4T4PR$xU%#s<%9N|C0BtTr=DZPbs@FTCI%n{ezAs4W|(F5
zcq>0gDMmfVFg}6i{-mZEqW?b~zMm!XmY=w~d;Vst8wtuXu+Rq|p9}%jQZ^WMk0)I#
z4;55=&3>qPUe$st;ukf{;MO>amaQfc_
z$(!-%8HwHfI|hgDq#SpkT3jboo>>gk&Rk$36cL%@a!pJ{PI7T@)m79xQkKilN=B>s
zuz{*@hP?xW2NX{Rbf>Fxr|2>#EtC!2)0;zGIy*sABmL`goYnr;n0v*3_$aDImC>aS
zbS~EjVx`AYO$s)516>miOP_R;8zb_C-Va%aH_H50mB+eMt`tu_mbHQ5e1e5RTiF%-kc47y`n;&a171;NIfBh0H3i*P+R41l7duCu&wQJ
z54t^t9S+(&gS|habx{>YhoPC|m6i}j??H4{R4qrkef*BwG%qYB3@Q3aJ>T;h@ttzE
zOST`Da3ULxi>}8W??TJcHphT@dIjwB!+fbth>(
zwZ6wd%E?GQ?_XJMx}#CU7qAo_BSu>`q}^89bEazXk4!Jyn$n3s_Eb5b?-(jP^=>?%
zu$&HRN$+k-2TJwjskJ(0J`{CdQW3t;qQ}SDztHgA(^Pog?@-EW3VizfRk0vdtd~WI
zI(nJdf?_L>3US06tlJcYb#z(&=z}+!DEj3;Lqb;<)mGAcMMpXDju}e(lcxQ|`rVGT
zzS(opt5{>($La6(HM<{sh6q3p+mI$Troi_|^#xJh2Sty)e%QIc1&=pW`Ug-(lav5;rpuMDb<&KVq+k>RNwLAtbFG1VPN_aB
zOQZ;z>h10h#GJxa>hjY&!puR~M>y`_C5r&-=#O40$4TZN2
zVl9wXk)rp?yoeK}*1-+GprgVVQj6=B4n<^8h>S~OSdeK$!-r0^3;DHs1`rNX!(-C>
zAx5BfGSEdRGDoZndE-E+7)Kz!mb~t8j-Jzw&P)$hiKCmc#
zYY~s399-mHb^h};?|>7};q!(Bafp+m(CTPSz*_{0*a8YEH61)qK(6WTyJd}>iR3mM
zJkb5Nwf=V8rw;{(1-CpvQmqni_Tmr8Wl9|(KEN&J+Oj~YOcBQ1Rr)=P?m
z|3op?f%O>FBYl_@QUP{M4#Bs2LXDlDV-TbP=CDM-^4v;SGc{slGupkq^$CeFdd20UD$fcwMdOEaG@t)a4f
z!!+mskMQ1`zr91c$I7|gUL7wwC_(r+-SWrO(nJMi0Smn?2jXyPbjz$@iHS`zlMkyd
zWo$|A<`v6U8M^H#L#gUPA4m!bIkO+q*MWhJqiI5Cs~(!E&*T65KOa(kiG0c_62
z6)iBH_PlGyR2=96=6n3_Z%vY=1XE77f2D{2;NiT}QI=V&sSCS38
z7}}~$ZH2Zq2NoPdC~~l9NiPeo+2DS
z&|kS$@}4~B5#?09!8S41ON;cc41l-YE>2L+Cu*O*H{TP)e>V4UDsGg|cWbQZAf8sz
zqEl@!i&Sl?A)()_!ThCj2(FK!6!XUbRLWMuA-Aw0MaB^8T<16
z*;q*D`-aBh2S}W$Fd@~6Z=PsuAKrX~^QvLMZHJ|TTN5W>FW1jRs)RC@xmwDy*_yiN
zzbcH4=Nx(q9=hJx=`3N&e^n3t9F9eR7hFkRm?QchA^1&Qiaqcu(0{Y9gj=iCL7ay#G(tsOJtU=B4(m9M}8BDefO^EqYPQqS7b_QPkfG8kHeUKxw!d_t87o&FBO77(R`5uIeGR|tZz1FV!KwcoOBh~gzb)$ouEW5TzOnQ}7
zYNtX!z&bI3xx7HL{R6J7R~XIs$@VGzvp>@&d(MLK!vj}=h?SH%kuB^9Lvj^ucyN&e
zG6>qk%lM4RQNqrIL7dvR_;69N#n5CP+=scZ&Y7*EDMN*2-_
z0^<%nM85~3zs0n6M)ne~m}|rU?Y*aSW?uhbn?Q-YS~1vx{A$CRwy2WHbO>V$Elp(Y
z>h7|fm4sMk$A0#BgVrYeQV=)BHcjx%sxd
zwwOTkVRt2-H+>uTrBT4}89Qg0o}162o+$NPI^(98JfL7@$^)cq=4HV|l*%f?0&-uxAA6gf9bXSz`swi1Y8J;P^3OSX~jJ51&2tvhu8UyivJ}1;+D`#b%e>RR=a{C
zhb@TTh8$6>)%6FZ;+sopygqdN_c-TZCMvnps5$>Cg20xzeyP4b8CgyJ_E=$NCxy%0
zCn)~f
z;l96Mf7tjbjEzShpoJvcu%z*Lf{FYVoNaI=81o`csDo@G(60o5xq%8#xRY=X35O79
z4ths3rZl?kFd54V%ZG;)cYeFEa&ym|abBW6lfw%(E9c0(XuW*}dk}1J^(}+2PF+(#
zI4#RK;!W;@M56*9)W|Sok?AO+G@P0BizICs*4a%Yh1#8ga)^%e
zb9P<2~{ib4+GS8i#+2C_Zpq%e4lS{*B={_Yq>0|RlJ%>P6wGM
zYx;%dFI^8tf4t=L3JhZr&SCM=QdMb(K-%kSxxsoT6?n9UYDLc59s3>Nl0ho*9@pf>h&XA>z9&8$qd5FQftmiiF@HG}`IS?}YTH_e
z249dbql*s@xwZn;T8Loyc_$$KMpE<8K?|v^Hr!yEHGU)G-CItf(X=VwStj||80H;l
z3)en|68OR<1E0i~=hvVy|Eu+