How app governance in Defender for Cloud Apps inventories OAuth apps registered in Entra ID, Google Workspace and Salesforce, scores their permissions and data usage, detects consent phishing and anomalous app behaviour, and how it fits with Entra user consent settings and the admin consent workflow.
How Intune compliance works end to end, from per-platform settings, the built-in default policy, grace periods and custom compliance through the Entra device object to a Conditional Access grant that requires a compliant device or an app protection policy, plus the MDE risk signal and how to unblock a user.
How Defender for Cloud Apps takes over a browser session from Entra Conditional Access, through the mcas.ms reverse proxy or Edge for Business in-browser protection, and how access and session policies block downloads, uploads, copy, paste and print on unmanaged devices.
How Conditional Access evaluates a sign-in, every condition, grant and session control, the Microsoft baseline and templates, break-glass exclusions, naming, report-only rollout, and the Graph and PowerShell shapes behind it all.
How Entra Connect Sync and Entra Cloud Sync move AD objects into Entra ID, which one to pick, how PHS, PTA, federation and seamless SSO authenticate hybrid users, the writebacks, Entra Kerberos for WHfB and FIDO2, sync errors and the operational traps.
Managed AD DS in Azure with LDAP, Kerberos, NTLM, domain join and Group Policy but no domain controllers to run, how identities reach it by one-way sync, when to pick it over IaaS DCs or cloud-only Entra join, and what it cannot do.
What Entra ID Protection detects, how user risk and sign-in risk are scored and remediated, the two risk-based Conditional Access policies that replace the retired legacy policies, workload identity risk, the Graph and PowerShell surface, export to Sentinel, and how risk shows up in Defender XDR.
Microsoft's SSE in one article, Entra Internet Access for web filtering and the Microsoft 365 profile, Entra Private Access as the VPN replacement through private network connectors, the client on four platforms, traffic forwarding profiles, compliant network Conditional Access, logging to Sentinel, and the limits that bite.
Entra ID Governance for the security engineer, with access reviews, entitlement management access packages, joiner mover leaver lifecycle workflows, guest and cross-tenant governance, dynamic groups, provisioning, and the licensing split between P2, the Governance SKU and Entra Suite.
Every documented hand-off between Intune and another Microsoft product, as one matrix, with the MDE two-way data flow, the Conditional Access signal chain, where each switch lives, and what silently breaks when a licence or tenant is wrong.
Every documented product-to-product link in the Defender family, where each switch lives, what it needs, what it unlocks, and how to prove it is working.
The three Windows device identity states in Entra ID, what each unlocks for SSO, Conditional Access, Intune, Windows Hello and LAPS, how hybrid join actually registers through the SCP, userCertificate and Entra Connect, why Entra join plus cloud Kerberos trust is now the default answer, and how to verify, clean up and troubleshoot.
Privileged Identity Management for Entra roles, Azure roles and groups, role settings and activation controls, alerts and access reviews, least-privilege role mapping, administrative units including restricted management, custom roles, protected actions, role-assignable groups, break-glass accounts and the privileged access roadmap.
The three permission layers in the Defender portal, Entra global roles, the legacy per-product RBAC for MDE, MDO, MDA and MDI, and unified RBAC with its permission groups, data sources, scoping, activation, import and the 2026 auto-enablement.
App registration vs service principal vs managed identity, application vs delegated permissions, admin consent, secrets vs certificates vs federated credentials, Workload ID Premium, the app registration hardening checklist, and how to monitor service principal credentials and sign-ins.