Microsoft 365 security and compliance

Microsoft 365 ships with a deep security and compliance stack. The names change often and the portals shift around, but the core split is steady: Microsoft Defender protects against threats, Microsoft Purview governs data, and Microsoft Entra controls identity. Nothing in this stack is one-size-fits-all — what you actually get depends on your licence tier.

Each pillar has a hub: which Defender is which for threat protection, What is Microsoft Purview for data protection and compliance, Conditional Access design for identity, security baselines for devices, and zero trust in Microsoft 365 for the model that ties them together. Operationally, start with the tenant audit checklist and monitoring and alerts.

Microsoft Defender

Defender is the family of threat-protection products:

• Defender for Office 365 — safer links and attachments, anti-phishing, attack simulation training.
• Defender for Endpoint — EDR for Windows, macOS, Linux, iOS, and Android.
• Defender for Identity — detection of identity-based attacks against Active Directory and Entra ID.
• Defender for Cloud Apps — CASB capabilities for SaaS apps.
• Microsoft Defender XDR — the unified portal that correlates signals across all of the above.

Microsoft Purview

Purview is the family of compliance and data-governance products:

• Information protection — sensitivity labels, encryption, and data classification.
• Data loss prevention (DLP) — policies that block or warn when sensitive data is shared improperly.
• Retention and records management — keep what you must, delete what you should.
• eDiscovery and audit — find content for legal cases and investigations.
• Insider risk management — detect risky user behaviour.
• Communication compliance — review chats and emails against policy.

Microsoft Entra

Entra is the identity stack:

• Entra ID for users, groups, and SSO.
• Conditional Access to enforce MFA and device compliance.
• Identity Protection for risky sign-in detection.
• Privileged Identity Management for time-bound admin access.

How licences gate features

A lot of this stack lives behind Microsoft 365 E5 or its standalone add-ons (Defender for Office 365 Plan 1/2, Entra ID P1/P2, Purview eDiscovery Premium). Business Premium gives a meaningful subset for SMBs. If a feature you read about doesn't appear in your tenant, the answer is almost always licensing.

A good starting baseline: MFA for everyone, Conditional Access blocking legacy auth, sensitivity labels on the most sensitive data, and Defender for Office 365 on every mailbox.

How the three pillars actually work together

The three-way split (Defender protects, Purview governs, Entra controls identity) is a useful mental model but understates how tightly the pillars actually interlock in a working tenant. Identity risk signals from Entra ID Identity Protection feed Conditional Access decisions that, in turn, determine whether a device even reaches the point of touching Purview-governed data. Defender XDR's alerts frequently originate from identity anomalies (Defender for Identity) or endpoint anomalies (Defender for Endpoint) that later inform an Insider Risk Management case in Purview when the pattern looks like deliberate misuse rather than external attack. And sensitivity labels, nominally a Purview capability, are what Defender for Cloud Apps and endpoint DLP actually key off when deciding whether a specific file transfer should be blocked. In practice, a mature security programme treats these as one connected system with three administrative surfaces, not three independent products that happen to ship together.

Frequently asked questions

Where should a small security team focus first if budget is limited? Identity, almost always — MFA enforcement and a Conditional Access policy blocking legacy authentication cost nothing beyond Entra ID P1 (already included in Business Premium and E3) and close off the attack path responsible for the large majority of real-world Microsoft 365 compromises, before spending further budget on the Defender or Purview layers.

Does Microsoft 365 E5 include everything in this stack? E5 includes the great majority of it, but a handful of capabilities are separately licensed add-ons even on E5 — SharePoint Advanced Management and certain Priva modules among them — so "we're on E5" is a strong starting position but not a guarantee that literally every feature described across the Defender, Purview, and Entra guides is already switched on and available.

How often should this stack actually be reviewed once it's configured? Quarterly at minimum for the fast-moving parts — Secure Score's action backlog, Conditional Access policy coverage against new sign-in patterns, and Purview label adoption — since Microsoft ships new capability continuously and a configuration that was complete a year ago routinely has gaps against what's available today.