For many IT professionals who are hesitant to move their operations to the cloud, security is the biggest issue that concerns them. The idea of storing sensitive company data on Internet servers, over which they have no direct control—and for which they do not even know the exact location—can be frightening. However, Microsoft has invested an enormous amount of time, effort, and expense into securing its datacenters, and Microsoft 365 includes an array of security tools that subscribers can utilize to provide defense against outside intrusions.

Every security situation is a matter of judgment. Administrators must evaluate the organization’s data and decide how much security it requires. In cases of highly sensitive data, the prospect of storing it in the cloud should rightly be frightening. In such cases, it might be necessary for an organization to maintain local storage and split the enterprise functionality between cloud-based and on-premises systems.

As noted elsewhere in this book, Microsoft maintains dozens of datacenters worldwide. The fact that Microsoft’s cloud services are storing data for thousands of organizations means they have the incentive and the capital to build datacenters with equipment and physical security that only the largest corporations could conceivably duplicate. For most prospective Microsoft 365 subscribers, the cloud will provide greater physical security, higher availability, and more fault tolerance than they could provide themselves.

Therefore, if the Microsoft datacenters can be considered safe against physical theft and most natural disasters, the remaining security concerns are centered around protecting identities, devices, and documents. These concerns threaten any enterprise network, whether on-premises or in the cloud. Unauthorized users can conceivably gain access to sensitive data wherever it is stored, and IT professionals must always try to prevent that from happening.

Security is a continuously developing challenge, with threats growing as quickly as the means to protect against them. For administrators who want to use Microsoft products to keep up with the latest developing threats, there is no question that the latest and best security tools that Microsoft makes are to be found in cloud-based platforms, such as Microsoft 365. Perpetual products, such as Exchange Server and Office 2021, are being left behind in their security capabilities in favor of Software as a Service (SaaS) products like Microsoft 365, Exchange Online, and the cloud-based SharePoint.

The Microsoft 365 security components include the following:

• Microsoft Intune Provides device and application management services that allow mobile devices to join the network only if they comply with security policies that ensure they are appropriately equipped and configured
• Azure Information Protection Enables users and administrators to apply classification labels to documents and implement various types of protection based on the labels, such as access restrictions and data encryption
• Data Loss Prevention Enables the automated discovery of documents that contain common data patterns, such as those of credit cards and Social Security numbers, using preconfigured sensitive information types
• Microsoft Defender for Cloud Apps Analyzes traffic logs and proxy scripts to identify the cloud apps that users are accessing and enables administrators to analyze app security and sanction or unsanction individual apps
• Microsoft Entra ID Protection Evaluates the sign-in activities of individual user accounts and assigns them risk levels that increment when multiple negative events occur
• Microsoft Defender for Identity Uses machine intelligence to prevent, detect, and remediate security threats unique to the Azure environment by analyzing user behavior and comparing it to known attack patterns
• Microsoft Advanced Threat Analytics Captures network traffic and log information and analyzes it to identify suspicious behaviors related to known phases of typical attack processes

Another aspect of Microsoft 365 that might help to convince traditionalists that a cloud platform can be secure is its use of intelligent analysis to identify behavior indicative of an attack. Tools like Microsoft 365 Defender gather information from Microsoft 365 devices, applications, and services and use endpoint behavioral sensors, cloud security analytics, and threat intelligence to prevent, discover, investigate, and remediate potential and actual threats.