M365 Security Architecture Cheatsheet

Security architecture is the set of decisions that determine whether a tenant is defensible, made deliberately and recorded, not assembled from defaults. This is the whole-tenant baseline: one layer at a time, the architecture decision that matters and why. It is the map; the deep single-domain references (identity, SOC, hunting) are the territory. Set against your own licensing and risk before applying.

Architecture thinking

A control is not an architecture. Enabling MFA is a feature; deciding which methods, for which users, enforced by which policy, with which exclusions and why, is architecture. Good security architecture records each significant decision as a tradeoff with a rationale (an architecture decision record), so that six months later the reason a control exists, or was deliberately not applied, is written down rather than reverse-engineered during an incident. The discipline matters because the dangerous configurations are rarely the ones someone chose; they are the defaults nobody decided about.

Identity and authentication architecture

Identity is the control plane, so its architecture is foundational: every other layer assumes the identity layer holds. The decisions here are the authentication methods you permit, how privileged and standard identities differ, and how external and non-human identities are modeled. Get this layer wrong and the rest of the architecture is built on sand, because an attacker with a valid identity inherits whatever the identity is trusted to do.

The decision people skip is the non-human one. Service principals and workload identities authenticate with secrets and certificates that never expire unless someone sets them to, and they sit outside the MFA and conditional-access controls that govern users. An identity architecture that hardens human sign-in while leaving app credentials long-lived and unmonitored has secured the front door and left the loading dock open, which is exactly where mature attackers now go.

Conditional access architecture

Conditional access is where identity, device, and session signals become an access decision, so it is the architecture's enforcement point. The decision is not which policies to enable but how the policy set is structured: a small number of named policies with clear single intents, deployed in rings (report-only, then pilot, then broad) so their combined effect is understood before it is enforced. A CA estate that grew policy by policy without a structure becomes a set of rules nobody dares change.

Privileged access architecture

Privileged access is architected on the assumption that admin credentials are the prize and will be targeted. The model is tiered: privileged accounts are separate from daily-use accounts, privilege is just-in-time rather than standing, and the most sensitive administration happens from hardened workstations that never touch email or the web. This is the layer where assume-breach is most concrete, you design so that a phished user account cannot reach Global Admin.

Data protection architecture

Data protection architecture answers what happens after the perimeter and identity controls are bypassed: can the attacker read, exfiltrate, or destroy the data they reach. The chain is classify, then protect: sensitivity labels mark what matters, label-driven encryption and DLP enforce handling, and the protection travels with the data rather than depending on where it sits. The common architectural failure is protection that stops at the tenant boundary while the data freely leaves it.

The architecture fails at the seam between classification and protection: labels applied inconsistently, or protection rules that do not match the labels, leave data marked sensitive but handled freely. Design the two as one chain, the label is the input the encryption and DLP act on, and audit that the chain actually fires, because a label with no enforcement behind it is documentation, not protection.

Endpoint and email architecture

Endpoints and email are the two surfaces where most intrusions begin, so their architecture is about reducing what an attacker can do once they land. On the endpoint that means enrollment, compliance, and attack-surface reduction; in email it means authentication standards and content protection. The architectural number that matters most is coverage: a device or mailbox the controls never evaluate is an unmonitored door, and that gap is where the next compromise walks in.

Sentinel and detection architecture

Detection architecture is where cost and coverage are traded against each other, because in Sentinel ingestion is the bill. The decisions are which data sources earn their ingestion, how the workspace is structured, and whether detection coverage maps to the techniques you actually face. The mistake is ingesting everything (expensive, noisy) or ingesting by habit (gaps in the techniques nobody chose to cover); the architecture is deliberate coverage at a justified cost.

The architectural tension is real: the data you do not ingest is the detection you cannot write and the investigation you cannot run, but ingesting everything turns the workspace into a cost centre that gets trimmed in the next budget round, taking your coverage with it. Resolve it deliberately, take the free M365 sources unconditionally, ingest paid sources against a named detection or investigation use, and write down the gaps you accept so they are a decision rather than a surprise mid-incident.

Posture and compliance

Posture management measures whether the architecture is actually in force, and its central trap is mistaking the score for the security. Secure Score and compliance dashboards report what is configured, not what is enforced or effective. A control can exist, be reported as present, and protect nothing, because it is in audit mode, scoped to no one, or silently overridden. The architectural discipline is to read posture as a starting question, not an answer.

The architecture baseline checklist

The whole-tenant baseline in one view. Each line is an architecture decision with a defensible secure default; the deep references expand each into its full design.