Microsoft 365 security and compliance

Microsoft 365 ships with a deep security and compliance stack. The names change often and the portals shift around, but the core split is steady: Microsoft Defender protects against threats, Microsoft Purview governs data, and Microsoft Entra controls identity. Nothing in this stack is one-size-fits-all — what you actually get depends on your licence tier.

Each pillar has a hub: which Defender is which for threat protection, What is Microsoft Purview for data protection and compliance, Conditional Access design for identity, security baselines for devices, and zero trust in Microsoft 365 for the model that ties them together. Operationally, start with the tenant audit checklist and monitoring and alerts.

Microsoft Defender

Defender is the family of threat-protection products:

• Defender for Office 365 — safer links and attachments, anti-phishing, attack simulation training.
• Defender for Endpoint — EDR for Windows, macOS, Linux, iOS, and Android.
• Defender for Identity — detection of identity-based attacks against Active Directory and Entra ID.
• Defender for Cloud Apps — CASB capabilities for SaaS apps.
• Microsoft Defender XDR — the unified portal that correlates signals across all of the above.

Microsoft Purview

Purview is the family of compliance and data-governance products:

• Information protection — sensitivity labels, encryption, and data classification.
• Data loss prevention (DLP) — policies that block or warn when sensitive data is shared improperly.
• Retention and records management — keep what you must, delete what you should.
• eDiscovery and audit — find content for legal cases and investigations.
• Insider risk management — detect risky user behaviour.
• Communication compliance — review chats and emails against policy.

Microsoft Entra

Entra is the identity stack:

• Entra ID for users, groups, and SSO.
• Conditional Access to enforce MFA and device compliance.
• Identity Protection for risky sign-in detection.
• Privileged Identity Management for time-bound admin access.

How licences gate features

A lot of this stack lives behind Microsoft 365 E5 or its standalone add-ons (Defender for Office 365 Plan 1/2, Entra ID P1/P2, Purview eDiscovery Premium). Business Premium gives a meaningful subset for SMBs. If a feature you read about doesn't appear in your tenant, the answer is almost always licensing.

A good starting baseline: MFA for everyone, Conditional Access blocking legacy auth, sensitivity labels on the most sensitive data, and Defender for Office 365 on every mailbox.