1.1. Identity Is the New Perimeter
💡 First Principle: When your users, devices, and apps live everywhere — home networks, SaaS clouds, phones — there is no network edge left to defend. The only thing present in every access request, wherever it comes from, is an identity. So identity becomes the control plane: the one chokepoint where you can verify, decide, and enforce.
What breaks without this mindset: a firewall-first security model assumes trustworthy insiders. One phished password later, the attacker is an insider, and the firewall waves them through. Most real-world breaches begin exactly this way — a valid credential used maliciously — which is why the SC-300 exists as its own certification.
Think of the shift like moving from a castle to an airport. A castle has one wall and one gate: once you're inside, you can go anywhere. An airport re-checks identity at every boundary — check-in, security, the gate — and adjusts scrutiny to risk (TSA PreCheck for known travelers, extra screening for anomalies). Microsoft's Zero Trust model formalizes this into three principles you'll see behind every Entra feature: verify explicitly (authenticate and authorize on every request using all available signals), use least privilege (grant the minimum access, just-in-time where possible), and assume breach (design as if the attacker is already inside — segment, monitor, and limit blast radius).
Map those three principles to products now and Phases 2–5 will feel inevitable: verify explicitly → Conditional Access and MFA; least privilege → PIM, custom roles, administrative units; assume breach → ID Protection, access reviews, monitoring.
⚠️ Common Misconception: "Our network security still protects us, so identity controls are a nice-to-have." In a cloud-and-mobile estate, network location is just one weak signal among many — and the exam's scenarios routinely feature attackers with valid passwords, where only identity-layer controls (MFA, risk policies, Conditional Access) stop the breach.
Reflection Question: An attacker phishes a valid password for a user working from home on a personal laptop. Which of the three Zero Trust principles, applied at the identity layer, could still stop the sign-in — and which product family implements it?
