1.2. How the Core Security Platforms Fit Together

💡 First Principle: SC-500 tests five platforms that map to three functions — prevent, detect, and respond — and confusing which platform owns which function is one of the most common ways to lose easy points on scenario questions.

Microsoft Entra ID and Azure Key Vault are largely preventive — they stop unauthorized access before it happens. Microsoft Defender for Cloud straddles prevention (policy and posture) and detection (workload protection alerts). Microsoft Sentinel is the detection and response layer, correlating signals across everything else into incidents. Microsoft Security Copilot sits on top of all of it as an investigation and response accelerator, not a data source of its own. A scenario that asks "where would you configure X" is really asking you to place X correctly on this map.

⚠️ Common Misconception: It's tempting to treat these five platforms as interchangeable "security tools" that all do roughly the same thing. They don't — each owns a distinct function, and a well-designed environment uses all of them together rather than picking one as a do-everything solution.