Ta usługa zapewnia kompleksowe podejście do ochrony danych, kont użytkowników i zasobów w chmurze.
| # | Moduł / Workload | 🔒 Hardening / Konfiguracja (przykłady) | 🔍 Monitoring & Automation | 📜 Compliance / Governance | Licencje | Główne KPI / Efekt biznesowy |
|---|---|---|---|---|---|---|
| 1 | Entra ID (Identity) | MFA FIDO2/Passkeys, PIM & RBAC, Conditional Access baseline, Identity Protection risk policies, Passwordless SSPR, Entra Connect hardening | Workbooks + alerty CA/PIM/IP, risk events do XDR | Access Reviews, 365-d audit log (Diagnostics) | Entra ID P2 | 100 % kont chronionych MFA, brak stałych Global Admin |
| 2 | Exchange Online | Modern Auth enforce (blokada Basic), Defender for O365 P2 – Anti-phish/ Safe Links/Attachments/ ZAP, transport rules & DLP, RBAC | Threat Explorer & AIR, real-time detections | AuditAdmin, Retention (Purview) | M365 E5 Security lub MDO P2 | ≥ 95 % złośliwych maili blokowanych |
| 3 | SharePoint Online / OneDrive | Sensitivity Labels + auto-apply, External Sharing MFA, Endpoint DLP, versioning lock, Adaptive Scopes | Defender for Cloud Apps session control, anomaly detections | Retention & Records Mgmt | M365 E5 lub E3 + Compliance addon | 0 nieautoryzowanych wycieków plików |
| 4 | Microsoft Teams | Naming & Sensitivity-label policies, Guest Access, Safe Links/Attachments in chat, App Permission policies | Teams-specific hunting queries | Audit (chat, meetings) | M365 E5 Security | Brak shadow-IT aplikacji w Teams |
| 5 | Defender for Endpoint (EDR) | Onboarding Win/macOS/Linux/iOS/Android (Intune/GPO/MDM), Attack Surface Reduction, EDR in Block Mode, Network Protection, WDAC & Device Control, harmonogram skanowania | TVM Secure Score, Live Response & KQL hunting, Automated Investigation & Response | Endpoint DLP, Tamper Protection, audit do Sentinel | MDE Plan 2 (w M365 E5) | 100 % urządzeń objętych EDR, MTTR ≤ 45 min |
| 6 | Defender for Identity | Instalacja sensorów na DC/AD CS, hardening krbtgt/SID-500, LDAP-S, Honeytokens | Attack Timeline, lateral-movement paths, alerty VPN-less | Alert retention, export do Sentinel | M365 E5 Security | 100 % DC objętych detekcją ruchu bocznego |
| 7 | Defender for Cloud Apps (MCAS) | Discovery Shadow IT, OAuth App Governance, session control z CAP | Anomaly detection (Impossible Travel, OAuth over-permission), Auto-remediation | Log retention > 180 dni | MCAS / M365 E5 | Redukcja Shadow IT o > 70 % |
| 8 | Intune / Endpoint Manager | Device Compliance policies, configuration baselines, BitLocker & FileVault, Mobile App Management (MAM), patch rings | Compliance reports, failed policy alerts | Device inventory eksport do Purview | Intune (w M365 E3/E5) | 0 urządzeń bez szyfrowania dysku |
| 9 | Microsoft Purview (Data & Compliance) | Unified DLP (Endpoint, Exchange, SPO/OD, Teams), Insider Risk policies, eDiscovery Premium | Content Explorer, adaptive scopes alerts | Records Management, Communication Compliance | Purview add-ons lub E5 Compliance | Zgodność z RODO i ISO 27001 |
| 10 | Microsoft Sentinel (SIEM + SOAR) – opcja | Konektory M365 Defender / Entra ID / Azure / VMware, MITRE ATT&CK workbooki | Analizy KQL, Fusion Correlation, Playbooki Logic Apps | Long-term log storage (2–7 lat) | Sentinel + Log Analytics | MTTD globalnie ≤ 15 min |
| 11 | Synergia XDR (w portalu Microsoft 365 Defender) | Entra ID / MDE risk → Conditional Access, Unified incident portal, Attack Story | Auto-tagging etapów kill-chain, cross-product hunting | Centralny audit / export | – | Odciążenie SOC o > 70 % |
