Microsoft Enterprise Mobility + Security Suite

Organizations are shifting from reactive cybersecurity—waiting for audit failures—to proactive, strategically planned security programs built around real-time analytics and dynamic account control. In response, Microsoft introduced a simplified licensing approach for its security portfolio through the Enterprise Mobility + Security (EMS) suite, designed to help organizations choose capabilities aligned to their requirements while supporting hybrid environments across endpoints and cloud services.

Microsoft’s cross-platform strategy emphasizes consistent access and protection across PCs, tablets, and smartphones, extending to servers and document stores through centralized, policy-based management and rights management. EMS integrates three core security pillars: behavioral analytics (learning “normal” usage and flagging anomalies), threat intelligence (research-driven detection of phishing and ransomware precursors), and information protection (classification, labeling, and rights enforcement to enable secure internal and external sharing). The suite is offered in two tiers: EMS E3 as the core identity-driven security and management bundle, and EMS E5 adding expanded document classification/protection, risk-based identity protection, and improved cloud app management.

Key components include Azure Active Directory Identity Protection, which applies heuristic and machine-learning-driven risk evaluation to authentication events and can permit, notify, deny, or step-up authentication using MFA, device enrollment, or password reset. Microsoft Intune provides consolidated device and app management across Windows, macOS, iOS, and Android, enabling policy enforcement and app-based data loss controls. Azure Information Protection enables end-to-end document security—classification through protection—where labels and usage rights travel with files across devices, locations, cloud storage, and external partners. Advanced Threat Analytics (on-premises) monitors domain controller traffic to detect suspicious patterns and known attack techniques, while Cloud App Security (CASB) discovers and scores cloud apps using log-based analysis and policy controls.

Microsoft’s main challenges are harmonizing historically disparate products, reducing console sprawl, enabling integration with existing security stacks, and clarifying EMS licensing.

• Microsoft reorganized EMS around behavioral analytics, threat intelligence, and document protection.
• EMS is offered in two tiers: EMS E3 and EMS E5.
• EMS E5 includes the EMS E3 suite plus document classification/protection, risk-based identity protection, and improved cloud app management.
• Azure AD Identity Protection can permit access, allow with notification, or deny an authentication request based on risk.
• Risk evaluation in Azure AD Identity Protection uses heuristic rules, policies, and machine learning.
• A user’s risk level is derived from confidence in the access and severity of risk events.
• Microsoft Intune can manage Windows, macOS, iOS, and Android devices.
• Azure Information Protection supports classify, label, and protect functions, including encryption and access control.
• Advanced Threat Analytics is an on-premises solution monitoring activity to and from Active Directory domain controllers via an ATA Gateway.
• Cloud App Security evaluates discovered SaaS apps against 13,000+ known apps and scores them using more than 60 factors.

• “No longer are companies waiting for audit failures before addressing security issues, they are taking a proactive approach and strategically planning their cybersecurity environment.”
• “How do we provide a comprehensive solution to cybersecurity and future-proof our organization for foreseeable vulnerabilities?”
• “Behavioral analytics learns about normal patterns of usage on a network and alarms on out-of-pattern activity.”
• “Threat intelligence uses enterprise-level research to ward-off phishing and ransomware attacks that usually precede hacker attacks.”
• “The Cloud is a major driver for Microsoft’s cybersecurity offerings; the same level of protection for documents and applications can now be provided in the Cloud as it is on the corporate network.”
• “Risk events are determined via policies and machine learning functionality.”
• “A user’s risk level can be reset via a management action such as issuing a manual password reset.”
• “These ‘markings’ are stored as part of the meta-data that travels with the document to ensure its protection transcends the device on which it’s opened, or the location to which it’s saved.”
• “It is becoming increasingly obvious that organizations need more than network edge devices to protect their sensitive data.”
• “The efficacy of any threat analysis is the minimization of false positives; if there are too many events to investigate, potentially important ones will be missed.”