A company plans to migrate to Microsoft 365. You need to advise the company about how Microsoft provides protection in a multitenancy environment. What are three ways that Microsoft provides protection? Each correct answer presents part of the solution.

Microsoft ensures protection in its multitenant cloud environment through a defense-in-depth strategy. This includes physical, logical, and data-layer controls.
1. BitLocker Encryption (A): At the physical layer, BitLocker AES 256-bit encryption is used on all servers, encrypting customer data at rest on the disk volumes. This protects against unauthorized access to the underlying hardware.
2. Azure AD Isolation (B): At the logical layer, each tenant is a discrete, isolated container within Azure Active Directory (Azure AD). Azure AD enforces strict security boundaries, using role-based access control (RBAC) to ensure that credentials for one tenant cannot access the resources of another.
3. Application-Level Isolation (F): Services like Exchange Online are designed for multitenancy, meaning mailboxes from multiple tenants are stored in the same databases. Protection is provided by application-level code that enforces tenant isolation, ensuring no tenant can access or view the data of another.

C. Transport Layer Security (TLS) is a protocol used to encrypt data in transit over a network, not data at rest on a server.
D. Azure AD provides authorization at the identity and application layers. The transport layer is responsible for data transmission, not user authorization or access control.
E. This describes a dedicated or single-tenant architecture. The standard Microsoft 365 multitenant environment intentionally and securely stores data from multiple tenants in shared databases.

1. Microsoft Trust Center. (n.d.). Encryption in Microsoft 365. Microsoft. Retrieved from https://learn.microsoft.com/en-us/purview/encryption.

Section: "Encryption technologies in Microsoft 365" -> "Volume-level encryption". This section explicitly states

"Data at rest in Microsoft 365 is encrypted at the physical level with BitLocker." This supports answer A and refutes C's application to data at rest.

2. Microsoft. (2023

October 18). Isolation and Access Control in Microsoft 365. Microsoft Learn.

Section: "Tenant Isolation". This document details how Azure Active Directory provides a security boundary for each tenant. It states

"The logical isolation of customer content for each tenant is achieved through Azure Active Directory." This supports answer B.

3. Microsoft. (2023

October 18). Isolation and Access Control in Microsoft 365. Microsoft Learn.

Section: "Service-Specific Isolation" -> "Isolation in Exchange Online". This section explains

"Exchange Online stores data from multiple tenants in the same databases... Exchange Online application logic ensures that tenants can only manage and see their own mailboxes and recipients." This supports the architectural fact in F and explains the protection mechanism

while refuting E.