Security isn’t built on tools, It’s built on identity foundations, And in most Microsoft environments that foundation starts with Active Directory. On Prem, cloud or hybrid. SC-900 makes this clear early on, If identity is weak, everything built on top of it is exposed.