As you've seen throughout this book, managing access to resources is a key component in making sure your data is secure in the Microsoft 365 platform. The Microsoft 365 platform has several tools and capabilities available to help you to secure your users, data, access, and infrastructure. While configuring the policies is out of scope for the MS-300 exam, it's important to know what features and capabilities can be used and when they might be applicable.
Microsoft recommends configuring policies based on risk profiles. You can use the following table to get an idea of what general policies and protections are available with which products, and for which risk profiles they might be applied:
| Risk/Protection Level | Policies | Description | Products or SKUs |
| Baseline | Require MFA when sign-in risk is medium or high... |
