Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The Microsoft Security Adoption Framework (SAF) is designed for business, technology, and security roles to use together. You don't need to read SAF in sequence. Start with the decision, outcome, risk, or capability that needs attention, and then connect that work to the relevant roles, disciplines, technologies, and technical solutions.
Use this article to find a practical entry point based on what you need to accomplish or your role in the organization.
Start with what you need
| If you need to... | Start with... |
|---|---|
| Align security with business priorities and risk | Strategy, integration, and governance |
| Establish architectural direction and apply Zero Trust | Security architecture and Zero Trust guidance |
| Improve a specific security capability | Security disciplines |
| Secure a business or technology initiative | Business scenarios |
| Plan implementation across technology environments | Technologies and technical solutions |
| Bring stakeholders together to make decisions and build a plan | SAF workshops |
| Understand how existing guidance relates to SAF | How existing security guidance fits into SAF |
These entries are common entry points, not required stages. Most efforts use more than one path.
Find guidance for your role
| Role group | Start here | Then use |
|---|---|---|
| Business leaders and risk owners | Strategy, integration, and governance | Choose where to start and relevant business scenarios |
| Security leaders, program leaders, and governance, risk, and compliance teams | Strategy, integration, and governance | Security posture and relevant security disciplines |
| Architects and technology leaders | Security architecture | MCRA and relevant technologies |
| Engineering, product, application, data, platform, and operations teams | Relevant technologies and security disciplines | Technical solutions |
| SecOps and incident-response teams | SecOps discipline | Incident-response readiness and incident-response playbooks |
These reading paths identify common entry points, not exclusive ownership. Most SAF outcomes require business, technology, and security roles to work together.
Connect the guidance
Whatever your starting point:
- Define the shared outcome and the risks that could affect it.
- Identify accountable owners, decision rights, and contributing teams.
- Apply Zero Trust principles across planning, architecture, delivery, and operations.
- Select the security disciplines and technologies involved.
- Use technical solutions to implement and operate the required protections.
- Measure outcomes and adjust as business needs, technology, and threats change.
You can enter this work at any point. What matters is connecting immediate action to broader business priorities, risk, strategy, and architecture.
Use SAF as a reference, not a checklist
SAF doesn't prescribe a single security program or transformation sequence. Use the guidance that fits your organization's priorities, risks, technologies, maturity, and ability to absorb change.
Start where you can make meaningful progress, connect focused work to the broader security direction, and expand as priorities and capabilities evolve.
Use SAF workshops
SAF workshops provide facilitated experiences that help stakeholders align on priorities, make decisions, and build actionable plans. Use them when shared understanding or cross-functional decisions are the main barrier to progress.