Microsoft Security Adoption Framework (SAF)

The Microsoft Security Adoption Framework (SAF) is a practical operating model for turning business priorities, risk, and Zero Trust principles into coordinated action. It connects business, technology, and security roles across strategy, architecture, implementation, and operations.

Use SAF to define shared outcomes, clarify responsibilities, select the disciplines and technologies that matter, implement protections, and measure progress across hybrid, multicloud, and multiplatform environments.

Why use SAF?

Use SAF to:

• Align security work to business priorities and risk. Connect business, technology, and security decisions and investments to the outcomes the organization needs to achieve and protect.
• Coordinate shared responsibility. Clarify how business, technology, and security roles make decisions and deliver outcomes together.
• Apply Zero Trust consistently. Use Zero Trust principles across strategy, governance, architecture, implementation, and operations.
• Connect strategy to implementation. Link desired outcomes to security disciplines, technologies, and technical solutions.
• Measure progress and adapt. Track results and adjust as business needs, technology, threats, and organizational capabilities change.

How SAF works

SAF connects business priorities and risk to coordinated security work and technology implementation. Four connected components help business, technology, and security teams understand desired outcomes, the security work needed, what must be protected, and how protections are implemented and operated.

The four components are:

• Business scenarios connect important business or technology initiatives to desired outcomes and risk.
• Security disciplines organize the security work needed to manage risk, make decisions, and improve security capabilities.
• Technologies identify what must be protected, including identities, endpoints, applications, data, infrastructure, networks, and AI.
• Technical solutions translate security requirements into implementation and sustainable operations across products and platforms.

Business priorities and risk provide context. Business scenarios describe desired outcomes. Security disciplines organize how teams work. Technologies identify what must be protected. Technical solutions turn this direction into implementation and operations.

Zero Trust principles inform decisions across all four SAF components—from business priorities and governance through architecture, implementation, and operations.

How roles use SAF

Role group	How the group uses SAF	Common SAF focus
Business leaders and risk owners	Define desired outcomes, business priorities, risk, accountability, and measures of success.	Business scenarios, strategy, and risk
Technology and product teams	Translate priorities and security requirements into architecture, engineering, delivery, implementation, and sustainable operations.	Technologies and technical solutions
Security teams	Provide risk insight, security expertise, governance, architecture, guardrails, validation, detection and response, and security measurement.	Security disciplines and security requirements

These roles contribute to shared outcomes and collaborate to achieve them. SAF provides shared context to help business, technology, and security roles coordinate decisions and responsibilities rather than treating security modernization as the work of a single team. Partners can contribute specialized expertise, implementation, and operational services.

Choose where to start

You don't need to use SAF in a fixed sequence. Choose a starting point that matches your current context:

• Start with strategy and transformation when there's leadership sponsorship for coordinated modernization and the organization needs shared strategic direction.
• Start with a priority risk or problem when an urgent gap or high-value opportunity needs attention.
• Start with a business or technology initiative when a specific initiative needs coordinated protection across roles, disciplines, and technologies.
• Start with a security standard or framework when the organization must align security work to defined objectives or practices.

These starting points are common, not required stages. Organizations can combine them or move between them as priorities, risks, and capabilities change.

Guidelines for using SAF effectively

Organizations can use SAF in different ways depending on their priorities, risks, and current security maturity. Regardless of where you start:

• Align work to business priorities and risk.
• Apply Zero Trust principles across business decisions, security practices, technology design, delivery, and operations.
• Coordinate responsibilities across business, technology, and security teams.
• Connect focused improvements to broader security strategy and architecture.
• Measure outcomes and adapt as priorities, risks, and conditions change.

For goal-based and role-based reading paths, see Using SAF effectively.

How existing security guidance fits into SAF

SAF builds on established Microsoft security guidance rather than replacing it. Some existing guidance is incorporated into the SAF structure, while other resources remain independent and complement SAF with deeper architecture, engineering, assessment, workshop, or operational guidance.

Microsoft provides complementary guidance in several areas:

• Strategy and architecture: CISO workshop and Microsoft Cybersecurity Reference Architectures (MCRA)
• Assessment and technology implementation: Zero Trust assessment and technology implementation guidance
• Engineering: Microsoft Security Development Lifecycle (SDL), DevSecOps Capability Model, and Secure Future Initiative (SFI)
• Operations and response: Privileged access guidance and incident-response playbooks

For details on how these and other Microsoft security resources relate to SAF, see How existing security guidance fits into SAF.

Explore SAF

• Using SAF effectively.
• Explore business scenarios.
• Explore security disciplines.
• Secure technologies.
• Implement technical solutions.
• Use SAF workshops.

Next step

Learn how to choose a practical entry point and connect your work across SAF in Using SAF effectively.