Daily Security News
Aboutmerill.net
Security adoption framework and CISO workshop
Standards and frameworks

Microsoft Security Adoption Framework (SAF)

6 November 2026Updated+59 / −65 lines

In brief

Updated Microsoft security guidance documentation in security-docs/zero-trust/security-adoption-model.md.

What security teams need to know

Review the underlying documentation change to determine whether it affects tenant configuration or rollout plans.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Microsoft Security Adoption Framework (SAF) | Microsoft Learn

To build effective security foundations and defend against attacks in the age of artificial intelligence (AI) and AI agents, organizations must follow Zero Trust principles.

Adopting Zero Trust security principles across your organization is a complex, multiyear effort that spans business strategy and planning, technical design and architecture, deployment, and operations.

Without a structured adoption approach, security modernization programs can become fragmented, reactive, and difficult to sustain.

The Microsoft Security Adoption Framework (SAF) provides you withis a structuredpractical operating model for turning business priorities, risk, and Zero Trust principles into coordinated action. It connects business, technology, and security adoption model with standardized, repeatable, role-aware processesroles across strategy, architecture, implementation, and operations.

Use SAF to define shared outcomes, clarify responsibilities, select the disciplines and technologies that help you plan, prioritize,matter, implement protections, and implement end-to-end security modernizationmeasure progress across hybrid, multicloud, and multiplatform environments.

This framework aligns critical business outcomes, security disciplines, and solution implementations so that business leaders, security managers, architects, and practitioners can move forward together at a controlled and sustainable pace across the organization.

SAF helps you avoid common mistakes, often called antipatterns, in your security modernization journey.

Tip

Microsoft offers a rich set of security adoption workshops - the Security Adoption Framework (SAF) workshops. Our structured adoption model guidance aligns with the expert-led guidance from Microsoft Unified delivered in those workshops. Learn more about SAF workshops.

Adoption model structure

The adoption model is built on three core components that help organizations move from business intent to detailed implementation:

  • Business scenarios define typical business outcomes and how security must be adapted to achieve them.
  • Security disciplines define how teams organize, plan, and operate to modernize security and achieve business outcomes.
  • Technology pillars describe organizational assets and resources that you want to secure. For example identity, devices, and data.

Diagram showing the four connected SAF components: business scenarios, security disciplines, technologies, and technical solutions, with roles and Zero Trust principles applying across the framework.

Why use an adoption model?SAF?

A structured adoption model helps youUse SAF to:

  • Align with security best practiceswork to business priorities and risk. - Align with Zero Trust principles, Microsoft Secure Future Initiative (SFI) patterns, open standards and guidance,Connect business, technology, and other security best practices.security decisions and investments to the outcomes the organization needs to achieve and protect.
  • Maximize existing investmentsCoordinate shared responsibility. - Get value from your existing tools before introducing new capabilities.Clarify how business, technology, and security roles make decisions and deliver outcomes together.
  • Deliver an end-to-end security strategyApply Zero Trust consistently. - Connect business priorities to securityUse Zero Trust principles across strategy, governance, architecture, controls, processes,implementation, and operations.
  • Adapt continuouslyConnect strategy to implementation. - EvolveLink desired outcomes to security posturedisciplines, technologies, and strategytechnical solutions.
  • Measure progress and adapt. Track results and adjust as threats, business needs, technology, threats, and technologiesorganizational capabilities change.

How SAF works

SAF connects business priorities and risk to coordinated security work and technology implementation. Four connected components help business, technology, and security teams understand desired outcomes, the security work needed, what must be protected, and how protections are implemented and operated.

The four components are:

  • Prioritize actionBusiness scenarios - Provide practical role-specific guidance for teamsconnect important business or technology initiatives to desired outcomes and stakeholders, grounded in best practices, lessons learned,risk.
  • Security disciplines organize the security work needed to manage risk, make decisions, and real-world examples.improve security capabilities.
  • Technologies identify what must be protected, including identities, endpoints, applications, data, infrastructure, networks, and AI.
  • Technical solutions translate security requirements into implementation and sustainable operations across products and platforms.

This diagram illustratesBusiness priorities and risk provide context. Business scenarios describe desired outcomes. Security disciplines organize how SAF brings these elements togetherteams work. Technologies identify what must be protected. Technical solutions turn this direction into a single adoption model.implementation and operations.

Diagram showing how the adoption model includes learnings and guidance from Microsoft and external sources.Zero Trust principles inform decisions across all four SAF components—from business priorities and governance through architecture, implementation, and operations.

EnableHow roles with the adoption modeluse SAF

By organizing this guidance around common business scenarios, disciplines, and implementation steps, the model helps you move from isolated recommendations to a cohesive approach for planning, implementing, and measuring security improvements. Microsoft will continue to enrich the adoption model content over time.

Each component of the adoption model targets a specific audience and role.

SectionRole group Primary audienceHow the group uses SAF AimCommon SAF focus
Business scenariosBusiness leaders and risk owners Business leadersDefine desired outcomes, business priorities, risk, accountability, and measures of success. Identify, define,Business scenarios, strategy, and communicate critical business outcomes that security must support.Translate business priorities into actionable security goals that guide planning and decision-making.Provide practical, repeatable guidance for business outcomes, with clear paths to the roles and disciplines involved in delivering the outcome.risk
Security disciplinesTechnology and product teams Security leaders and teams, IT leaders, designers, architects.Bridge business scenariosTranslate priorities and security deployment/implementation. Ensure that security investmentsrequirements into architecture, engineering, delivery, implementation, and priorities translate into measurable outcomes through clear planning, architecture,sustainable operations.Technologies and operational practices.Business scenarios usually map to multiple security disciplines.technical solutions
Technology pillarsSecurity teams TechnicalProvide risk insight, security expertise, governance, architecture, guardrails, validation, detection and response, and security implementers and partners.measurement. Define what types of assets must be secured, and where Zero Trust principlesSecurity disciplines and security controls must be applied.Connect security strategy to implementation by grouping related technologies, controls, and capabilities.Business scenarios are likely to cross multiple technology pillars. For example, if our business outcome is to improve security posture across the enterprise, then we must improve posture across devices, data, infrastructure, networks, and more.requirements

Diagram showing how the adoption model serves different roles across the organization.These roles contribute to shared outcomes and collaborate to achieve them. SAF provides shared context to help business, technology, and security roles coordinate decisions and responsibilities rather than treating security modernization as the work of a single team. Partners can contribute specialized expertise, implementation, and operational services.

Adoption guidanceChoose where to start

Structured adoption guidance focuses on:You don't need to use SAF in a fixed sequence. Choose a starting point that matches your current context:

These starting points are common, not required stages. Organizations can combine them or move between them as priorities, risks, and capabilities change.

Guidelines for rolesusing SAF effectively

Organizations can use SAF in different ways depending on their priorities, risks, and current security disciplines.maturity. Regardless of where you start:

  • Align work to business priorities and risk.
  • Product-agnostic recommendations based on Zero Trust principles, Microsoft best practices, and external frameworks.
  • Detailed implementation guidance using Microsoft security products and services.
  • Alignment withApply Zero Trust principles across business decisions, security practices, technology design, delivery, and operations.
  • Coordinate responsibilities across business, technology, and security best practices.teams.
  • Connect focused improvements to broader security strategy and architecture.
  • Measure outcomes and adapt as priorities, risks, and conditions change.

Diagram showing how the Security Adoption Framework (SAF) connects the business with security and technology.For goal-based and role-based reading paths, see Using SAF effectively.

ExistingHow existing security guidance integrationfits into SAF

This adoption model brings togetherSAF builds on established Microsoft security guidance that was historically published across multiple frameworksrather than replacing it. Some existing guidance is incorporated into the SAF structure, while other resources remain independent and resources, aligning it into a single, actionable structure.complement SAF with deeper architecture, engineering, assessment, workshop, or operational guidance.

It integrates and builds on established guidance, including these content sources:Diagram showing how SAF integrates selected guidance and connects to complementary Microsoft security guidance.

Microsoft provides complementary guidance in several areas:

Diagram showing how the adoption model integrates existing security content.For details on how these and other Microsoft security resources relate to SAF, see How existing security guidance fits into SAF.

AdditionalExplore SAF resources

Use these resources to complement the adoption model with focused guidance and workshop material: