Daily Security News
Aboutmerill.net
Security adoption framework and CISO workshop
General

Using SAF effectively

6 November 2026Updated+40 / −50 lines

In brief

Updated Microsoft security guidance documentation in security-docs/zero-trust/security-adoption-journey.md.

What security teams need to know

Review the underlying documentation change to determine whether it affects tenant configuration or rollout plans.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Microsoft security adoption overviewUsing SAF effectively | Microsoft Learn

No two organizations are alike, and companies modernize security in different ways depending on their goals and priorities, maturity, culture, and leadership support.

This article describes three common patterns for starting a Zero Trust security adoption journey.

  • Top down - Start with a high-level strategy. Resolve the strategy into detailed plans, and deliver on those plans.
  • Build up - Start with one or more top priority areas to focus on quick wins. Expand to more areas and build out an overall strategy.
  • Scenario-driven - Start with a specific business scenario and drive a coherent approach for that scenario across multiple disciplines.

Use this guidance to choose a starting point, rather than a pattern. It's important that your starting point enables progress without disrupting critical business operations.

Tip

The Microsoft offers a rich set of security adoption workshops - the Security Adoption Framework (SAF) workshops. Our structured adoption model guidance alignsis designed for business, technology, and security roles to use together. You don't need to read SAF in sequence. Start with the expert-leddecision, outcome, risk, or capability that needs attention, and then connect that work to the relevant roles, disciplines, technologies, and technical solutions.

Use this article to find a practical entry point based on what you need to accomplish or your role in the organization.

Start with what you need

If you need to...Start with...
Align security with business priorities and riskStrategy, integration, and governance
Establish architectural direction and apply Zero TrustSecurity architecture and Zero Trust guidance
Improve a specific security capabilitySecurity disciplines
Secure a business or technology initiativeBusiness scenarios
Plan implementation across technology environmentsTechnologies and technical solutions
Bring stakeholders together to make decisions and build a planSAF workshops
Understand how existing guidance from Microsoft Unified delivered in those workshops. Learn more about SAF workshops.

Select a pattern

relates to SAF		How existing security guidance fits into SAF

Before you start note that:

  • Adoption patterns aren't mutually exclusive. You canThese entries are common entry points, not required stages. Most efforts use one pattern, evolve to another, or blend them over time.
  • Most organizations move through more than one pattern over time,path.

    Find guidance for your role

    Role groupStart hereThen use
    Business leaders and many adoptrisk ownersStrategy, integration, and governanceChoose where to start and relevant business scenarios
    Security leaders, program leaders, and governance, risk, and compliance teamsStrategy, integration, and governanceSecurity posture and relevant security disciplines
    Architects and technology leadersSecurity architectureMCRA and relevant technologies
    Engineering, product, application, data, platform, and operations teamsRelevant technologies and security disciplinesTechnical solutions
    SecOps and incident-response teamsSecOps disciplineIncident-response readiness and incident-response playbooks

    These reading paths identify common entry points, not exclusive ownership. Most SAF outcomes require business, technology, and security roles to work together.

    Connect the guidance

    Whatever your starting point:

    1. Define the shared outcome and the risks that could affect it.
    2. Identify accountable owners, decision rights, and contributing teams.
    3. Apply Zero Trust principles across planning, architecture, delivery, and operations.
    4. Select the security disciplines and technologies involved.
    5. Use technical solutions to implement and operate the required protections.
    6. Measure outcomes and adjust as business needs, technology, and threats change.

    You can enter this work at any point. What matters is connecting immediate action to broader business priorities, risk, strategy, and architecture.

    Use SAF as a blended approach where they use multiple patterns simultaneously.

  • For example,reference, not a buildup or scenario‑driven approach often creates the momentum and insight needed to move towardchecklist

    SAF doesn't prescribe a more comprehensive, strategy‑led adoption.

Whatever pattern you choose, we recommend that you:

  • Decide how you want to modernize. Most organizations focus on updating existing processes and technologies. A few build a newsingle security program from scratch.
  • Alignor transformation sequence. Use the approach. Align withguidance that fits your organizationalorganization's priorities, constraints, risk tolerance,risks, technologies, maturity, and the ability to absorb change.
  • Continuously adjust. Continuously gather data to measure what is working, what isn't, and

    Start where adjustment is needed.

  • Support business as usual. Ensure that you can perform while you transform. Business operationsmake meaningful progress, connect focused work to the broader security direction, and threat actors don't pause during security modernization. Teams must do their day jobs while they're transforming their approach.
expand as priorities and capabilities evolve.

Top-downUse SAF workshops

Top-down is a strategy-led approach that starts with and end-to-end vision, and drives coordinated delivery across the organization. To use this pattern:

  1. Start at the beginning of the adoption path, and establish a clear strategy aligned to business priorities.
  2. Translate that strategy into architecture, roadmaps, and prioritized technical initiatives.
  3. Deliver consistently across security disciplines and technology pillars.

This approach works well for organizations where CISOs and security leaders have strong executive sponsorship and understand the importance of driving a coordinated change and active collaboration across business, IT, and security teams.

Build-up

Buildup is an incremental approach that starts with targeted improvements and expands over time. To use this pattern:

  1. Start with a high-impact quick win that addresses and urgent risk or operational gap. For example focuses on a specific discipline or pillar to begin.
  2. Demonstrate measurable value of the quick win to build credibility and support.
  3. Expand laterally within the same discipline for another win, or transition to a broader, strategy-led top-down approach.

This pattern works well for organizations that currently lack full executive sponsorship for security modernization. Technical and security leaders can use visible wins to reduce risk and build credibility for broader adoption.

Scenario-driven

Scenario-driven adoption focuses on securing a specific business initiative and uses it to drive cross‑discipline alignment. To use this pattern:

  1. Identify a high-priority business scenario.
  2. Secure the scenario across multiple security disciplines.
  3. Use the scenario to exposure dependencies, gaps, and future modernization needs.

This pattern is suitable when there's executive support and funding for a particular security initiative, but not for full security transformation. It helps organizations to connected disconnected programs and siloed efforts, improve collaboration, and defer lower-priority modernization until later. \ No newline at end of file SAF workshops provide facilitated experiences that help stakeholders align on priorities, make decisions, and build actionable plans. Use them when shared understanding or cross-functional decisions are the main barrier to progress. \ No newline at end of file