11.6 Renamed Products and Similar-Name Traps
Key Takeaways
- Use current names: Azure AD is now Entra ID, Azure Sentinel is now Microsoft Sentinel, Microsoft 365 Defender is now Defender XDR, MCAS is now Defender for Cloud Apps, Azure ATP is now Defender for Identity, Azure Security Center is now Defender for Cloud, and MIP is now Purview Information Protection.
- Defender for Cloud and Defender for Cloud Apps are different products: cloud resources/posture versus SaaS app discovery and control.
- Compliance Manager compliance score and Defender for Cloud secure score are different scores in different domains.
- Rebrand traps usually appear as distractors, not as direct naming questions, so translate every legacy term to its current name before answering.
Naming Accuracy Is an Exam Skill
Microsoft product names change often, and SC-900 candidates frequently study from notes, videos, and screenshots made at different times. The exam uses current names. When you see older naming in outside resources, translate it to the current term before you memorize anything; otherwise one service can look like two separate answers. The identity rename is the most common example: Microsoft Entra ID is current, Azure Active Directory (Azure AD) is the former name, and they are the same service.
The table below is the master rebrand reference for this exam. Memorize the right-hand column as the answer-key vocabulary, and recognize the left-hand column only so you can translate stale study material.
| Former name | Current name (use this) | What it does |
|---|---|---|
| Azure Active Directory (Azure AD) | Microsoft Entra ID | Cloud identity and access management. |
| Azure Sentinel | Microsoft Sentinel | Cloud-native SIEM and SOAR. |
| Microsoft 365 Defender | Microsoft Defender XDR | Extended detection and response across Defender services. |
| Microsoft Cloud App Security (MCAS) | Microsoft Defender for Cloud Apps | CASB for SaaS app discovery and control. |
| Azure Advanced Threat Protection (Azure ATP) | Microsoft Defender for Identity | On-premises Active Directory threat detection. |
| Azure Security Center / Azure Defender | Microsoft Defender for Cloud | Cloud security posture management and workload protection. |
| Microsoft Information Protection (MIP) | Microsoft Purview Information Protection | Data classification, sensitivity labels, and protection. |
A rebrand trap usually appears as a distractor rather than a direct "what is the new name?" question. An answer choice may use a current product name while your memory supplies an older label, or vice versa. Trust the current names above. This matters most for identity and for extended detection and response, because older content using "Azure AD" and "Microsoft 365 Defender" is still widely circulated online.
Similar Names, Different Jobs
Beyond rebrands, several current names are close enough to be confused. Keep these one-line jobs straight:
- Defender for Cloud: cloud resource posture, recommendations, standards, regulatory compliance views, secure score, and workload protection.
- Defender for Cloud Apps: SaaS app discovery and control (CASB).
- Microsoft Defender XDR: correlated detection and response across Defender services in the Defender portal.
- Microsoft Sentinel: SIEM and SOAR with connectors, incidents, hunting, workbooks, and playbooks across any source.
- Microsoft Purview: compliance, information protection, data governance, retention, eDiscovery, audit, and risk.
- Defender for Identity (on-premises AD) vs Entra ID Protection (cloud identity risk): both touch identity, but different environments.
Read the Object of the Verb
Similar-name traps yield to one technique: read the object of the verb. If the organization wants to protect virtual machines and cloud resources through recommendations and workload protection, the object is cloud infrastructure and the answer is Defender for Cloud. If it wants to discover and control SaaS applications, the object is cloud apps and the answer is Defender for Cloud Apps. The words "cloud" and "apps" both carry weight.
The score trap deserves a final pass. Compliance Manager produces a compliance score and improvement actions in the compliance solutions domain. Defender for Cloud surfaces a secure score and posture recommendations in the security solutions domain. Both help prioritize work, but they are in different domains. Write the score name next to the domain before answering, and the swap disappears.
Your goal is not to memorize every historical brand for its own sake — it is to answer current SC-900 questions with current names and correct product boundaries. When a third-party resource conflicts with current Microsoft naming, follow the current name and verify against official Microsoft Learn pages before you trust your old notes. A candidate who reliably translates legacy terms and reads the object of the verb will clear the naming-trap questions that catch unprepared test-takers.
Why These Rebrands Happened, and How to Drill Them
Understanding the logic behind Microsoft's renames makes them far easier to remember than rote memorization. Microsoft consolidated its security portfolio under three umbrella brands: Entra for everything identity, Defender for everything threat protection and detection, and Purview for everything compliance and data governance, with Sentinel kept as the standalone SIEM/SOAR name. Each rebrand pulls a product under its umbrella. Azure AD moved under Entra because it is identity. Azure Security Center, Azure ATP, and MCAS all moved under Defender because they protect or detect threats.
Microsoft Information Protection moved under Purview because it is data governance. Microsoft 365 Defender became Defender XDR to signal it is the cross-product correlation layer, not just a Microsoft 365 add-on. Once you see the umbrella each product belongs to, the new name almost predicts itself.
| Umbrella brand | Domain | Members that were renamed into it |
|---|---|---|
| Microsoft Entra | Identity and access | Azure AD → Entra ID |
| Microsoft Defender | Security / threat protection | Azure Security Center, Azure ATP, MCAS, M365 Defender |
| Microsoft Purview | Compliance and data governance | Microsoft Information Protection (MIP) |
| Microsoft Sentinel | SIEM and SOAR | Azure Sentinel |
A Two-Pass Naming Drill for Final Week
Run a simple two-pass drill before test day. Pass one — translate: take any study note, video transcript, or screenshot caption that uses a legacy term and rewrite it with the current name. Seeing "Azure AD Conditional Access" become "Entra ID Conditional Access," or "Azure Security Center secure score" become "Defender for Cloud secure score," trains your eye to auto-correct under exam pressure. Pass two — disambiguate the look-alikes: for each close pair, write a one-line discriminator. " These four discriminators, plus the umbrella table above, cover the overwhelming majority of naming and similar-name traps SC-900 throws.
The candidates who miss these questions are almost always the ones who memorized features from outdated material without ever reconciling the names; doing the reconciliation deliberately is what turns a trap into a free point.
Which row correctly pairs a former Microsoft product name with its current name?
Which pair is most likely to be confused because the names are similar but the workloads differ?
Older training material refers to 'Microsoft 365 Defender' as the unified detection and response solution. What current name should you map this to?