This architecture shows how security operations center (SOC) teams can incorporate Microsoft Entra identity and access capabilities into an overall integrated and layered zero-trust security strategy.
Network security dominated SOC operations when all services and devices were contained on managed networks in organizations. However, Gartner predicts that through 2022, the market size of cloud services will grow at a rate nearly three times that of overall IT services. As more companies embrace cloud computing, there's a shift toward treating user identity as the primary security boundary.
https://learn.microsoft.com/en-us/azure/architecture/example-scenario/aadsec/azure-ad-security