SC-500T00: Implement End‑to‑end Security Controls for Cloud and AI Workloads

Module 1: Manage and implement authentication methods in Microsoft Entra ID

Learn to plan, deploy, and manage secure authentication in Microsoft Entra ID. This module covers authentication methods, MFA with Conditional Access, passwordless options, and self-service password reset.

Module 2: Implement and configure Privileged Identity Management (PIM)

Implement Just-in-Time privileged access using Privileged Identity Management (PIM) to reduce standing privilege across Microsoft Entra roles, Azure resources, and group-based access for cloud and AI environments.

Module 3: Authenticate your API plugin for declarative agents with secured APIs

When building apps for work, you typically integrate with secured APIs. Learn about the two common ways of how APIs are secured – API key and OAuth2, and how to integrate with them when building an API plugin for declarative agents that run in Microsoft 365 Copilot.

Module 4: Configure and secure Azure Key Vault

Configure a security-hardened Azure Key Vault for enterprise workloads. Apply soft delete and purge protection, enforce least-privilege RBAC access with just-in-time activation, and secure the network perimeter using firewall rules and private endpoints.

Module 5: Manage keys and secrets in Azure Key Vault

Manage the security lifecycle of cryptographic keys and secrets in Azure Key Vault. Configure HSM-backed keys, implement Bring Your Own Key (BYOK) for regulatory scenarios, set up automated key rotation, and build zero-downtime secret rotation using dual-credential patterns.

Module 6: Manage certificates and monitor Azure Key Vault

Manage certificate lifecycle in Azure Key Vault through integrated certificate authority issuance and autorenewal. Enable diagnostic logging to create an investigation-ready audit trail, configure log-based alert rules, and integrate Event Grid for real-time lifecycle automation.

Module 7: Protect Azure Key Vault with Microsoft Defender for Cloud

Protect Azure Key Vault with Microsoft Defender for Cloud. Use Defender CSPM agentless secret scanning to discover exposed credentials across virtual machines (VMs) and cloud deployments, enable Microsoft Defender for Key Vault to detect malicious access patterns, and respond effectively to Key Vault security alerts.

Module 8: Enforce governance with Azure Policy and resource locks

Enforce security standards before resources reach production using Azure Policy. Assign built-in policy definitions and initiatives at management group scope, author custom definitions with automated remediation tasks, and protect critical resources from deletion using Azure resource locks.

Module 9: Configure security controls and remediate recommendations in Defender for Cloud

Configure Defender for Cloud security standards at management group scope and systematically deploy security controls to remediate recommendations. Manage custom security standards, assign recommendation ownership using governance rules, and remediate at scale using Fix, Azure Policy remediation tasks, and structured exemptions.

Module 10: Evaluate regulatory compliance in Defender for Cloud

In this module, you use Microsoft Defender for Cloud to assess your organization’s compliance posture against security frameworks. You explore the regulatory compliance dashboard, investigate control gaps, assign regulatory standards, and generate audit-ready reports that communicate compliance status to stakeholders.

Module 11: Manage and right-size RBAC role assignments for least privilege

Implement least-privilege access governance across Azure and Microsoft Entra ID. Assign built-in roles at appropriate scope, create custom roles for Azure resources and Microsoft Entra directory operations. Then identify and remediate overprivileged access using Microsoft Entra access reviews and Defender for Cloud Security Posture Management (CSPM) identity insights.

Module 12: Describe Azure storage services

This module introduces you to storage in Azure, including things such as different types of storage and how a distributed infrastructure can make your data more resilient.

Module 13: Implement security and manage access for Azure Storage

Implement account-level security controls and access governance for Azure Storage. Configure secure transfer settings, choose appropriate authorization models, apply stored access policies for SAS lifecycle management, and enforce Shared Key disable using Azure Policy to protect storage accounts used by AI agents and enterprise workloads.

Module 14: Configure network security for Azure Storage

Configure network-layer access controls for Azure Storage accounts. Apply firewall rules, define virtual network and IP-based access, configure resource instance rules for Azure AI services, manage trusted service exceptions, and implement private endpoints to eliminate public endpoint exposure.

Module 15: Implement Microsoft Defender for Storage

Enable and configure Microsoft Defender for Storage to detect threats against Azure Blob Storage, Azure Files, and Azure Data Lake Storage. Configure activity monitoring, malware scanning with cost controls, sensitive data threat detection, and alert routing to ensure Defender outputs reach the appropriate security team.

Module 16: Configure platform-level security for Azure SQL

Configure authentication, network isolation, encryption, and access controls for Azure SQL Database and SQL Managed Instance. Implement Microsoft Entra ID–only authentication with managed identity access for AI workloads, deploy private endpoints, and apply transparent data encryption, dynamic data masking, and row-level security to protect sensitive financial data.

Module 17: Configure auditing for Azure SQL Database and SQL Managed Instance

Configure audit logging for Azure SQL Database and SQL Managed Instance to create tamper-resistant compliance records. Set audit action groups, route logs to Azure Monitor, Event Hubs, and immutable blob storage, and configure SQL Managed Instance–specific auditing to meet financial regulatory audit requirements.

Module 18: Implement Microsoft Defender for Databases

Enable Microsoft Defender for Databases to detect SQL injection, anomalous query patterns, and vulnerability exposures across Azure SQL services. Enable protection at subscription scope using Azure Policy, configure vulnerability assessment baselines, and route security alerts to the security operations team.