SC-500 & AZ-500 Hands-On Certification Course with Sims

Engage with hands-on simulations in the AZ-500 course by opening the links in a new tab, then perform each action and submit results; assignments do not affect certificate access.

Set up your Microsoft 365 and Azure lab with a free Office 365 E5 trial and activate Microsoft 365 E5, including optional Teams trial, noting location limitations.

Learn how to set up a free Azure account with $200 credit and 12 months of free services, including steps to sign up, associate a credit card, and access portal.azure.com.

Sign up at portal.azure.com to receive $200 Azure credit for 30 days and access services for a year; a credit card is required, switch to pay-as-you-go after 30 days.

Create and manage user identities across Azure, Admin and Entra portals, defining user principal name, display name, password, licenses, groups, roles, and administrative units in Entra ID.

Explore privileged identity management (PIM) and how it enables just-in-time, time-bound access with approvals, MFA, and access reviews across Azure AD (Intra ID), Microsoft 365, and Intune, upholding least privilege.

Learn to implement and configure privileged identity management in Microsoft Entra, granting temporary access via just-in-time role activation, MFA verification, and role assignments under Entra roles.

Explore how conditional access uses signals from identities, devices, apps, and data to enforce zero-trust policies, block or allow access, and apply real-time risk-based controls.

Learn to create and tailor conditional access policies across portal.azure.com, Intra ID, and Intune, targeting users or groups, resources, conditions like user risk and sign-in risk, and grant or block.

Explore how Azure built-in role-based access control governs access for users, groups, and service principals through role definitions, assignments, and privileged identity management in Azure intra-id and Microsoft 365 services.

Explore multifactor authentication concepts, emphasizing two or more different factors and how risk-based adaptive MFA and conditional access protect identities in IntraID, Azure, and Microsoft 365.

Enable multi-factor authentication across Microsoft Intra, Azure, and Microsoft 365 by configuring security defaults, conditional access, and MFA methods such as FIDO2 and SSPR.

Explore how app registrations in Microsoft IntraID (Azure AD) enable internet-facing web apps to authenticate and authorize users via IntraID, Azure, or personal Microsoft accounts.

Register an app in Azure AD by opening portal.azure.com, selecting app registrations, entering a display name, choosing accounts in the organizational directory only, adding a redirect URI, and clicking register.

Learn to configure API permissions in app registrations on portal.azure.com, grant azure storage access via user impersonation, and apply admin consent to enable access.

Navigate to portal.azure.com, choose app registrations, click new registration, and configure the user facing display name, accounts in organizational directory only, and a redirect URI.

Create a security group for box app users, assign it to the enterprise app, set an owner and roles, and use access reviews to verify access.

Learn how consent settings control enterprise app access in the Azure portal, with user and admin consent, verified publishers, and permission classifications from low to high impact.

Explore choosing the right identity for Azure workloads, from managed identities and service principals to on-premises and hybrid scenarios, emphasizing security, automation, and least-privilege permissions.

Create a managed identity in the Azure portal, set up a resource group and region, name the identity, and prepare a VM to interact with a SQL database.

Create an Azure virtual machine and attach a user-assigned managed identity to enable cross-resource access, illustrating system vs user-assigned identities and how access is controlled.

Set up an Azure SQL database and server, assign a user assigned managed identity as a SQL server contributor to grant access, and clean up the resource group.

Discover how to redo simulations after completing an assignment by following these steps: go to summary, back to assignment, open instructions, and click the simulation link.

Create and configure an Azure Key Vault in portal.azure.com to securely store secrets, keys, and certificates. Centralize management with monitoring and integration for Azure disk encryption, tde, and app services.

Explore hardware security modules in Azure Key Vault premium, covering FIPS 140-2, single-tenant HSMs, centralized key management, private endpoints, monitoring, auditing, and data residency.

Configure access to a key vault using either vault access policy or Azure RBAC. Grant specific permissions for keys, secrets, and certificates via access policies or IAM roles.

Explore how to manage keys, secrets, and certificates in Azure Key Vault, including key generation, HSM options, exportable keys, and configuring customer managed keys for storage encryption.

Configure a key rotation policy in Azure Key Vault to automatically renew keys, set rotation days, enable notifications before expiry, and manage key lifecycles while preserving old keys briefly.

Back up keys, secrets, and certificates in an Azure Key Vault by downloading backups from the portal, and use Microsoft’s CLI or PowerShell scripts to automate restores.

Configure a custom security policy to enforce the Microsoft IaaS anti-malware extension on a Windows Server VM, analyze compliance, deploy remediation, and verify the extension is installed.

Create a policy initiative in azure policy by grouping policies, optionally adding groups and parameters, then review, create, and assign it to monitor compliance across resources.

Explore Azure policy concepts by applying a Microsoft defined security initiative for auditing, selecting definitions, and assigning it to a VM in the demo org, generating a non-compliance report.

Explore how Azure resource groups organize and manage resources across subscriptions and regions, apply rbac permissions, and analyze costs at the resource group level, while understanding lifecycle and deletion implications.

Create a storage account in Azure, apply a delete lock and explain read-only versus delete locks, then verify the lock prevents deletion, remove the lock, and delete the storage account.

Learn how Azure RBAC and intra ID roles control access and permissions across Azure, Microsoft 365, and intra ID, following the least privilege principle and scope hierarchy.

Manage Azure resource permissions by creating custom roles in a resource group, using the IAM blade, and understand the control plane versus data plane for VM access.

Create a storage account in the Azure portal with a unique name in east us, using general purpose standard and locally redundant storage. Review hot, cool, and archive tiers.

Create and configure an Azure storage account, choosing name, region, performance, redundancy, and access settings, then enable data protection, encryption options, and network controls for secure, scalable storage.

Learn how to manage Azure storage keys for web access to blob storage, including primary and secondary keys, rotation and regenerating keys, and connection strings for web apps.

Learn how shared access signatures (sas tokens) grant time-limited, permission-specific access to Azure storage resources via signed URLs and keys; configure containers, anonymous access, and blob access tiers.

Enable Defender for Storage in Defender for Cloud, upgrading from the classic plan to a per-storage-account model with upload malware scanning, sensitive data threat detection, and enhanced log analysis.

Demonstrate testing Defender for cloud by uploading a malware file to a storage blob container in an Azure storage account and reviewing malware scans and security alerts.

Explore the core concepts of relational databases—tables, rows, columns, entities, and relationships—and how SQL, DDL, and DML define and manipulate data for efficient queries.

Configure a platform-level Azure SQL Database by creating a resource group, a server, and a basic two-gigabyte database with public access, firewall rules, and the AdventureWorks sample.

Download SQL Server Management Studio (SSMS) and install the latest version. Open SSMS from the Windows Start menu to connect to a SQL server, using the default installer options.

Set up an Azure SQL database and server in the portal, configure a resource group and server name, choose SQL authentication, and connect with SQL Server Management Studio.

Discover how dynamic data masking on Azure SQL databases hides email addresses from non-privileged users by enabling masking in the portal and selecting the email mask.

Explore azure sql database encryption at rest with bitlocker and tls in transit, and learn to implement customer managed keys using key vault or managed hsm for tde.

Explore Azure virtual networks, address spaces, subnets, VNICs, dhcp, and NSGs, then hub-and-spoke peering, Azure Firewall, UDRs, VPN gateways, and ExpressRoute for on-premise connectivity.

Set up a Windows Server 2022 virtual machine in Azure, creating a resource group and vnet, configuring auto shutoff and connecting via RDP for hands-on use.

Plan and implement virtual networks in Azure by creating VNets and subnets, configuring address space, and applying security features like encryption, Azure Bastion, DDoS protection, NAT gateway, and NSGs.

Learn how vnets require peering to communicate across networks; set up a hub-and-spoke model with vnet1 as the hub and vnet2, vnet3, and vnet4 as spokes, enabling bidirectional traffic.

Create a route table and a firewall subnet, add a route to 10.1.10.0/24 with a virtual appliance as next hop, and link it to all subnets to override system routing.

Learn how network security groups and application security groups perform IP filtering in Azure, applying inbound and outbound rules to subnets or NICs with clear rule priorities.

Learn how Azure WAN unifies multiple locations through hubs, enabling traffic between sites and connected VNets via VPN routers or ExpressRoute, all within the Azure network.

Azure virtual WAN offers basic and standard SKUs. Basic supports only site-to-site VPN; standard adds express route, user VPN, inner hub and vnet-to-vnet transitions, and firewall and network appliance support.

Design an Azure virtual WAN architecture that connects headquarters, branch offices, and remote users via ExpressRoute, site-to-site VPNs, and point-to-site VPNs, with standard tier hubs enabling cross-region traffic.

Learn how Azure private link service enables cross-tenant private access from Company A's VNet to Company B's load balancer, avoiding public IPs for compliant access to resources.

Create and configure Azure firewall, select standard or premium, and manage firewall policies with rule collections including net, dnet, and application rules for inbound and outbound traffic.

Create and configure an Azure route table to direct internal traffic through the Azure firewall, associating subnets across multiple VNets and setting a next hop as the virtual appliance.

Learn how overexposure of data in SharePoint occurs when sharing and permissions allow broad access, potentially enabling AI Copilot and ChatGPT to access sensitive files, and how to control access.

Explore how Purview data security posture management (DSPM) enhances data protection in Microsoft 365 by enabling data discovery, risk assessments, encryption, compliance, and policy enforcement for AI apps.

Explore how Microsoft 365 Copilot acts as your AI assistant, accessing your emails, files, chats, and calendar via Graph, while data is not used to train the underlying model.

Explore use cases for AI researcher, analyst, and custom Copilot agents, highlighting find and explain, interpret, calculate, and recommend capabilities, plus automations that read policy documents and analyze Excel data.

Create and configure a Copilot Studio agent, upload the employee handbook as knowledge, and test it to summarize and describe the handbook for new employees.

Create conditional access policies in portal.azure.com to block all Intra ID agents, targeting all agent identities or all agent users with report-only mode.

learn to securely access azure virtual machines using azure bastion, avoiding exposure of port 3389 by connecting over https through the azure portal, with cost considerations.

Install Microsoft Anti-Malware on a virtual machine and monitor it with Microsoft Defender for cloud, enabling real-time protection and scheduled or quick scans.

Extend Azure security controls to hybrid and multicloud servers using Azure Arc, enabling centralized policies, Defender for Cloud, monitoring, and governance across on-premises, AWS, GCP, and edge.

Protects Windows and Linux servers with Defender for Servers, integrated through Defender for Cloud. Leverage real-time threat detection, vulnerability management, and continuous security monitoring across hybrid multi-cloud environments.

Create a Windows server in Azure by provisioning a virtual machine in a resource group in East US, using Windows Server 2025, 2 vCPU, 8 GB RAM, and enabling RDP.

Verify that a provisioned Azure VM is onboarded to Defender for Cloud and Defender for Servers by checking the inventory, server resources, and security recommendations in the portal.

Explore how data is encrypted at rest with Microsoft managed keys and how to use a Key Vault for customer managed keys in Azure Container Instances.