Azure Security: AZ-500

Learn to manage identities, authentication, authorization, and application access using Microsoft Intra ID (formerly Azure AD) in module one, reinforced by a recommended hands-on lab.

Entra ID, formerly Azure Active Directory, is a multi-tenant cloud directory and identity service that enables single sign-on for Microsoft 365, Salesforce, and other apps, with users, groups, and devices.

Demo of Entra ID in the Azure portal, covering users, groups, devices, and licenses, with note that Azure Active Directory is now Microsoft Entra ID and basic tenancy concepts.

Distinguish internal employee users from external guests in Entra ID, where external accounts use federation authentication. Invite external users by email and assign them to groups or roles.

Create a new Entra ID user named Jake Roberts with a custom password, set usage location, and assign roles such as user administrator, then review audit and sign-in logs.

Learn how to invite external users as guests in Entra ID, send email invitations, set usage location and group roles, and complete activation via the invitation workflow.

Demonstrate activating Entra ID Premium 2 (P2) via the try/buy path, featuring a 30-day trial, required billing setup, and conversion from trial to paid license.

Learn about Entra ID groups, including Microsoft 365 groups and security groups, and use direct, nesting, and dynamic membership plus validation tool to manage access in Azure, noting 24-hour propagation.

Configure Entra ID group expiration to auto-delete inactive groups after a configurable inactivity period, with owner notifications and a 30-day soft-delete restoration window before hard deletion.

Create a security group named sales-users in Entra ID, using dynamic user membership with department equals sales; validate the rule to confirm Roy's membership.

Discover how Entra ID manages Microsoft 365 group expiration by configuring group lifetimes, enabling 30/15/1 day renewal notifications, and requiring exchange license for email alerts with an owner or helpdesk.

Enable self-service password reset (sspr) to let users verify identity via email, sms, or authenticator app, reducing helpdesk calls and boosting productivity through quick resets.

Explore self-service password reset in azure ad, configuring authentication methods (email, sms, mobile app), security questions, user group scope, and admin notifications to secure resets.

Explore Azure role based access control and intra role based access control, learn how to assign roles to users or groups, and set scopes from management groups to subscriptions.

Explore Entra ID roles and how administrator and global administrator manage authentication across Azure and Microsoft 365, noting two distinct role sets: Entra ID identities and resource roles.

Organize Azure subscriptions with management groups to centralize access policies and compliance through a hierarchical container. Inheritance lets roles and policies apply from root to all subscriptions and resources.

Explore Azure roles and access control by creating a virtual machine in a resource group, then assign roles like virtual machine contributor at resource, group, subscription, and management group levels.

Explore how custom roles in Azure RBAC enable granular permissions by assembling specific rights. The UI shows P1/P2 licensing blocks, grayed-out options, and a 30-day trial.

Create a custom azure rbac role from scratch, selecting permissions like manage user licenses and update basic user properties, then assign the role to users or groups.

Explore privileged identity management (PIM) in Azure, enabling just-in-time activation of roles like user administrator with optional MFA, approvals, and access reviews to control privileged access.

Explore a PIM scenario where Bob Ross creates and manages entry users, enforcing multi-factor authentication via text message or authenticator app for all actions.

Learn how to configure privileged identity management (PIM) in Azure AD, assign eligible and active roles, and require multi-factor authentication for activation.

Apply the zero trust model that never assumes trust and continually verify users and devices. Limit access based on authentication and device signals, possibly enforcing multi-factor authentication.

Microsoft Entra identity protection automates detection and remediation of user risk and sign-in risk, provides detections reports, and supports MFA registration policies.

Identify the five identity protection roles and summarize their permissions, from security administrator’s full access (excluding password resets) to operator and reader duties, to global reader and global administrator capabilities.

Explore identity protection in Azure AD, focusing on user risk, sign-in risk, and MFA registration policies. Learn how policy enforcement, risk levels, and reporting guide access controls and security responses.

Security defaults protect against identity attacks by default, require MFA for all users and admins, block legacy authentication, and safeguard privileged access.

Open manage properties to view security defaults, enabled by default and enforcing MFA for all users; consider conditional access (P1/P2) for complex needs.

Leverage conditional access to evaluate real-time sign-in risk using user, location, and device signals, then block, grant, or require MFA for cloud apps.

Learn to configure Azure conditional access by adding enterprise apps like ADP, defining trusted locations such as headquarters, and applying policies with risk and multi-factor authentication.

Protect sensitive data in Azure by safeguarding keys, secrets, and certificates with Azure Key Vault, a central repository that enables on-demand decryption of sensitive fields for applications.

Explore how to set up an Azure Key Vault: assign a vault owner, select a resource group and region, grant access to keys, secrets, and certificates, and monitor audit logs.

Discover how Azure Key Vault centralizes secrets, keys, and certificates for app authentication and data encryption. Understand hardware security modules, FIPS 142 and 140-3, and BYOC for trusted key management.

Azure key vault isolation means the vault is dedicated to one region and cannot be moved to another region; data stays in hardware security modules specific to that region.

Learn how to manage Azure Key Vault administration, assign security team roles, and enforce access policies for developers, operators, and auditors, including key and secret management, backups, and compliance considerations.

Demonstrates deploying an Azure key vault, enabling purge protection, configuring access with RBAC or vault access policies, and linking keys to disk encryption sets with private endpoints.

Learn how multi-factor authentication strengthens Azure security by requiring two of three factors, something you know, something you possess, or something you are, via cloud-based Azure MFA and Office 365.

This lecture demonstrates Azure AD MFA configuration, including five denials triggering a 180-minute lockout, fraud alerts, and user blocking, with passwordless options like authenticator apps and FIDO2 keys.

Enable and enforce multi-factor authentication for a user in Azure, walk through enrollment with the authenticator app and email, and note security defaults may require MFA for privileged roles.

Register your application with Azure Active Directory to outsource authentication and manage access, supporting five primary scenarios.

See how an API acts like a waiter, a messenger between the user and the backend, delivering requests from a web portal to the application and back.

Register applications to manage authentication with Azure Active Directory; a single-page web app authenticates, returns a token, and the API validates the token via Azure Active Directory.

The lecture guides you through creating a new app registration in Azure Active Directory, selecting account types, defining redirect and branding, and configuring permissions, tokens, and ownership.

Enforce organizational standards with Azure policy and monitor compliance via the dashboard, tracking compliant and non-compliant resources while enabling encrypted drives, threat detection, and location constraints.

Demonstrates creating an Azure policy to restrict resources to East US within a resource group, using allowed locations, applying and validating policy assignments, and exploring compliance and remediation options.

Azure blueprints define repeatable resources to deploy, enforcing organizational standards for applications, virtual machines, networking. They bundle resource groups, policies, role assignments, and template deployments for a big-picture, integrated setup.

Explore how to create and publish an Azure blueprint, define artifacts like virtual machine administrator login and virtual machine contributor roles, and automatically apply them to VMs and resource groups.

Lock resources in Azure to prevent accidental deletion or modification by applying delete or read-only locks, inherited from parent scopes like subscription or resource group to all contained resources.

Apply a delete lock on a resource group to prevent deletion; learn how locks can be read only or delete, and how they inherit to resources within the group.

Explore the pitfalls of applying Azure locks, including read-only locks on storage accounts, app services, resource groups, and subscriptions, and delete locks that can disrupt keys, backups, and ongoing operations.