Your cart is empty.
Keep shopping
Teach on Udemy
Turn what you know into an opportunity and reach millions around the world.
Learn MoreAZ-500 Microsoft Azure Security Exam Certification
Rating: 4.5 out of 54.5(10,028 ratings)
66,041 students
AZ-500 Microsoft Azure Security Exam Certification
Passing this exam earns you : Microsoft Certified: Azure Security Engineer Associate certification.
Created byAlan Rodrigues
Last updated 7/2026
English
Arabic [Auto],German [Auto],
What you'll learn
- This course is designed to provide you with a comprehensive understanding of securing Microsoft Azure environments.
- Utilizing Security services can enhance organizations' security posture and reduce the risk of security breaches in the digital age.
- Azure security core services and implement security controls and threat protection.
- To protect data, applications, and networks in a cloud technology environment
- This course is designed for professionals who want to demonstrate their skills in securing Microsoft Azure environments.
- Upon completion of this course, you'll not only be well-prepared for the AZ-500 exam, but you’ll also have the expertise to manage security in Azure environment
Course content
8 sections • 339 lectures • 26h 36m total length
- PowerPoint Slides download0:13
- Azure Foundations for Cloud Security3:55
Explore Azure cloud computing, its broad services from computing to AI, and learn to set up a free account for hands-on practice aligned with security-focused exam objectives.
- Creating the Azure Free Account4:48
Register an Azure free account using Gmail or GitHub to access $200 free credit for new customers for 30 days, with phone verification and multi-factor authentication.
- About Microsoft Entra ID2:59
Explore Microsoft Entra ID as the centralized identity and access management solution, create users and groups, and manage Azure roles with built-in and Entra roles.
- Quick tour of Microsoft Entra ID4:03
Explore the Microsoft Entra ID interface, navigate the Azure portal, and learn about default directory, tenant ID, licenses, and basic management of users, groups, and applications.
- Creating a User in Microsoft Entra ID4:04
- Introduction to Azure Virtual Machines4:59
Learn how Azure virtual machines deliver on-demand compute to host applications, with configurable Windows or Linux OS, CPU, RAM, storage, region, and networking, billed pay-as-you-go.
- Lab - Deploying an Azure Virtual machine12:38
- What is Azure Role-Based Access Control3:21
Explore Azure RBAC as an authorization system for managing access to Azure resources, using built-in and custom roles and scope-based role assignments.
- Lab - RBAC - Resource level assignment7:14
Learn how to assign Azure RBAC roles at the resource level for labuser01, including reader and virtual machine contributor roles, through a step-by-step role assignment, scope, and least-privilege guidance.
- Lab - RBAC - Resource-Group-Level Assignment7:00
Apply role-based access control at the resource group level by granting lab user 01 the reader role to all resources, illustrating scope inheritance and post-lab cleanup.
- Lab - RBAC - Assigning the Contributor Role3:40
A hands-on lab demonstrates using RBAC to assign the virtual machine contributor role alongside reader at the resource group level, enabling management actions like stopping a VM.
- Lab - RBAC - User Access Administrator Role5:21
Explore how the user access administrator role enables you to manage role assignments at a scope, without granting resource permissions, and delegate Azure RBAC control across resource groups.
- Creating a Custom Azure RBAC Role5:21
Define and assign a custom Azure RBAC role at the resource group level by cloning and editing permissions to allow select VM actions like start and restart.
- Creating a Security Group in Microsoft Entra ID6:23
Create and manage security groups in microsoft entra id to centrally assign azure resource permissions and microsoft entra roles, enabling scalable access control and lifecycle management.
- About renewing the temporary access pass0:44
- Introduction to Microsoft Entra ID Roles2:31
Explore Microsoft Entra ID roles and how RBAC grants permission to create users, groups, and applications at the directory level, alongside managing Azure resources.
- Assigning a Microsoft Entra Role to a User6:02
Demonstrate how lab user 01 is granted a Microsoft Entra ID user admin role to manage users and groups at the directory level, illustrating Entra ID roles versus resource rbac.
- Deleting resources3:19
- Introduction to Microsoft Entra Authentication Methods4:41
Explore Microsoft Entra authentication methods, including primary authentication with username and password or a temporary access pass, plus multifactor authentication and self-service password reset.
- Using the Microsoft Authenticator App9:32
Enable multi-factor authentication with the Microsoft Authenticator app in Microsoft Entra ID. Register the app and use a second factor like a one-time code.
- Moving Beyond Passwords with Microsoft Entra Passwordless Authentication2:27
Explore passwordless authentication with Microsoft Entra, using key-based credentials stored on devices or security keys, unlocked by a pin or biometrics, including Windows Hello for Business and passkeys.
- A look at Microsoft Entra Passwordless Authentication5:10
Explore passwordless authentication with Microsoft Entra ID, compare it to multifactor authentication, and learn to register a device, set a passcode, and approve sign in requests via the authenticator app.
- Understanding Microsoft Cloud Licences5:29
Understand Microsoft Entra ID licenses, especially P2, including pricing, subscription, and how the Microsoft 365 admin center manages licenses and user access for Entra security features.
- Accessing Microsoft 365 Admin Center11:21
Subscribe to Microsoft Entra ID P2 trial licenses via the Microsoft 365 admin center, create a user, set up billing, and assign licenses for conditional access and privileged identity management.
- Summary - Microsoft Entra ID14:34
- Privileged Identity Management6:36
Learn how privileged identity management enables just-in-time, temporary access to Microsoft Entra and Azure resource roles through eligibility, activation, MFA, and approvals, with audit and governance.
- Lab - Privileged Identity Management - Microsoft Entra roles - Assignment7:32
Explore privileged identity management in Microsoft Entra by granting and activating Microsoft Entra roles, using eligible vs active assignments, and provisioning a user administrator role with time-bound eligibility.
- Lab - Privileged Identity Management - Microsoft Entra roles - Activation3:53
Demonstrates privileged identity management enabling eligible assignments to Microsoft Entra roles. Shows activation of a user admin role for a limited duration with justification.
- Lab - Privileged Identity Management - Role settings2:40
Navigate Microsoft Entra Privilege Identity Management to configure role settings for the user administrator role, adjusting activation duration, MFA, justification, approvals, assignments, and notifications for roles, groups, and resources.
- Lab - Privileged Identity Management - RBAC4:24
Learn how privileged identity management extends to Azure resources, managing RBAC roles, activating roles, and handling eligible and active assignments at the subscription or resource group level.
- Microsoft Entra Conditional Access4:09
- Lab - Microsoft Entra Conditional Access9:29
- Lab - Conditional Access Policy - Locations5:19
Create a named ip address location, mark it as trusted, and apply a conditional access policy that grants access from trusted locations while requiring multifactor authentication, then review sign-in logs.
- Summary - PIM and Conditional Access6:49
Explore how Microsoft Entra Privileged Identity Management reduces standing privileges by enforcing time-based activation, multifactor authentication, approvals, and conditional access for admin roles.
- Introduction to Azure Key Vault2:42
Explore the Azure Key Vault service, a managed solution for storing secrets, encryption keys, certificates, and other sensitive data; learn how apps securely fetch passwords, API keys, and connection strings.
- Lab - Deploy an Azure Key Vault3:30
Deploy an Azure key vault from the marketplace, select standard pricing, enable soft delete and purge protection, store secrets, keys, and certificates, and configure role-based access control with public access.
- Lab - Creating a secret in the key vault5:32
Explore creating secrets, encryption keys, and certificates in Azure Key Vault, and apply RBAC to separate control plane from data plane access, enabling apps to securely fetch secrets.
- Retrieve a Secret from Azure Key Vault with Python2:04
- Lab – Retrieve a Secret from Azure Key Vault with Python10:26
Build a simple Python program using Azure Identity and the Azure Key Vault Secrets library to fetch the dbpassword secret from a Key Vault via the Azure CLI as labuser01.
- Quick look at creating encryption keys2:59
- Configure Azure Key Vault Firewall and Network Access1:24
- Lab - Configure Azure Key Vault Firewall - IP address3:32
Configure azure key vault firewall to restrict access, enabling public access only from specific virtual networks and IP addresses, add your client IP to authorize secure calls and fetch secrets.
- Move the Key Vault Application to an Azure Virtual Machine7:41
Move the key vault application to an azure virtual machine, configure a virtual network, install python and azure identity and key vault secrets, then log in with a device code.
- Understanding Virtual Network Service Endpoints4:14
Enable a virtual network service endpoint for the subnet so the Python program on the virtual machine can securely access the Key Vault's secret.
- Why Applications Need an Identity in Microsoft Entra ID3:17
Register an application in Microsoft Entra ID to give a Python program its own identity, enabling RBAC access to Azure resources like Key Vault and virtual machines.
- Lab - Authenticate an Application to Key Vault7:14
Register a new application in Microsoft Entra ID, and configure a Python program to authenticate to Azure with a client secret credential, then access a key vault secret.
- Managed Identities for Azure Resources2:23
Learn how Azure managed identities create a resource identity for Azure resources to access Key Vault without az login or client secrets, with Microsoft Entra managing credentials and tokens.
- Lab - Managed Identities for Azure Resources3:41
Enable a system assigned managed identity on the virtual machine and grant it role-based access control to access key vault secrets, letting the program use the vm identity.
- Introduction to Microsoft Graph API1:50
Explore Microsoft Graph API as a gateway to data across Microsoft cloud services via REST APIs and SDKs. Learn about application and delegated permissions with a Python-based Graph API example.
- How a Microsoft Graph request works2:09
Explore the key components of a Microsoft Graph request, including the http method, endpoint, api version, resources, access tokens, and delegated and application permissions.
- Delegated and application permissions4:33
Learn how delegated and application permissions govern access to Microsoft Entra ID via Microsoft Graph, contrasting signed-in-user tokens with app-only tokens for background services.
- Lab - Call Microsoft Graph from Python - Application permissions10:16
Learn to call the Microsoft Graph API from Python using GraphServiceClient and application permissions, configure an Entra ID app, grant admin consent for User.Read.All, and read all users.
- Lab - Call Microsoft Graph from Python - Delegated permissions7:38
Learn how to call Microsoft Graph from Python using delegated permissions to sign in a user via device code flow and fetch the signed-in user's profile, contrasting with application permissions.
- Summary - Key vault and identities9:57
Explore how Azure Key Vault protects secrets, keys, and certificates; manage access with Microsoft Entra ID and role-based access control; leverage application and managed identities with Graph API permissions.
- Protecting Azure Resources with Resource Locks3:58
- Enforcing Security Standards with Azure Policy3:10
- Understanding Azure Management Groups2:42
- Lab - Block public IP address creation with Azure Policy7:52
Assign the built-in not allowed resource types policy to block public IP address creation under microsoft.network, and view compliance in the policy dashboard as you prevent non-compliant deployments.
- Remediate Existing Azure Resources with Azure Policy4:54
demonstrates how to create an Azure policy with a remediation task to enforce a default environment tag on resources, using a managed identity, assignment scope, and remediation verification.
- Summary - Locks, policy, management groups7:02
Enforce protection with Azure resource locks at subscription, resource group, or resource level, and govern resources using policy, management groups, and policy effects such as audit, deny, modify, and deployIfNotExists.
- Introduction to Azure Storage Accounts6:31
Explore Azure storage accounts and their blob, file, queue, and table services, learning how general-purpose v2 accounts store unstructured data, host file shares, manage messaging, and enable NoSQL data.
- Lab - Building an Azure storage account2:49
Create an Azure storage account in the portal, selecting a resource group, West US 2 region, and general-purpose v2 with locally redundant storage, then review and create.
- Lab - Blob service - Uploading objects to the service4:31
Learn to upload and manage binary objects in Azure blob storage by creating containers, uploading documents or code, and using versions, snapshots, access tier, and unique URLs.
- Access Azure Storage Data with Azure Storage Explorer1:56
- Lab - Access Azure storage using Storage account access key5:22
Connect to an Azure storage account with Azure Storage Explorer using a storage account access key (key1 or key2) and rotate keys to maintain access to blob containers.
- Lab - Access Azure storage using Shared Access Signature6:21
Explore secure, time-bound access to Azure storage using shared access signatures, with granular permissions for blob, container, and object levels and start and expiry times.
- Lab - Role-Based Access Control for Azure Blob Storage7:07
Apply role-based access control for Azure blob storage by assigning storage blob data reader and blob data contributor roles at the storage account scope, then verify access in Storage Explorer.
- Lab - Accessing Azure Blob Storage on an Azure virtual machine5:14
Explore accessing Azure blob storage from an Azure virtual machine using the Azure CLI to list blobs with account key and login authentication, including undelete of deleted blobs.
- Lab - Accessing Azure Blob Storage on an Azure virtual machine - Managed Identit3:21
Learn to use a system-assigned managed identity on an Azure VM to access blob storage, by granting the Storage Blob Data Reader role and authenticating with az login --identity.
- Lab - Configure Azure Storage Firewalls - Service Endpoints5:14
Explore how to configure Azure Storage firewalls and networking, including public access controls, private endpoints, virtual network service endpoints, and IP-based restrictions to secure storage accounts.
- Secure Azure Storage with Private Endpoints1:42
- Manage Shared Access with Stored Access Policies5:13
Learn how stored access policies add a revocable permission layer to shared access signatures at the container level, enabling revocation by editing policy permissions without regenerating account keys.
- Introduction to Azure SQL Database3:31
Explore the Azure SQL Database service as a fully managed relational database in the cloud, covering logical SQL servers, administrators, and firewall rules, with focus on security for the exam.
- Lab - Setting up an Azure SQL database4:56
Create an Azure SQL database by provisioning a logical server and database in a resource group, selecting region and SQL or Entra authentication, and enabling a public firewall endpoint.
- Lab - Azure SQL - Logging into the database1:54
- Lab - Azure SQL - Adding a new user5:05
Enable Microsoft Entra authentication for an Azure SQL server, create a labuser01 user from external provider, grant data reader role, and verify access.
- Firewall and Network Settings in Azure SQL Database6:01
Learn how Azure SQL Database firewall and public access control connections, including allowing Azure services and adding virtual network service endpoints for secure VM access.
- Connecting Azure SQL Database Through a Virtual Network Service Endpoint2:43
Configure a virtual network service endpoint to access Azure SQL database from a virtual machine, then add the SQL endpoint and a virtual network rule on the server.
- Configure Database Auditing for Azure SQL4:42
Enable Azure SQL Auditing at the server level to record selected database activities and send audit events to a Log Analytics workspace for querying with KQL and auditing insights.
- Summary - Azure Storage and SQL9:42
Navigate azure storage accounts and their blob, file, queue, and table services, covering authorization, key management, SAS tokens, RBAC roles, and Azure SQL database authentication and auditing.
- Important Course Instructions0:40
- PDF and Diagrams download0:04
- Resources and an Identity provider5:31
Understand how an external identity provider, such as Microsoft ID for Azure, handles authentication and authorization, reduces data store burden, and enables multi-factor authentication, single sign-on, and auditing.
- Using Azure as a cloud platform3:20
Azure is a cloud platform that eliminates upfront infrastructure costs by hosting apps in global data centers, to deploy a virtual machine using Microsoft ID as the identity provider.
- Introduction to Azure1:39
Azure is a popular cloud platform offering services from virtual machines to Azure Kubernetes Service, AI, and app service. Explore the products page and create an Azure account to begin.
- The Azure Free Account4:49
- Creating an Azure Free Account5:23
Create an Azure free account by setting up a Microsoft account, completing verification, and selecting pay-as-you-go to access $200 free credit for 30 days.
- Tour around the Azure Portal2:57
- Important basic concepts with Azure3:16
- Microsoft Entra ID - The big picture6:34
This goes through Azure AD
- Lab - Creating a user in Microsoft Entra ID7:35
- Lab - Creating a group in Microsoft Entra ID3:51
- Let's start working with Azure resources3:47
- Lab - Deploying an Azure virtual machine12:02
- So what is Role-based access control4:24
- Lab - Role-based assignments - Resource level7:24
Assign a role at the resource level using access control, selecting a user or group, applying the reader role, and noting the JSON permissions and assignable scopes.
- Lab - Role-based assignments - Resource group level5:15
- Lab - Role-based assignments - Contributor Role7:07
- Lab - Role-based assignments - User Access Administrator Role4:40
- Lab - Having multiple roles assigned to a user3:03
Assign two roles to a user and observe how reader and contributor permissions accumulate to determine access on resources, illustrating that permissions sum rather than favor least restrictive permissions.
- Lab - Creating a custom role3:53
- Deleting our resources1:05
- Microsoft Entra ID Roles1:49
Discover the built-in roles in Microsoft Entra ID and how they manage features within the identity service, distinct from RBAC, with examples to assign roles to users.
- Lab - Microsoft Entra ID Roles4:21
Demonstrate how to assign a user administrator role to user A in the Microsoft Entra admin center in Azure, enabling permissions to manage users and security settings in Entra ID.
- Understanding the entire landscape till now2:55
- What can new users do in Microsoft Entra ID2:18
Learn how default Microsoft Entra ID user settings enable or restrict actions like registering applications and creating security groups, and how to manage guest access and external collaboration.
- Lab - Inviting an external user4:40
- More on Users and Groups2:19
Learn to recover deleted users within 30 days and restore user A, and review group management, including Microsoft 365 groups versus security groups, nesting limits, and licensing restrictions.
- Microsoft Entra ID Licenses4:07
- Microsoft Entra ID Premium Trial License10:04
- Subscribing to Microsoft Business Basic Licenses3:02
- Assigning licenses to users5:35
- Working with Licenses for groups4:45
Learn how to assign licenses at the group level for security groups in Microsoft Entra Admin Center and Microsoft 365 Admin Center, using group A and its members.
- Microsoft 365 Groups0:54
- Dynamic Membership Rules6:58
- Microsoft Entra ID - Application Registration7:52
This goes through Applicatin Registration
- Lab - Application Registration - Entra ID Application Object12:24
Register an Entra ID application object to represent the postman tool, then grant Microsoft Graph application permissions to read all users' profiles and grant admin consent for the default directory.
- Lab - Application Registration - Calling the Graph API10:31
- Microsoft Entra ID - Sign-in and Audit logs1:33
Explore sign-in logs and audit logs in Microsoft Entra ID to monitor user activity, view login details like IP address and location, and learn what's available in the free edition.
- Microsoft Entra ID - Enterprise Applications2:42
Explore enterprise applications with Microsoft Entra ID, register applications, and enable single sign-on to SaaS apps like Dropbox through Android integration.
- Working with Enterprise applications7:57
Learn how to register and manage enterprise applications in Microsoft Entra, assign groups and licenses, and configure single sign-on with SaaS apps like Dropbox Business.
- Enterprise Application - Important Properties1:46
- Enterprise Application - Self-Service9:09
Enable self-service access for an enterprise application by creating a security group for Dropbox users, configuring password-based single sign-on, and implementing an approval workflow to add users automatically.
- Managing applications in Entra ID1:50
- Multi-Factor Authentication2:33
Learn how multi-factor authentication adds a security layer beyond username and password for privileged users in Azure and Microsoft Entra, with examples like the Microsoft Authenticator app.
- Lab - Multi-Factor Authentication6:38
This goes through a Lab on Multi-Factor Authentication
- Lab - Multi-Factor Authentication - Using the Microsoft Authenticator App3:47
Enable multi-factor authentication using the microsoft authenticator app to add a secondary verification step during sign-in, including scanning a qr code, approving a push notification, and entering a one-time code.
- Passwordless authentication8:22
Enable passwordless authentication with Microsoft Entra using Windows Hello for business, the Microsoft Authenticator app, or security keys, and sign in without a password for server admin access.
- Custom banned passwords1:48
- Conditional Access Policies1:39
Explore conditional access policies in Microsoft Entra to enforce multi-factor authentication after initial sign-in, using if-then access rules, while clarifying they are not the first line of defense.
- Lab - Conditional Access Policies12:38
This goes through a Lab on Conditional Access Policies
- Few points on conditional access2:40
- Lab - Conditional Access Policy - Locations3:44
- Lab - Conditional Access Policy - Multiple policies3:17
- What is Microsoft Entra ID Protection3:05
- A look into Microsoft Entra ID Protection3:09
Explore the Microsoft Entra ID protection features in the Entra Admin Center, review the identity protection dashboard, understand risk levels and sign-in risks, and configure user and sign-in policies.
- What are Access Reviews2:30
Explore how access reviews revoke outdated permissions when users change roles or leave. Use the access panel for security groups and applications, and privilege identity management for Azure resources.
- Lab - Setting up the Access Review10:26
- Lab - Access Review - Self Review3:41
- What is Privileged Identity Management2:07
- Privileged Identity Management - Microsoft Entra roles9:46
- Privileged Identity Management - Azure resources8:50
- Privileged Identity Management - Groups3:53
- Privileged Identity Management - Access Review3:40
- Administrative Units4:01
- Lab - Administrative Units6:51
- Having a hybrid setup4:17
This goes through Azure AD Connect
- Setting a custom domain for Microsoft Entra ID5:19
Set up a custom domain in Microsoft Entra ID, verify ownership with a TXT record, and map users under the domain for identity syncing with Entra Connect.
- Setting up Microsoft Active Directory Domain Services7:21
Learn to simulate an on-premises network in Azure by provisioning a Windows Server VM and installing Active Directory Domain Services as a domain controller for a new forest.
- Setting up Microsoft Entra Connect - Infrastructure setup9:24
- Setting up Microsoft Entra Connect - Implementation12:32
Demonstrates joining a Windows Server to an on-premises domain, installing Microsoft Entra Connect, and configuring password hash synchronization to sync on-premises Active Directory users to Microsoft Entra ID.
- Pass through authentication8:11
- Quick note on synchronized users1:50
Learn how on-premises Active Directory domain services sync users to Microsoft Entra ID and enable password write-back to reflect changes from Entra ID back to on-premises AD.
- Application Proxy3:06
- Using Application Proxy - Infrastructure setup5:41
- Using Application Proxy - Implementation11:44
- Section Quiz
- Understanding the Azure virtual network2:03
- Lab - Let's deploy an Azure virtual machine3:39
Deploy an Ubuntu Server VM in Azure, configure a virtual network with a subnet and public IP, install nginx, and explore network security groups, virtual network peering, and VPN connections.
- Lab - Let's host a web server on the machine7:49
- Understanding Network Security Groups7:30
This chapter looks into Network security groups
- Lab - Network Security Groups - Priority setting4:08
- Lab - Network Security Groups - Access to other machines14:23
- Lab - Network Security Groups - Subnets7:13
Attach a single network security group to multiple subnets, detaching NSGs from NICs to simplify management; configure inbound http and ssh rules, with Azure Firewall protecting the entire network.
- Lab - Network Security Groups - Multiple NSG's4:40
- Lab - Application Security Groups - Setup5:44
- Lab - Application Security Groups - Implementation5:16
- Virtual Network Peering1:19
This chapter looks into Virtual network peering
- Lab - Virtual Network Peering12:08
- User Defined Routes2:59
Discover how user defined routes steer traffic within a virtual network through a firewall or virtual appliance, replacing the default system route to strengthen security and control.
- Lab - User Defined Routes - Setup5:38
Create a subnet and central VM to host a firewall appliance. Define a user defined route that directs traffic from app subnet to web subnet via the central VM.
- Lab - User Defined Routes - Implementation10:46
- Point to Site VPN Connection2:23
- Lab - Point-to-Site VPN - Initial Setup9:30
- Lab - Point-to-Site VPN - Setting the gateway3:00
- Lab - Point-to-Site VPN - Certificates for authentication6:47
- Lab - Point-to-Site VPN - Certificates for authentication - Reference0:22
- Lab - Point-to-Site VPN - Establishing the connection2:48
Establish a point-to-site vpn to securely access a private virtual network by downloading and installing a vpn client, verifying the certificate, and connecting to the app gateway.
- Notes on Point to Site VPN Connection0:42
- Site-to-Site VPN Connection1:31
This chapter looks into Site-to-Site VPN connections
- Lab - Site-to-Site VPN - Setup3:36
- Lab - Site-to-Site VPN - Connection13:28
Create a local network gateway to represent the on-premises network and establish an IPsec site-to-site VPN with a shared key between the Azure gateway and company VM, enabling routing.
- Site to Site VPN - Notes0:42
- Network Watcher1:40
- Network Watcher - IP Flow Verify and Next Hop5:15
- Lab - Network Watcher - NSG Flow logs6:11
- Performing a cleanup0:54
- Azure ExpressRoute3:31
Explore how Azure ExpressRoute establishes a private, non-internet connection from on-premises to an Azure virtual network and to Microsoft 365 via a partner edge and ExpressRoute circuit, with redundancy.
- Azure Virtual WAN2:57
- Lab - Virtual WAN - Creation4:30
- Lab - Virtual WAN - Virtual Hub2:04
- Lab - Virtual WAN - Virtual Network connections4:56
- Lab - Virtual WAN - Point-to-Site connections5:12
- Virtual WAN - VPN Sites0:43
- Securing access to PaaS services1:50
Explore how to securely connect your virtual network to public platform as a service resources such as storage accounts, key vaults, and Cosmos DB, enabling private, secure access.
- What are Azure Storage Accounts2:14
- Lab - Working with Azure Storage Accounts8:12
- Service Endpoints2:55
- Lab - Service Endpoints - Setup12:28
- Lab - Service Endpoints - Implementation10:10
Demonstrates implementing Azure service endpoints to securely connect a virtual network subnet to an Azure storage account, after configuring firewall rules and Storage Explorer access.
- Important points with Service Endpoints4:46
- Note on PaaS services Public IP addresses5:13
- Using NSG to only allow access to Azure storage6:25
Explore configuring network security groups to enforce default deny rules and granular outbound access to Azure storage using service tags for North Europe endpoints.
- What is Azure Cosmos DB2:07
- Lab - Working with Azure Cosmos DB5:16
- Lab - Azure Cosmos DB - Service Endpoints9:28
Add a Cosmos DB service endpoint from a virtual network, configure firewall rules to allow only selected networks or private endpoints, and verify access through the data explorer.
- The Azure Key Vault service1:17
- Lab - Azure Key Vault3:17
- Lab - Azure Key Vault - Service Endpoints3:48
- Azure Private Endpoints3:18
- Lab - Azure Private Endpoints11:44
- What are Azure Web Apps2:26
Discover how the Azure Web App Service provides a managed platform for hosting web applications and integrates with virtual networks, with support for dotnet, Java, Node.js, PHP, and Python runtimes.
- Lab - Deploying an Azure Web App4:23
- Azure Web App - Virtual Network Integration1:52
- Azure Web App - Virtual Network Integration - Implementation Overview1:58
- Lab - Azure Web App - Azure Virtual Network Integration - Database server7:02
Deploy Azure Ubuntu Linux VM to host a MySQL database, configure a private IP in a virtual network, create a database, table, and user, and connect a web app securely.
- Lab-Azure Web App-Azure Virtual Network Integration - Database server -Resources0:41
- Lab - Azure Web App - Azure Virtual Network Integration - Application setup6:40
Deploy a dotnet web app to an Azure web app and establish private connectivity to a MySQL database inside an Azure virtual network using VS Code and Azure tools.
- Lab - Azure Web App - Azure Virtual Network Integration - Implementation2:57
- Azure Web App - SSL3:44
- Azure DDoS protection2:28
Azure DDoS protection guards your web application against bot-driven traffic with continuous monitoring, real-time attack metrics, and a rapid response team, including IP protection and network protection options.
- What is the Azure Firewall service2:17
- Lab - Azure Firewall - Setup2:29
- What is the Azure Bastion Service3:12
- Lab - Azure Bastion Service5:58
- Lab - Azure Bastion Service - Usage2:40
Connect to remote virtual machines across peered networks using the Azure Bastion service, even without public IPs, then SSH through the portal and install Nginx on Ubuntu.
- Lab - Azure Firewall - Deployment4:24
- Lab - Azure Firewall - Routing traffic through the firewall5:37
- Lab - Azure Firewall - Application rules4:52
- Lab - Azure Firewall - NAT Rules4:25
Explore how to use denat rules in Azure Firewall for network address translation, mapping a public firewall IP and port to a private VM IP and SSH port.
- Hub Spoke Architecture12:15
Implement a hub-spoke architecture with Azure Bastion and Azure Firewall, enabling site-to-site VPN, gateway subnet and network gateway, then configure routes and firewall rules to reach web VM zero one.
- Azure Application Gateway4:09
- Lab - Azure Application Gateway - URL Routing - Setup11:15
Configure two ubuntu web servers with nginx, hosting videos and images, and use the Azure Application Gateway to route /videos to web vm01 and /images to web vm02.
- Lab - Azure Application Gateway - URL Routing - Implementation9:33
Set up an Azure application gateway with URL routing to direct internet traffic to video and image back-end pools, using path-based rules and a front-end IP.
- Lab - Web Application Firewall3:45
- Azure Content Delivery Network3:22
- Azure Front Door1:58
Azure Front Door expands the CDN by delivering globally distributed web content with low latency and caching, a global service that speeds and routes content for apps across regions.
- Lab - Azure Front Door - Setup5:08
Demonstrate Azure Front Door setup alongside an existing Application Gateway, enable WAF detection mode, and deploy a second Web App in UK South to simulate dual web infrastructures.
- Lab - Azure Front Door - Implementation8:15
Deploy and configure Azure Front Door with an endpoint and an origin group containing an Azure Application Gateway and a web app, setting routes and health checks to optimize latency.
- Azure SQL Managed Instance8:01
Discover Azure SQL managed instance, a managed service with near 100% compatibility to SQL Server, deployed in a virtual network for private, secure access compared to Azure SQL Database.
- Section Quiz
- Lab - Let's deploy the Azure Key vault again3:06
- Using an application to access secrets7:14
- Using Azure Role-based access control3:17
Learn how to switch an Azure key vault from access policies to role-based access control, assign the key vault secrets user role to the app, and read secrets using RBAC.
- Lab - Azure Key Vault soft delete8:11
- Lab - Backup and Restore of secrets2:09
- Encryption at rest1:54
- Lab - Azure Storage encryption - Customer managed keys6:29
- Note - Infrastructure Level encryption1:29
Enable infrastructure level encryption on Azure storage accounts to provide a second layer of at-rest encryption; this setting cannot be changed after creation.
- Lab - Azure Disk Encryption9:30
Deploy a Windows VM with 8 GiB data disk, enable Azure Disk Encryption using a Key Vault and customer managed keys, with BitLocker on Windows and DM-Crypt on Linux.
- Note on automated key rotation1:32
Enable automatic key rotation in Azure Key Vault with rotation policies, rotation time, and notifications to keep customer managed keys fresh for storage and disk encryption.
- Managed Service Identity3:36
- Lab - Managed Service Identity9:23
- What is the Azure Policy service1:06
- Management Groups3:54
- Looking at Management Groups6:22
- Lab - Azure Policy6:29
- Lab - Azure Policy - Deny effect4:04
Apply an Azure policy with deny effect to enforce OS and data disk encryption with a customer-managed key, affecting new VM deployments while auditing existing resources.
- Lab - Azure Policy - Remediation6:32
- Lab - Creating a custom policy4:17
- Azure Blueprints1:33
- Lab - Working with Azure Blueprints8:20
- Lab - Azure Blueprints - Resource Locks3:24
- What is the Azure Monitor Service4:47
Discover how the Azure Monitor service collects metrics and logs from Azure resources and on-premises systems, using Log Analytics workspaces to analyze data, set alerts, and visualize performance.
- What is a Log Analytics Workspace1:43
- Lab - Creating a Log Analytics workspace1:14
- Lab - Sending log data to the Log Analytics workspace9:49
- What is Microsoft Sentinel3:39
- Lab - Microsoft Sentinel - Creating a workspace2:33
- Lab - Microsoft Sentinel - Azure Activity Connector5:25
- Lab - Microsoft Sentinel - Windows Security Events Connector3:30
- Microsoft Sentinel - Microsoft Entra ID Connector1:51
- Note on collecting syslog and common event format1:32
- Exploring the tables in the Log Analytics workspace3:28
- Log Analytics - Filtering for data6:28
Use KQL to filter data in a log analytics workspace with where clauses and time ranges. Analyze AzureActivity and SecurityEvent data by applying EventID filters and combined criteria.
- Log Analytics - Filtering for data - Resources0:42
- Log Analytics - Summarizing data1:59
- Log Analytics - Summarizing data - Resources0:23
- Log Analytics - Projection and Dynamic data types6:37
Learn to project specific columns in log analytics queries and extract values from dynamic data types, using project, square bracket access, and extend to retrieve the client IP address.
- Log Analytics - Projection and Dynamic data types - Resources0:34
- Microsoft Sentinel - Looking at workbooks2:59
- Microsoft Sentinel - Creating a scheduled query rule8:26
- Microsoft Sentinel - Working with Incidents2:27
Learn how Microsoft Sentinel converts alerts into incidents, view incident details, and use playbooks, automation rules, and team assignments to manage threats, tactics, and techniques across data sources.
- Microsoft Sentinel - Hunting for issues2:56
- Microsoft Sentinel - Playbooks10:40
- What is Microsoft Defender for Cloud2:45
- Quick look at Microsoft Defender for Cloud4:58
Explore microsoft defender for cloud's basic free features, including recommendations, secure score, and compliance controls, and learn how to enable remediation and encryption with a free trial of enhanced security.
- Upgrading to Microsoft Defender for Cloud Enhanced security features2:06
Upgrade to the enhanced Microsoft Defender for Cloud to access a 30-day free trial within your Azure subscription, unlocking more recommendations based on your resources and Log Analytics workspace.
- Looking at the initial recommendations7:33
- Microsoft Defender - Regulatory compliance3:25
- Microsoft Defender for Servers4:16
- Microsoft Defender - Just-in-Time VM Access4:56
Explore how just-in-time VM access in Microsoft Defender for Cloud converts a deny network rule into a time-bound allow rule for RDP (3389) access.
- Microsoft Defender for Cloud - Just-in-time VM access - Requesting access7:43
Configure Microsoft Defender for Cloud to grant just in time VM access with a custom RBAC role, temporarily opening port 3389 for three hours after a deny rule blocks traffic.
- Microsoft Defender - Just-in-Time VM Access - Custom Role - Resources0:10
- Microsoft Defender for Storage1:47
Protect Azure storage data with Microsoft Defender for Storage, which detects threats, malicious uploads, exfiltration, and data corruption. Enable workflow automation to alert security admins when issues arise.
- Microsoft Defender - Workflow Automation4:05
- Microsoft Defender for SQL2:09
- Section Quiz
- Lab - Creating an Azure SQL Database5:23
This chapter looks into creating an Azure SQL Database
- Lab - Microsoft Entra database authentication - Setting the admin8:00
- Lab - Azure AD Authentication - Azure SQL Databases - Resources0:16
- Lab - Microsoft Entra database authentication - Adding another user3:29
- Lab - Enable Database auditing3:54
This chapter looks into Azure SQL Server auditing
- Lab - Dynamic Data Masking6:59
- Lab - Dynamic Data Masking - Resources0:18
- Transparent data encryption1:52
This chapter looks into a lab on Azure SQL Database encryption
- Azure SQL Database - Always Encrypted3:15
- Lab - Azure SQL Database - Always Encrypted6:22
- Securing access to Azure Storage Accounts1:31
Learn how to securely authorize access to data stored in Azure storage accounts, including general purpose v2, blob storage, file shares, queues, and table storage.
- Lab - Let's create an Azure Storage Account2:51
This chapter looks into creating an Azure storage account
- Lab - Let's learn to use the Blob service5:46
- Lab - Let's use the Azure Storage Explorer6:05
This chapter looks into working with Azure storage explorer
- Lab - Shared Access Signatures - At the Blob level3:57
Generate and apply blob-level shared access signatures to grant read-only access for a defined start-end window, limit permissions, IP restrictions, and share a blob SAS URL.
- Lab - Shared Access Signature - Container Level2:47
Generate a container-level shared access signature with read and list permissions and start and expiry times. Connect to the container using the SAS URL in Azure Storage Explorer.
- Lab - Shared Access Signatures - At the Storage Account Level2:47
- Lab - Blob service - Stored Access Policy7:00
Learn how stored access policies secure blob storage by embedding permissions in shared access signatures (sas) tokens. Discover how to invalidate rogue tokens by rotating keys or updating access policies.
- Lab - Azure File share service5:16
- Lab - Shared Access Signature - Blob Service - Permissions example2:58
Generate a shared access signature for the blob service with resource types service and container and permissions read and list, showing that object permissions are needed to access individual blobs.
- Lab - Shared Access Signature - File Service - Permissions example1:51
- Lab - Role assignments for Azure Storage Accounts - Blob service9:21
- Lab - Using the Queue service - Using Microsoft Entra ID2:37
Explore the queue service by creating a queue, sending and receiving messages, and granting Microsoft Entra ID access with a storage queue data message sender role for messaging operations.
- Lab - Using the Table service - Using a SAS3:37
Create and populate a storage table in Azure using the table service, define partition and row keys, and access it with a shared access signature via Azure Storage Explorer.
- Final note on all authentication methods supported3:37
- Lab - Azure Blob snapshots1:57
Explore blob snapshots as a read-only, point-in-time copy in Azure storage, and learn how to promote a snapshot to restore a blob’s previous version.
- Lab - Azure Blob versioning3:05
- Lab - Azure Blob - Soft delete1:50
Explore how soft delete protects Azure blobs and containers by retaining deleted data for seven days, enabling restoration to the prior state after accidental deletion or override.
- Understanding the container landscape4:44
Explore how to deploy container-based applications on Azure, using Docker concepts and container runtimes to isolate apps and manage dependencies for secure, scalable deployments.
- Lab - Deploying Docker on a virtual machine3:37
Deploy an Ubuntu Linux Azure VM, install the Docker tool set, and run a simple container, while learning how Azure services secure container based deployments.
- Lab - Running the nginx container on the Linux VM3:14
Run nginx in a docker container on an Azure Linux VM. Pull the nginx image from Docker Hub, run it, map ports, and verify with the VM's public IP.
- Lab - Azure Container Registry4:12
Learn how to create and deploy a private Azure Container Registry and publish your custom Docker image to Azure Container Registry, enabling private image hosting within Azure.
- Lab - Containerize an application8:40
- Lab - Containerize an application - Resources0:11
- Lab - Publishing to the Azure Container Registry2:30
- Lab - Publishing to the Azure Container Registry - Resources0:15
- Different RBAC roles for Azure Container Registry1:22
- Note on Content trust1:25
- Lab - Azure Container Instances4:26
- Lab - Using Azure Kubernetes4:47
- Lab - Using Azure Kubernetes - Application deployment3:19
- Quick note on Microsoft Defender for Cloud - Containers and Kubernetes1:46
Discover how Microsoft Defender for Cloud protects workloads on Azure Kubernetes and Azure Container Registry, with container image scanning, workload protections, and actionable recommendations.
- Section Quiz
- Practice Test 1
- Practice Test 2
- Bonus Lecture0:28
Right here! Avail special discount coupon links for all of my Al Azure and AWS Courses
Requirements
- Learners are required to have a basic understanding of managing several security aspects such as managing identities and securing data and infrastructure.
- Learners need to have a basic understanding on base-level services provided on the Azure platform like AZ 900
Description
v 4.0 - October 2024
Refreshed course with newer videos to reflect the changes in exam objectives and changes in Azure services
Updated Practice Tests
Updated Quizzes at the end of each section
v 3.0 - February 2022
Refreshed course with newer videos to reflect the changes in exam objectives and changes in Azure services
Added new Practice Test questions
Added Quizzes at the end of each section
v 2.0 - April 2021
Refreshed videos on various chapters which includes the following
Role-based access control
Azure AD Privileged Identity Management
Conditional Access Policies
Azure Firewall
Azure Bastion
Point-to-Site and Site-to-Site VPN connections
Network Security Groups
Update Management
Security for Azure SQL databases - Includes Azure AD Authentication, Data masking , Always Encrypted feature
Added new videos which includes the following
Azure AD Roles - User and Password Administrator role
More chapters regarding aspects for Conditional Access policies
Azure AD Applications - Delegated permissions
Hub and Spoke Architecture using Azure Bastion, Azure Firewall and Azure VPN gateway
Working with various new aspects in Azure Security Center
Working with various new aspects in Azure Sentinel
Azure Key Vault - Using RBAC access policies
v 1.1 - August 2020
Updated contents of course as per changes in objectives - 29th July 2020
This course will make students be prepared to take on the following exam
Exam AZ-500: Microsoft Azure Security Technologies
All concepts covered in this course are aligned to the following Exam Objectives
Manage identity and access
Implement platform protection
Manage security operations
Secure data and applications
There are labs that focus on various security aspects on Azure. This includes working with Azure AD, Protection for workloads on Azure that includes virtual machines, Azure SQL databases and Azure storage accounts.
Security is a very important aspect in today's world. And this course will ensure that students are prepared when it comes to security on the Azure cloud platform.
Who this course is for:
- Learners who wants to ace Azure security core services and implement security controls and threat protection.
- Students who wants to be a valuable asset to any organization looking to secure its cloud infrastructure.