AZ-500: Azure Security Technologies Course

Explore Azure AD as a cloud identity service, learn licensing from free to P1/P2 and B1/B2, and how dynamic groups, MFA, and conditional access secure internal and external apps.

Master Azure AD key capabilities, including user and group management, conditional access with multi-factor authentication, device governance, and B2B/B2C collaboration, plus SaaS and on-premises resource access.

Explore Azure AD users, including cloud-based, synchronized Active Directory, and B2B guest users; learn how to create and manage users via the portal, PowerShell, and CLI, with MFA for security.

Demonstrate creating internal and B2B guest users in Azure AD, assign them to groups and roles such as security administrator, configure password options, and invite guests with access controls.

Explore Azure AD groups, including security and Office 365 groups, and learn how static, dynamic user, and dynamic device memberships control access to resources and collaboration tools.

Learn how to create groups in Azure AD, choose group types (security or Office 365), assign owners and members, configure application admins, and view group properties and audit logs.

Explore user settings and external collaboration in Active Directory, including application registration, admin portal access, LinkedIn connections, and guest permissions to secure B2B collaboration.

Explore application management challenges and how Azure AD enables secure, seamless access to cloud and on-premise apps through single sign-on, conditional access, MFA, and governance reporting.

Register an app in Azure AD to create a service principal, grant its access to subscriptions and resources, and configure permissions and secrets or certificates for authentication.

Understand why single sign-on is needed, how an identity provider authenticates users across multiple apps, and the protocols used to implement single sign-on to reduce administration and boost productivity.

Explore the different single sign-on options with Azure AD, including OpenID Connect, SAML, and password-based authentication. See how linked and header-based authentication integrate apps for centralized access.

Azure AD Connect unites on-prem and cloud identities to synchronize users and enable single sign-on for hybrid access, providing a common identity with a single password.

Explore Azure AD Connect authentication types—password hash synchronization, pass-through authentication, and federation integration—and learn how to choose the right method for on-premise and cloud apps.

Explore identity concepts in Azure security, including users, groups, applications, and credentials, and differentiate system managed and user managed identities, learning how credentials are secured without code by managed identities.

Create system-assigned and user-assigned managed identities for an Azure VM to obtain credentials from the instance, avoiding hard-coded secrets.

Explore how Azure Active Directory Identity Protection uses threat intelligence, risk signals, and conditional access to automatically alert, block, or verify sign-ins when identities are compromised.

Enterprise state roaming enables a unified Windows experience by securely synchronizing user settings across devices, separating corporate data, with data encrypted before leaving devices and protected by Microsoft information protection.

Explore zero trust principles and how conditional access gates secure cloud applications and data by never trust, always verify, with identity as the control plane and device-based authentication.

Azure conditional access combines signals like user, IP address, location, device, and application with conditions and access controls to enforce organizational policy and governance, prompting MFA when risk is detected.

Learn how Azure conditional access works by evaluating multiple policies in two phases, enforcing MFA and a compliant device, and blocking access when a policy is violated.

Demonstrates configuring a MFA-based conditional access policy in Azure, creating a test user, selecting users and apps, and applying location and device conditions to require multifactor authentication.

Understand the purpose of conditional access and the three pillars—common signals, common diseases, and common applied policies—driving access decisions with signals from users, devices, IPs, and MFA.

Explore how role based access controls use security principals, role definitions, and scope to grant fine grained permissions for resources like storage, virtual machines, and secret database.

Learn how security principals (users, groups, service principals, and managed identities) authorize access to Azure resources under RBAC, and how authentication, authorization, roles, and assignments streamline secure access.

Learn how to define roles in Azure RBAC, distinguish built-in and custom roles, and manage access with both management and data operations for resources like storage accounts.

Explain how scope in Azure RBAC narrows access to management groups, subscriptions, resource groups, and resources, using roles such as reader and contributor and the idea of effective permissions.

Explore how azure rbac enforces permissions through rule assignments: security principle, permissions, and scope, to grant right users access to resources like virtual machines, databases, and storage.

Configure role-based access control in Azure by creating a security group as a principal, assigning a built-in role, and scoping access to a resource group.

Azure policy enforces rules via policy definitions on data sources such as virtual machines and storage accounts, enabling governance, encryption at rest, and compliance across the organization.

Explore how Azure policies are defined, assigned, and evaluated, and how policy effects like audit, deny, modify, and append shape resource compliance across subscriptions, resource groups, and regions.

Explore how to configure Azure location based policies by assigning built-in policies, enforcing location constraints, and validating resource group creation only in approved regions like central India.

Explore Azure privileged identity management and how it secures elevated access to critical resources, with just-in-time access, approvals, MFA, and access reviews.

Explore azure locks, a feature that prevents accidental deletions and unwanted changes by applying cannot delete or read-only locks to resources, safeguarding critical assets.

Enable locks on a storage account to prevent accidental deletion, selecting read-only or delete restrictions to safeguard critical data.

Explore a layered Azure network security strategy protecting workloads from internet traffic with private endpoints and DDoS protection. Use virtual network isolation and network security groups to control traffic flow.

Learn how distributed denial of service attacks flood targets with compromised devices and how Azure protection offerings mitigate such attacks with basic and standard plans, monitoring, detection, and logs.

Azure DDoS protection standard monitors traffic to public IPs. It blocks attack traffic and forwards traffic to resources such as virtual machines, load balancers, and application gateways, with customizable policies.

Create a vignette virtual network in a resource group and define two subnets with distinct address ranges, illustrating subnetting inside the virtual network for Azure security technologies labs.

Learn how Azure network security groups control traffic to virtual machines by defining inbound and outbound rules, priorities, sources, destinations, and defaults.

Learn how Azure NSG rules are evaluated. Check inbound traffic at the subnet level first, then NIC; check outbound traffic at the NIC level first, then subnet.

Learn how Azure NSG rules are evaluated from subnet level to NIC, and how deny and allow settings control traffic to a virtual machine.

Group your virtual machines by the application they run. Learn how Azure application security groups replace IP-based NSG rules and simplify traffic between web servers, apps, and databases.

Learn to use Azure application security groups as logical collections of virtual machines, attach NICs, and apply inbound rules by using ASG as source or destination in network security groups.

Azure Firewall is a cloud-based, stateful security service that protects virtual networks and resources with centralized hub-and-spoke management, threat intelligence feeds, and integration with Azure Monitor and Splunk.

Navigate Azure's user-defined routing to control traffic between subnets with custom routes and next hops, alongside default routes to send traffic to internet, VPN gateway, or network appliances.

Demonstrates configuring Azure Firewall with a user-defined route and next hop through a virtual appliance, across subnets, and testing google.com access.

Learn how service endpoints extend your virtual network to Azure services, moving traffic onto the Microsoft backbone and keeping data private by avoiding internet exposure.

Use Azure service endpoint policies to restrict access to selected storage accounts over the service endpoint, enforcing least-privilege and granular control while keeping data off the internet.

Enforce Azure vm security by avoiding public IP exposure, restricting management ports to approved sources, encrypting disks, and applying RBAC with policy enforcement, just-in-time access, MFA, and updates.

Learn how Microsoft anti malware for Azure virtual machines provides real-time protection via the VM extension, with updates, alerts, remediation, and reporting, plus storage forwarding and marketplace options.

Demonstrates installing Microsoft anti-malware on a Windows virtual machine using VM extensions, enabling real-time protection, configuring scans and exclusions, scheduling, and uninstalling.

Learn to configure update management for Azure virtual machines by enabling an automation account and a Log Analytics workspace, viewing missing security updates, and scheduling deployments across multiple VMs.

Learn why Azure Key Vault centralizes secrets and encryption keys, preventing exposure in code and memory, while enabling lifecycle management and hardware security module backed security at scale.

Explore azure key vault overview as a central service for secrets, keys, and certificates, backed by a FIPS 140 certified hardware security module and offering standard and premium options.

Learn how to create a key in an Azure key vault, add secrets and certificates, and configure access policies for secure application access.

Explore azure disk encryption for Windows and Linux virtual machines, encrypting boot and data volumes to prevent unauthorized access and meet security and compliance requirements.

Demonstrates enabling Azure disk encryption on a virtual machine by creating a Key Vault and key, configuring access policies, and applying encryption to the VM disks.

Explore Azure key authentication methods and a secure workflow for creating and managing keys, using managed identities or service principals with certificates or secrets, plus monitoring.

Explore Azure data storage service types, including blob, file, queue, and table storage, with data replication across regions and data lake capabilities for unstructured data.

Learn how storage accounts use access keys to authenticate and access data, why rotating primary and secondary keys prevents downtime, and how key rotation improves security and availability.

Secure an Azure storage account by applying authentication and authorization options, including shared keys and shared access signatures, for blobs, queues, and files; explore encryption in transit and at rest.

Azure storage security layers spanning management access, data plane controls, and network restrictions, with role-based access control, storage keys security, firewall, and encryption in transit and at rest.

Secure data plane access for storage accounts by applying role-based access control, shared access signatures, account keys, and policy-based controls to blobs, tables, queues, and files.

Explore the limitations of storage account keys, such as blanket access and lack of temporary or service-specific controls, and learn why shared access signatures provide granular, temporary access.

Create storage account, secure access keys and connection string. Apply rbac with service principals, assign contributor or reader, and store keys as secrets in key vault to avoid hard coding.

Enable encryption at rest with customer-managed keys and enforce encryption in transit for storage accounts, noting that by default Microsoft-managed keys protect data in blobs and files with https only.

Secure storage accounts by configuring firewall and virtual networks, and establish a private endpoint to route data over a private link with encryption in transit.

Discover how shared access signatures enable granular, time-bound permissions with start and expiry times for storage resources via service level and account level SAS, using stored access policy.

Learn to create a storage container, access it with storage explorer, and generate shared access signatures for a container, including setting permissions and storage access policies.