Microsoft Azure Security Technologies (Exam AZ-500)

Explore Azure Active Directory as a multi-tenant identity management solution featuring multifactor authentication, device registration, self-service password reset, auditing, alerting, conditional access, and on-premises integration.

Compare Azure AD and AD DS for cloud versus on-prem authentication. Azure AD uses web protocols and lacks organizational units or group policy, unlike on-prem AD DS, with pass-through authentication.

Azure Active Directory offers many pre-built administrative roles and RBAC to assign users to roles like global administrator, billing administrator, and directory reader; you can also create custom roles.

Learn to create and manage Azure Active Directory groups, including security and Office 365 groups, and apply role-based access control with dynamic user and device membership rules.

Learn how to enable and configure multifactor authentication in Azure Active Directory, including choosing authentication methods (authenticator app, text, hardware token), managing trusted IPs, and enforcing per-user MFA setup.

Learn how to transfer an Azure subscription and its resources to a new account or tenant, including billing ownership, new owner acceptance, and necessary RBAC reassignments.

Explore how Azure Active Directory identity protection automates detection and remediation of identity-based risks, flags unusual sign-ins and risky travel, and exports data to SIEMs such as Azure Sentinel.

Create and configure user risk and sign-in risk policies in Azure AD Identity Protection. Apply to all users, set risk levels (high/medium/low), and enforce actions like block or password change.

Conditional access evaluates signals beyond identity to decide access. Consider Azure AD conditions like location, device, app, risk, and group membership to grant, block, or require MFA.

Create a conditional access policy in Azure Active Directory, assign targets, choose cloud apps, set user risk and location, and enforce access with MFA or device compliance.

Explore how Azure Active Directory access reviews verify group memberships and privileged roles through identity governance, including group-based, privileged identity management, and enterprise applications, with scheduling and automation.

The shared responsibility model clarifies cloud versus customer duties, letting you focus on data, endpoints, and access management while leveraging provider security features to monitor logins and security signals.

Learn how Azure hierarchy governs access from management groups to subscriptions and resource groups, how permissions cascade downward through inheritance, and how role assignments behave across levels.

Learn how Azure policies and locks enforce governance by restricting actions and locations, using built-in policy definitions, initiatives, and no-delete and read-only locks to protect resources.

Assign roles with Azure role-based access control across management groups to resource groups and resources, using built-in owner, contributor, and reader roles to grant granular permissions.

Azure blueprints offer a standards-based, declarative way to deploy resources with artifacts like ARM templates, policies, resource groups, and RBAC, keeping deployments connected and repeatable across subscriptions.

Azure Active Directory Privileged Identity Management enables just-in-time privileged access by requiring approvals, justification, and multi-factor authentication, with audit history, alerts, and an Azure Active Directory Premium P2 license.

Activate privileged identity management in Azure Active Directory to elevate a user to a global administrator via eligible or active assignments, and configure activation rules, approvals, MFA, and notifications.

Configure Azure AD Connect to enable directory synchronization from on-premises Active Directory to Azure Active Directory. Configure password hash synchronization and use on-premises domain as the authority.

Explore Azure virtual networks as isolated, secure environments that control traffic, support site-to-site and express route connections, and segment resources with subnets and DNS-enabled IP management.

Azure provides automatic basic DDoS protections with real-time mitigation. Standard DDoS protection for virtual networks uses machine learning to defend public IP resources like application gateways.

Understand default Azure virtual network routes, including internet access and VNet-to-VNet communication. Use user defined routes to redirect traffic through a network virtual appliance for logging and inspection.

Force tunneling reroutes internet traffic from azure virtual network via a user defined route to a site-to-site or express route vpn for audit and packet inspection at on-premises gateway.

Understand how the Azure firewall as a service delivers stateful, scalable protection with default deny, app fqdn filtering, nat rules, network rules, and integrated monitoring.

Learn to secure Azure networks with network security groups by applying inbound and outbound rules to NICs or subnets, protecting virtual machines with default rules and priority-based first-match logic.

Use application security groups to group virtual machines within a virtual network and define policies by group. Apply NSG rules with ASG tags to simplify inbound and outbound traffic control.

Access Azure storage and other services securely by enabling service endpoints in a virtual network, keeping traffic on the Azure backbone and restricting access by subnet or IP.

Replace public endpoints with private links to access Azure platform as a service via private IPs, keep traffic on the Microsoft network, and enable on-premises integration.

Explore the Azure application gateway, which load balances web traffic, routes by host header or url, enables ssl termination, url rewrite to https, auto scaling, and a web application firewall.

Protects web apps globally by centralizing protection at the firewall, shielding against SQL injection and cross-site scripting, with core OWASP rules applied at scale.

Explore how Azure Front Door delivers layer 7 global routing to users via the nearest point of presence, with custom domains, edge TLS termination, and a web application firewall.

Discover how express route provides a private, non-internet path to Azure with IPsec encryption for secure traffic, and how ExpressRoute Direct delivers high-throughput, dual-active circuits across all Azure regions.

Adopt the shared responsibility model by securing endpoint systems—laptops, tablets, and smartphones—connecting to Azure resources with endpoint protection, keeping virus definitions up to date, and integrating into Azure Security Center.

Configure automated update management in Azure to assess, schedule, and apply updates to Windows and Linux VMs across Azure, on premises, and other clouds using Log Analytics and Automation accounts.

Activate Azure disk encryption on OS and data disks of VMs, using platform managed or customer managed keys in Azure Key Vault; Security Center monitors encryption and flags unencrypted disks.

Explore Windows Defender capabilities, including Credential Guard for credentials in virtualized environments and secure boot, and Defender Application Control to block unsigned scripts and kernel-mode code, preventing rootkits and spyware.

Use Azure Security Center to detect threats and improve your posture with machine learning driven analytics, policy-based safeguards for virtual machines, endpoint protection, disk encryption, and regulatory standards assessment.

Learn how Azure security baselines, developed with the Center for Internet Security, set auditable baseline objectives across identity, security center, storage, SQL, logging, networking, and virtual machines for secure deployments.

Understand how containers share an operating system to improve resource efficiency, and how container orchestration enables scalable, high-availability deployments in Azure.

Secure Azure container instances by using a private registry, scanning images with Azure Security Center, enforcing approved signed images, applying least privilege, and enabling logging and monitoring.

Authenticate to Azure container registry using Azure Active Directory credentials or a service principal for role-based access control, with docker login via az acr to cache credentials.

Explore Azure Kubernetes Service as a managed container orchestration platform, learn about the control plane, nodes, pods, deployments, and deploying via yaml manifests for scalable container apps.

Learn AKS networking concepts, including cluster IP, node port, and load balancer, plus external name DNS, Azure load balancer integration, and network policy controls for pod access and traffic routing.

Learn how AKS handles storage by contrasting ephemeral pod storage with persistent volumes backed by Azure Disk or Azure Files, including SMB shares that enable multiple pods to access data.

Explore how Azure Key Vault centralizes secrets, keys, and certificates management with access control and logging, enabling secure storage, encryption, and application access for development through production.

Explore how Azure key vault access is governed by management and data planes, with user plus application or application-only authentication, enabling centralized control and access policy updates.

Explore how Azure Key Vault manages certificates, including creating, importing, and managing X.509 version three certificates (self-signed and CA-generated), RSA and other keys, and lifecycle with automatic renewal and notifications.

Explore Azure key vault keys, from soft keys in software to HSM-protected keys, and learn to create, import, update, delete, list, sign, verify, wrap, bring your own key, and rotate.

Explore the Microsoft identity platform, built on Azure Active Directory, to sign in users, obtain tokens for API calls like Microsoft Graph, and register applications in the Azure portal.

Register an application in the Azure portal to enable tokens from the Microsoft identity platform. Configure account types, redirect URI, and client ID or secrets to secure token access.

Use managed identities for Azure resources to securely authenticate code without exposing credentials, choosing between system assigned and user assigned identities, and assign access roles to resources.

Understand data sovereignty by examining how laws govern data in its country or region and how Azure geographies and region pairs support privacy, replication, and high availability.

Learn how to control access to Azure storage using storage account keys, shared access signatures, and Azure Active Directory role based access control for blobs, containers, and files.

Azure storage encryption automatically protects all data at rest and in transit with 256-bit keys; you can use Microsoft-managed, customer managed, or customer provided keys for per-request control.

learn to apply immutable blob storage policy with time based retention or legal hold, and lock the policy to meet sec retention requirements.

Explore how to authenticate to Azure Files using Active Directory Domain Services, whether on premises or in Azure, and secure file shares via AD credentials, access controls, and PowerShell configuration.

Configure storage accounts to require secure transfer and enforce encrypted connections for blob and file storage. Manage custom domains and blob public access to prevent anonymous access and safeguard data.

Explore SQL authentication options and learn to use Azure Active Directory credentials for database access, mapping logins to AD users by configuring an Azure AD admin.

Configure Azure sql firewall rules at database or server level to restrict access by IP address or range. Use sql authentication or azure ad to connect.

Enable auditing at the server or database level to log events to storage, log analytics, or event hub, configure retention, and run auditing in parallel for compliance insights.

Discover data discovery and classification in Azure SQL, labeling sensitive information types and applying dynamic data masking to limit exposure, including masking credit card numbers to last four digits.

Discover how Azure vulnerability assessment scans databases, surfaces findings, and uses baselines to reduce noise, while advanced threat protection detects SQL injection and unusual access.

Explore how transparent data encryption protects data at rest in Azure SQL databases and servers with real-time page-level encryption, using service-managed keys or bring-your-own-key options.

Explore always encrypted, a client-side mechanism protecting data at rest, in transit, and in use by encrypting with deterministic or randomized keys stored in Windows Store or Azure Key Vault.

Leverage Azure Monitor to ingest telemetry from Azure, on-premises, and third-party sources, store metrics and logs, visualize with dashboards, run log analytics, and automate alerts.

Discover how log analytics in Azure Monitor collects data from cloud and on-premises, using agents on Windows or Linux with a workspace ID and key, and kql queries.

Azure security center acts as the central hub for monitoring azure subscriptions, deployed resources, and non-azure servers via log analytics, providing recommendations to harden environments and flagging potential hazards.

Configure Azure Security Center policies with default, regulatory, and custom policies. Define policy definitions and initiatives, and assign them at management group, subscription, or resource group to meet regulatory standards.

Explore how Azure Security Center uses ASC recommendations to enforce security policies, provide remediation steps and quick fixes, and boost your security score by applying automated or manual remediations.

Understand how the secure score in Azure Security Center reflects your security posture, rising as you implement recommendations, such as enabling MFA to improve scores and reduce risk.

Limit brute force risks by disabling public IPs and using Azure Bastion or site-to-site VPN to access VMs through private IPs, with multi-factor authentication and just-in-time access.

Leverage Azure Sentinel to counter alert fatigue by aggregating signals from Azure Identity Protection, Microsoft Cloud App Security, Intune, and Azure Defender for cloud-scale SIEM-driven threat detection and automated response.

Configure data connectors in Azure Sentinel to ingest security data from multiple sources via built-in connectors, APIs, or agents, enabling real-time log streaming and automated detections.

Use Azure Sentinel workbooks to monitor data and view interactive reports. Leverage pre-built and custom workbooks with machine learning rules to consolidate alerts into incidents and save your reports.

Learn to build Azure Sentinel playbooks with logic apps to automate incident responses, using triggers, templates, and integrations like ServiceNow and approval emails.

Leverage Azure Sentinel's robust hunting framework to proactively hunt across your organization, surface high-value insights from queries in the portal, and trigger custom detection rules and alerts.

Explore five hundred Azure security technologies, including privileged identity management for just-in-time administrative access, user-defined routes for force tunneling, and Azure Central for security analytics across on-premises and cloud environments.