SC-500 Security Engineer: AI & Cloud Security

Learn how to secure Azure identities and control access using Microsoft Entra ID, MFA, Conditional Access, and Privileged Identity Management (PIM).

Lab 1A — Configure Privileged Identity Management

Practice Lab: Microsoft Entra Privileged Identity Management (PIM)

In this lab, you will configure Microsoft Entra Privileged Identity Management (PIM) to implement just-in-time (JIT) privileged access.

You will practise how to:

• Assign the Conditional Access Administrator role as an eligible assignment

• Configure activation duration and justification requirements

• Require approval before privileged access is activated

• Request and approve temporary privileged access

• Verify the activated permissions

• Deactivate the role when the task is completed

• Enable a system-assigned managed identity on an Azure App Service

This lab does not require an Azure deployment template. You can follow the lab instructions directly and use your own Microsoft Entra/Azure environment where the required licensing and permissions are available.

Microsoft Learning Lab Instructions:
Lab 1A – Configure Privileged Identity Management

My recommendation: Don't just watch the demonstration. Try the lab yourself, experiment with the settings, and repeat the activation/approval workflow. Hands-on practice will help you build confidence and understand how PIM works in a real-world environment.

Learn → Practise → Experiment → Build confidence.

Estimated time: 45 minutes, based on the Microsoft Learning lab.

Note: The GitHub instructions are Microsoft's publicly available learning resources. Your course demo is intended to help learners understand and practise the concepts demonstrated in those resources.

Learn how to protect application secrets, encryption keys, and certificates using Azure Key Vault, access controls, and security best practices.

Labb 1C — Secure Azure Key Vault

Practice Lab: Secure Application Secrets with Azure Key Vault

In this lab, you will learn how to securely store and protect application secrets and cryptographic keys using Azure Key Vault. You will configure RBAC, managed identity, network restrictions, Defender for Key Vault, and monitoring to build a secure secrets-management solution.

What You Will Practise

• Deploy and configure an Azure Key Vault

• Enable Azure RBAC for Key Vault access

• Apply least-privilege access using Key Vault roles

• Store application secrets and cryptographic keys

• Enable a system-assigned managed identity for an App Service

• Allow the application to retrieve secrets without storing credentials

• Understand the difference between management-plane and data-plane access

• Test access with different users and permissions

• Apply network restrictions to Key Vault

• Enable Defender for Key Vault

• Send Key Vault activity to Log Analytics for monitoring

Understanding the Deployment Template

This lab includes an Azure deployment template that prepares the required environment, including the App Service, VNet, Key Vault, and Log Analytics workspace.

The template prepares the environment; the actual security controls are configured and tested by you during the lab.

The Security Story

The lab follows a simple security flow:

Application → Managed Identity → Microsoft Entra ID → Key Vault → Secret

Instead of storing passwords, API keys, or other credentials inside application configuration, the application uses its managed identity to authenticate and RBAC to obtain only the permissions it needs.

Key Vault → Secure Storage
RBAC → Least-Privilege Access
Managed Identity → Passwordless Authentication
Network Restrictions → Reduce Exposure
Defender + Logs → Detect and Monitor

Lab Resources & Practice

The lab resources are based on the publicly available Microsoft Learning resources:

MicrosoftLearning – Security Identity Labs

Recommended approach:

1. Review the lab scenario and security architecture.

2. Deploy the provided template to prepare the environment.

3. Follow the lab instructions step by step.

4. Test application access to Key Vault.

5. Remove permissions and perform a negative test.

6. Restore the required permissions and verify access again.

7. Repeat the lab independently to build confidence.

Don't just watch the demo — practise the lab yourself. The most important concept is understanding how Managed Identity + RBAC + Key Vault removes the need to store application credentials.

Azure Cost Notice: Some resources used in this lab may incur Azure charges. Monitor your Azure usage and delete the resources after completing the lab if they are no longer required.

Estimated duration: 60 minutes.

Learn how to apply least-privilege access using Azure RBAC, governance controls, role assignments, and resource access management.

Lab 1D — Configure Azure Policy and Role-Based Access Control

Practice Lab: Azure Governance, Least Privilege & Access Reviews

In this lab, you will work through a realistic governance scenario involving Azure Policy, Infrastructure as Code, RBAC, Microsoft Entra ID Access Reviews, and resource locks. You will identify governance gaps, enforce tagging standards, create a least-privilege security reviewer role, review unnecessary privileged access, and protect a critical resource from accidental deletion.

What You Will Practise

• Assign a built-in Azure Policy and review compliance

• Trigger an on-demand policy compliance scan

• Deploy a custom tagging policy using Bicep and Cloud Shell

• Understand Infrastructure as Code (IaC) for governance

• Create a custom Azure RBAC role using least privilege

• Assign the security reviewer role at a limited scope

• Use Microsoft Entra ID Access Reviews to evaluate unnecessary Contributor access

• Automatically apply the access-review decision

• Apply a CanNotDelete resource lock

• Verify that the lock prevents deletion

Understanding the Lab Environment

This lab uses a prepared Azure environment containing resources such as a resource group, storage account, and virtual machine. The exercises then build governance controls around these resources.

The lab demonstrates four important security dimensions:

Policy Compliance → IaC Governance → Least-Privilege RBAC → Access Certification

Lab Resources & Practice

The lab instructions are based on the publicly available Microsoft Learning lab resources:

MicrosoftLearning – Security Identity Labs

The lab also uses a Bicep policy template to demonstrate how governance policies can be deployed consistently through Infrastructure as Code rather than configured manually.

Recommended approach:

1. Review the lab scenario.

2. Understand what the preconfigured environment provides.

3. Follow the lab instructions step by step.

4. Pay particular attention to the difference between Policy, RBAC, Access Reviews, and Resource Locks.

5. Use the demo video as a reference if you get stuck.

6. Repeat the lab yourself to build confidence.

Don't just watch the demo — practise the lab yourself. The goal is not only to understand Azure governance, but to gain confidence implementing these controls in a real environment.

Azure Cost Notice: This lab uses Azure resources. Monitor your Azure usage and remove resources when they are no longer required if you are running the lab in your own subscription.

Estimated duration: 60 minutes.

Learn how to protect Azure Storage using encryption, access controls, network security, SAS, private endpoints, and Defender for Storage.

Lab 2A — Secure Azure Storage

Practice Lab: Protect Azure Storage with Network Controls, SAS Policies, Defender and Logging

In this lab, you will secure an Azure Storage account that contains sensitive application data. You will learn how to control data-plane access, manage SAS tokens, restrict network access to an authorized virtual network, enable Microsoft Defender for Storage, and send storage activity logs to Log Analytics.

What You Will Practise

• Create a stored access policy for a blob container

• Generate and test a policy-backed SAS token

• Understand why stored access policies provide a central revocation mechanism

• Restrict storage access to a specific Azure virtual network

• Test and verify that unauthorized network access is blocked

• Understand how network restrictions affect Cloud Shell and portal access

• Enable Microsoft Defender for Storage

• Configure diagnostic logging to a Log Analytics workspace

• Understand the difference between access control, network security, threat detection, and monitoring

Understanding the Deployment Template

This lab includes an Azure deployment template that prepares the environment before you begin the security exercises.

The template creates the required lab environment, including the storage account, virtual network, and Log Analytics workspace. The visual deployment graph provided with this lecture will help you understand what is deployed and how the resources are connected.

Think of it as:

Deployment Template → Prepare the Environment → Security Exercises → Test & Validate

Important: The deployment template is only used to prepare the Azure environment. The actual security work—SAS policy, network restrictions, Defender for Storage, and diagnostic logging—is performed by you during the lab.

Lab Resources & Practice

The lab instructions and supporting resources are based on the publicly available Microsoft Learning lab resources:

MicrosoftLearning – Security Identity Labs

Recommended approach:

1. Review the lab instructions.

2. Study the deployment-template visual provided with this lecture.

3. Deploy the template to prepare your Azure environment.

4. Follow the lab steps and perform each security configuration yourself.

5. Use the demo video as a reference if you get stuck.

6. Repeat the lab independently to build confidence.

Don't just watch the demo — practise the lab yourself. The goal is to understand not only what each security control does, but also why and when you would use it.

Azure Cost Notice: This lab creates Azure resources that may incur charges. Monitor your Azure usage and delete the resources after completing the lab if they are no longer required.

Estimated duration: 60 minutes.

Learn how to secure Azure databases using Microsoft Entra authentication, network controls, encryption, auditing, and Defender for Databases.

Lab 2B — Secure Azure SQL Database

Practice Lab: Secure Azure SQL with Entra ID, Private Endpoint, Auditing & Defender

In this lab, you will harden an Azure SQL database following a security assessment that identified weaknesses in identity management, network access, and auditing. You will replace individual database administration with Microsoft Entra ID group-based access, isolate the database using a Private Endpoint, enable SQL auditing to Log Analytics, and enable Defender for Databases.

What You Will Practise

• Create an Entra ID security group for SQL administration

• Configure the group as the Microsoft Entra administrator for Azure SQL

• Understand identity-based database administration

• Remove the Allow Azure services and resources firewall exception

• Create and configure an Azure Private Endpoint

• Configure Private DNS for private SQL connectivity

• Enable SQL auditing and send audit data to Log Analytics

• Generate database activity and verify the audit event using KQL

• Enable Microsoft Defender for Databases

• Validate the final security configuration

Understanding the Deployment Template

This lab includes an Azure deployment template that prepares the database environment before you begin the security exercises.

The template provisions the required Azure SQL server and database, virtual network, Private DNS zone, Log Analytics workspace, and supporting resources. The deployment also initializes the database with sample data that you will use during the auditing exercise.

The visual deployment graph provided with this lecture will help you understand:

What the template deploys → How the resources connect → What you will secure

Important: The deployment template prepares the lab environment. The actual security configuration and validation are performed by you during the lab.

Lab Resources & Practice

The lab instructions and supporting resources are based on the publicly available Microsoft Learning lab resources:

MicrosoftLearning – Security Identity Labs

Recommended approach:

1. Review the lab scenario and security findings.

2. Study the deployment-template visual provided with this lecture.

3. Deploy the template and wait for the deployment to complete.

4. Follow the lab instructions step by step.

5. Pay particular attention to Entra ID authentication, Private Endpoint, auditing, and Defender for Databases.

6. Use the demo video as a reference if you get stuck.

7. Repeat the lab independently to build confidence.

Don't just watch the demo — practise the lab yourself. The goal is to understand how multiple Azure security controls work together to protect a database.

Azure Cost Notice: This lab creates Azure resources that may incur charges. Monitor your Azure usage and delete the resources after completing the lab if they are no longer required.

Estimated duration: 60 minutes.

Learn how to secure Azure networks using NSGs, ASGs, Azure Firewall, private endpoints, secure network architectures, and Network Watcher.

Lab 2C — Configure Network Security Controls

Practice Lab: Secure an Azure AI Workload with NSG, ASG, Azure Firewall & Private Endpoint

In this lab, you will secure an AI inference workload that has several network security gaps. You will apply Network Security Groups (NSGs), Application Security Groups (ASGs), Azure Firewall, Private Endpoint, route tables, and Network Watcher to control and validate network traffic.

What You Will Practise

• Create an Application Security Group (ASG) for the AI workload

• Create and configure NSG rules using the ASG

• Block inbound RDP from the Internet

• Allow inbound HTTPS from the virtual network

• Deploy Azure Firewall in a hub-spoke network

• Configure an application rule collection for outbound traffic

• Create a route table to force spoke traffic through Azure Firewall

• Create a Private Endpoint for the workload storage account

• Disable public access to the storage account

• Configure and use Private DNS

• Use Network Watcher IP flow verify to validate allow/deny decisions

• Review effective security rules

Understanding the Deployment Template

This lab includes an Azure deployment template that prepares the base environment before you perform the security configuration.

The template provides the hub and spoke VNets, VNet peering, workload subnet, Windows Server VM, storage account, and Private DNS zone. You then build the security controls on top of this environment.

The visual deployment graph provided with this lecture helps you understand:

What the template deploys → How the network is connected → What you need to secure

Important: The deployment template prepares the environment. It does not complete the security exercise. You will create the ASG, NSG, Azure Firewall, Private Endpoint, and route table, and then validate the resulting security controls.

The Security Story

This lab brings several controls together:

ASG → Identify the workload
NSG → Control inbound traffic
Azure Firewall → Inspect outbound traffic
Private Endpoint → Remove public storage exposure
Network Watcher → Validate the controls

This makes the lab particularly useful for understanding how multiple network security controls work together rather than relying on a single firewall or NSG.

Lab Resources & Practice

The lab instructions and supporting resources are based on the publicly available Microsoft Learning lab resources:

MicrosoftLearning – Security Identity Labs

Recommended approach:

1. Review the lab scenario.

2. Study the deployment-template visual provided with this lecture.

3. Deploy the template and wait for the deployment to complete.

4. Follow the security exercises step by step.

5. Use Network Watcher to verify your security decisions.

6. Use the demo video as a reference if you get stuck.

7. Repeat the lab independently to build confidence.

Don't just watch the demo — practise the lab yourself. The real learning happens when you configure the controls, test them, see what is allowed or denied, and understand why.

Azure Cost Notice: This lab creates Azure resources, including Azure Firewall, that may incur charges. Monitor your Azure usage and delete the resources after completing the lab if they are no longer required.

Estimated duration: 65 minutes.

Learn how to secure Azure servers and virtual machines using JIT access, Defender for Servers, vulnerability assessment, hardening, and disk encryption.

Learn how to identify sensitive data exposure and reduce AI data risks using Microsoft Purview DSPM, classification, and data protection controls.

Learn how to secure AI agent identities, permissions, and resource access using identity and least-privilege security controls.

Learn how to secure AI applications and integrations using Microsoft Foundry, AI gateways, authentication, access controls, and security policies.

Lab 3C — Configure AI Gateway and Foundry Security Controls

Practice Lab: Secure an AI Model Endpoint with API Management, Foundry Guardrails & Defender

In this lab, you will secure a Microsoft Foundry-hosted language model endpoint that currently has no authentication, rate limiting, or content safety controls. You will configure Azure API Management AI Gateway to control access and token consumption, apply content safety and Prompt Shield in Azure AI Foundry, and enable Defender for AI Services for behavioral threat detection.

What You Will Practise

• Review an unsecured AI model endpoint

• Configure Azure API Management as an AI Gateway

• Require subscription key authentication

• Apply token rate limiting to control AI consumption and cost abuse

• Test authentication and rate-limiting behavior

• Create a Foundry content safety guardrail

• Configure Prompt Shield for jailbreak and indirect attacks

• Apply the guardrail to a deployed model

• Enable Defender for AI Services

• Understand the difference between preventive and detective security controls

• Review the complete security architecture for an AI workload

Understanding the Deployment Template

This lab includes an Azure deployment template that prepares the environment before you begin the security exercises.

The template provisions the required API Management instance and pre-configured Foundry environment/model endpoint. You then apply the security controls yourself.

The visual deployment graph provided with this lecture helps you understand:

Deployment Template → AI Gateway + Foundry Environment → Security Configuration → Testing & Validation

Important: The deployment template prepares the lab environment. It does not configure the complete security solution. You will configure the gateway policies, authentication, rate limiting, Foundry guardrails, Prompt Shield, and Defender for AI Services during the lab.

The Security Story

This lab demonstrates defense in depth for AI workloads:

APIM Authentication → Who can access?
Token Rate Limiting → How much can they consume?
Foundry Guardrails + Prompt Shield → What content is allowed?
Defender for AI Services → What suspicious behavior is happening?

The key takeaway is that no single control is enough to secure an AI endpoint. Access control, consumption control, content protection, and threat detection work together.

Lab Resources & Practice

The lab instructions and supporting resources are based on the publicly available Microsoft Learning lab resources:

MicrosoftLearning – Security Identity Labs

Recommended approach:

1. Review the unsecured AI endpoint scenario.

2. Study the deployment-template visual provided with this lecture.

3. Deploy the template and wait for the environment to complete.

4. Follow the lab instructions step by step.

5. Test each security control after configuring it.

6. Use the demo video as a reference if you get stuck.

7. Repeat the lab independently to build confidence.

Don't just watch the demo — practise the lab yourself. The objective is to understand how AI Gateway, Foundry security controls, and Defender work together to protect an AI workload.

Azure Cost Notice: This lab creates Azure resources, including API Management, that may incur charges. Monitor your Azure usage and delete resources when they are no longer required.

Estimated duration: 60 minutes.

Learn how to monitor and protect AI workloads using Microsoft Defender for Cloud, security recommendations, threat detection, and monitoring controls.

Lab 3D — Monitor AI Security with Defender for Cloud

Practice Lab: Monitor AI Workloads with Microsoft Defender for Cloud

In this lab, you will explore how Microsoft Defender for Cloud monitors AI workloads and helps security teams identify security findings and recommendations.

You will practise:

• Reviewing the Data and AI security dashboard

• Checking AI workload protection status

• Reviewing security findings and severity

• Examining AI security recommendations and remediation guidance

• Understanding behavioral detections for AI workloads

• Comparing preventive controls such as content filtering with Defender's behavioral monitoring

The lab also demonstrates an important real-world concept: preventive controls reduce risk at the point of interaction, while Defender for AI Services helps identify suspicious behavior and activity patterns over time.

Important: Defender for Cloud data may take 6–24 hours or longer to appear. The lab therefore supports both a live-results path and a guided-review path when live findings are not yet available.

Estimated time: 15 minutes.

Learn how to secure Azure application hosting platforms and services using identity, network, access, and platform security controls.

Lab 4C — Secure Azure App Services and API Management

Practice Lab: Protect Web Applications and APIs with WAF, Entra ID & APIM

In this lab, you will secure web and API workloads by implementing layered controls across Application Gateway WAF, Azure App Service, Azure Function App, and Azure API Management.

You will first observe how WAF behaves in Detection mode, then switch it to Prevention mode and verify that malicious requests are blocked. You will also enforce Microsoft Entra authentication, restrict network access, and require subscription keys for API access.

What You Will Practise

• Test WAF Detection mode and review logged requests

• Switch WAF to Prevention mode and verify malicious requests are blocked

• Configure Microsoft Entra authentication (Easy Auth) for App Service

• Restrict App Service network access using Access Restrictions

• Restrict Function App network access

• Configure API Management to require subscription keys

• Test API access with and without a subscription key

• Understand how WAF, identity, network restrictions, and API controls work together

Understanding the Deployment Template

This lab includes an Azure deployment template that prepares the environment before you begin the security exercises.

The template provisions the core application platform environment, including:

Application Gateway → WAF Policy → App Service → Function App → API Management

The visual deployment graph provided with this lecture will help you understand what the template deploys and how these components fit together.

Important: The deployment template prepares the lab environment. The actual security configuration and testing are performed by you during the lab.

The Security Story

This lab demonstrates security at multiple layers:

WAF → Protect against web attacks
Entra Authentication → Verify who can access the application
Network Restrictions → Control where traffic can come from
APIM Subscription Key → Control API access

The important lesson is that application security is layered. WAF alone does not provide identity control, and authentication alone does not protect against web attacks.

Lab Resources & Practice

The lab instructions and supporting resources are based on the publicly available Microsoft Learning lab resources:

MicrosoftLearning – Security Identity Labs

Recommended approach:

1. Review the security gaps identified in the scenario.

2. Study the deployment-template visual provided with this lecture.

3. Deploy the template and wait for the deployment to complete.

4. Follow the lab exercises step by step.

5. Test each security control before and after configuration.

6. Use the demo video as a reference if you get stuck.

7. Repeat the lab independently to build confidence.

Don't just watch the demo — practise the lab yourself. Pay attention to the difference between Detection vs Prevention, authentication vs network restriction, and application security vs API security.

Azure Cost Notice: This lab creates Azure resources that may incur charges. Monitor your Azure usage and delete the resources after completing the lab if they are no longer required.

Estimated duration: 60 minutes.

Lab 4B — Secure Container Workloads with AKS and Defender for Containers

Practice Lab: Secure AKS and Azure Container Registry with Defender, RBAC & Network Controls

In this lab, you will secure a containerized AI inference environment running on Azure Kubernetes Service (AKS). You will enable Microsoft Defender for Containers, verify container and registry monitoring, and strengthen Azure Container Registry (ACR) security using least-privilege RBAC and network restrictions.

What You Will Practise

• Enable Defender for Containers on the Azure subscription

• Verify AKS and container registry monitoring coverage

• Prepare a container image in Azure Container Registry

• Understand how Defender provides vulnerability visibility for container images

• Disable the ACR admin account

• Assign AcrPull and AcrPush roles using Azure RBAC

• Apply least-privilege access to the container registry

• Restrict ACR public network access using selected networks

• Review the security posture of the container environment

Understanding the Deployment Template

This lab includes an Azure deployment template that prepares the container environment before you begin the security exercises.

The template provisions the AKS cluster, virtual network, and Azure Container Registry required for the lab. A container image is then imported into the registry so that you can work with a realistic container workload during the exercise.

Think of the flow as:

Deployment Template → AKS + ACR Environment → Container Image → Security Controls → Validation

Important: The deployment template prepares the environment. The actual security configuration—Defender for Containers, RBAC, registry access controls, and network restrictions—is performed by you during the lab.

The Security Story

This lab demonstrates multiple layers of container security:

Defender for Containers → Monitor & Detect
ACR Vulnerability Visibility → Identify Image Risks
RBAC → Control Who Can Pull/Push Images
Network Restrictions → Reduce Registry Exposure

The key takeaway is that securing containers is not only about securing the running workload. The container image, registry, identity, and network all need protection.

Lab Resources & Practice

The lab instructions and supporting resources are based on the publicly available Microsoft Learning lab resources:

MicrosoftLearning – Security Identity Labs

Recommended approach:

1. Review the lab scenario and identified security gaps.

2. Study the deployment-template visual provided with this lecture.

3. Deploy the template and wait for the AKS environment to complete.

4. Import/verify the container image as instructed.

5. Follow the security exercises step by step.

6. Verify each security control after configuring it.

7. Use the demo video as a reference if you get stuck.

8. Repeat the lab independently to build confidence.

Don't just watch the demo — practise the lab yourself. The goal is to understand how identity, registry, network, and workload security controls work together to protect containerized applications.

Azure Cost Notice: This lab creates Azure resources, including AKS and other services that may incur charges. Monitor your Azure usage and delete the resources after completing the lab if they are no longer required.

Estimated duration: 45 minutes.

Learn how to configure Microsoft Security Copilot and use AI-powered assistance to support security investigation, analysis, and response.

Learn how to identify security gaps, assess cloud security posture, and improve protection using Microsoft Defender for Cloud.

Learn how to configure Microsoft Sentinel, collect security data, and prepare security events for monitoring and threat detection.

Lab 4D — Explore Defender for Cloud Security Posture and CSPM

Practice Lab: Assess Cloud Security Posture with Defender CSPM

In this lab, you will explore how Microsoft Defender for Cloud and Defender CSPM help security teams assess, prioritize, and improve cloud security posture.

You will practise:

• Reviewing Secure Score and security recommendations

• Assessing security posture against NIST SP 800-53 Rev. 5

• Exploring secret-scanning findings and understanding secure Key Vault usage

• Investigating attack paths and potential blast radius

• Assigning governance ownership and remediation timelines

• Reviewing optional multicloud security coverage

The lab demonstrates the complete CSPM workflow:

Assess → Prioritize → Investigate → Assign → Remediate

Because Defender posture data is generated asynchronously and may take 24 hours or longer, the lab supports both live-result and guided-review paths. You can therefore understand the workflow even when live findings are not yet available.

Estimated time: 75 minutes.