SC-500 Implementing End-to-End Security Controls for Cloud and AI Workloads

What's inside

Chapters

1. Microsoft Entra ID: Privileged Identity Management, Conditional Access and authentication
2. Application identities, consent and managed identities
3. Azure Key Vault
4. Governance: Azure Policy, roles, locks and backup protection
5. Securing Azure Storage
6. Securing Azure SQL and open-source databases
7. Network security: NSGs, ASGs, Virtual Network Manager and Network Watcher
8. Private and hybrid access: Virtual WAN, VPN, Entra Private Access and Private Link
9. Azure Firewall
10. Securing servers and virtual machines
11. Securing containers: Defender for Containers, AKS, ACR, ACI and Container Apps
12. Securing App Service, Functions, Logic Apps, WAF and API Management
13. Securing AI workloads and agents
14. Managing security posture with Microsoft Defender for Cloud
15. Microsoft Sentinel: collection, automation and retention
16. Microsoft Security Copilot

Plus an appendix glossary of 800+ terms, each linked to Microsoft Learn, and free online for print readers.

Sample diagrams

Free study notes

Some sections of the book, free to read online:

• Privileged Identity Management: eligible vs active assignments and role settings

  How PIM activation, approval, maximum duration and notifications work, and what each role setting controls.

• Conditional Access policies: assignments, conditions and grant controls

  How a Conditional Access policy is built and how multiple policies combine.

• Key Vault access: control plane vs data plane, RBAC vs access policies

  Why control-plane roles can't read secrets, and which Key Vault role or access policy each task needs.

• Azure Policy effects and remediation tasks

  What Deny, Audit, Append, Modify and DeployIfNotExists do, and when you need a remediation task and managed identity.

• Choosing a storage authorisation method: keys, SAS types and Microsoft Entra ID

  Account keys, account and service SAS, user delegation SAS and Entra RBAC compared by scope and revocability.

• Always Encrypted, TDE and dynamic data masking compared

  Where each Azure SQL data protection feature works and who it protects data from.

• Azure Virtual Network Manager security admin rules and NSGs

  How security admin rules are evaluated before NSGs, and when to use Allow, Deny or Always allow.

• Just-in-time VM access in Defender for Cloud

  How JIT locks management ports and opens them on request, with the plan and permissions it needs.