appendix

Appendix & Exam Index

Appendix — Cross-Reference & Exam Index

This is the connective tissue for the whole vault, referenced from 00-Strategy-and-Map and from every unit’s Full guide. It has three parts:

  1. Glossary — the key terms used across all units, defined once.
  2. Exam-objective coverage map — every AZ-500 (78) and SC-100 (81) objective mapped to the one unit that owns it.
  3. Consolidated authoritative references — the deduplicated Microsoft Learn + external source list from all units.

The seven units, in study order:

A. Glossary of key terms

Terms are grouped by the unit that owns the concept. Each entry links back to its host unit.

Identity & access — Unit 1 — Identity, Access & Privileged Access

  • Azure RBAC — The authorization system for Azure resources (VMs, storage, Key Vault). A role assignment binds a security principal + role definition + scope; scope nests management group → subscription → resource group → resource and inherits downward. Stored in Azure Resource Manager.
  • Microsoft Entra roles — The authorization system for directory objects (users, groups, app registrations, Conditional Access). Tenant-wide by default; some scopable to an administrative unit or app. Stored in Microsoft Entra ID. Distinct from Azure RBAC — the single most-tested identity distinction.
  • NotActions / NotDataActions — Subtraction from a wildcard within one role definition, not deny rules; a second assignment granting the action still wins. True deny requires Azure deny assignments.
  • User Access Administrator (UAA) — Azure role that grants access only (role assignments), no resource operations. RBAC Administrator is the constrained least-privilege delegation variant; Owner is full control plus grant.
  • PIM (Privileged Identity Management) — Just-in-time, time-bound, audited privilege. Requires Entra ID P2 or Entra ID Governance. Converts eligible (must activate) assignments into temporary active rights gated by MFA, justification, time limit, and optional approval. Goal: zero standing active privilege except break-glass.
  • Eligible vs Active assignment — Eligible = the user must activate before privileges apply; Active = privileges apply immediately. Combined with time bounds this yields four shapes (perm-eligible, perm-active, time-bound eligible, time-bound active).
  • PIM for Groups — Makes group membership/ownership eligible, indirectly gating any access the group confers. For an Azure role assigned to such a group, the user activates the group first, then the role.
  • Break-glass account — Two cloud-only emergency Global Administrator accounts, permanently active, excluded from Conditional Access and PIM, with split offline credentials, so a misconfiguration can’t lock you out.
  • Conditional Access (CA) — Microsoft’s Zero Trust policy engine: if-then rules evaluated after first-factor authentication. Requires Entra ID P1. Signals include user/group, location, device state, app, and real-time risk; controls include block, require MFA, require authentication strength, require compliant device.
  • Authentication strength — A named set of allowed methods in a CA grant control (e.g. phishing-resistant MFA = FIDO2 / Windows Hello / certificate).
  • Continuous Access Evaluation (CAE) — Near-real-time token revocation: Entra pushes critical events (account disable/delete, password reset, MFA enabled, admin revocation, Entra ID Protection high risk) to resource APIs. CAE-aware tokens carry a 24-hour lifetime for resilience instead of the standard 60–90 minutes.
  • Protected actions — A CA authentication-context requirement wrapped around the highest-impact Entra operations (e.g. editing CA policies, editing cross-tenant access), so a stolen admin token can’t dismantle the controls.
  • Security defaults — Free, all-or-nothing baseline MFA for tenants without P1; mutually exclusive with CA policies.
  • Application object (app registration) — The global application template in its home tenant: declares scopes, app roles, redirect URIs, the Application ID URI, and credentials. One per application.
  • Service principal — The local instance of an application within a tenant; the concrete identity that receives role assignments and consent. The Enterprise applications blade is the SP view; App registrations is the application-object view.
  • Managed identity — A service principal whose credentials Azure manages (no secret in code). System-assigned = 1:1 with one resource, shares its lifecycle; user-assigned = standalone, reusable across resources. Tokens are obtained from the Instance Metadata Service (IMDS).
  • Workload identity federation (FIC) — OIDC trust that lets an external workload (GitHub Actions, Kubernetes, AWS, GCP) exchange its own IdP token for an Entra token — no stored secret. A federated credential is set on a user-assigned managed identity or app registration (not a system-assigned MI); default audience api://AzureADTokenExchange.
  • Delegated permission (scope) — Permission used on behalf of a signed-in user; bounded by both the granted scope and the user’s own rights. Recorded as an oauth2PermissionGrant.
  • Application permission (app role) — App-only permission used by daemons with no user; bounded only by the permission and always requires admin consent. Recorded as an appRoleAssignment.
  • Consent phishing (illicit consent grant) — Attack where a user is tricked into consenting to a malicious app, granting durable token-based access that survives password resets. Mitigated by restricting user consent, the admin consent workflow, publisher verification, and OAuth-grant audits.
  • B2B collaboration — Inviting external users as guest objects in your workforce tenant. B2B direct connect is a mutual trust with no guest object (e.g. Teams shared channels). Microsoft Entra External ID in external tenants is the CIAM successor to Azure AD B2C.
  • Cross-tenant access settings — Govern B2B inbound/outbound, including trusting MFA and device claims from a partner so guests aren’t re-challenged.
  • Microsoft Entra Verified ID — Decentralized identity: issue and verify holder-controlled verifiable credentials.
  • Enterprise access model — Successor to the legacy AD tier model. Tier 0 = control plane; former Tier 1 splits into management plane + data/workload plane; former Tier 2 into user access + app access. Lower planes never control higher planes.
  • Privileged Access Workstation (PAW) — A dedicated, hardened device used only for administration — the single trusted entry point to the control plane (Credential/Device/Exploit Guard, AppLocker, BitLocker, deny-default web).
  • CIEM (Cloud Infrastructure Entitlement Management) — Least-privilege analysis of human and workload identities across clouds. Currency note: standalone Microsoft Entra Permissions Management was retired October 1, 2025; CIEM now lives in Microsoft Defender for Cloud (Defender CSPM plan) across Azure/AWS/GCP.

Data, storage & key management — Unit 3 — Data, Storage & Key Management

  • Key Vault management vs data plane — Management plane (Azure RBAC) governs the vault resource (create/delete, networking, permission model); data plane (Azure RBAC or vault access policy) governs reading/using keys, secrets, and certs. RBAC is recommended (object-scoped, central, PIM-able, supports deny).
  • Key Vault tiers — Standard (software keys), Premium (HSM-backed keys, FIPS 140-2 Level 2), Managed HSM (single-tenant, FIPS 140-2 Level 3, you own the Security Domain).
  • Soft-delete (Key Vault) — Always on, cannot be disabled; retention 7–90 days (default 90). Purge protection is optional and, once enabled, irreversible — nobody (including Microsoft) can purge before retention elapses; defends against malicious key destruction.
  • SSE (Storage Service Encryption) — Always-on 256-bit AES encryption at rest for storage, Microsoft-managed key by default.
  • CMK / BYOK — Customer-managed key in Key Vault/Managed HSM that adds key custody; revoking it cuts access. BYOK specifically imports an externally generated HSM key for use as the CMK.
  • Infrastructure (double) encryption — A second encryption layer with a separate Microsoft-managed key and algorithm; must be enabled at account/scope creation, immutable thereafter.
  • SAS (Shared Access Signature) — Delegated storage access. Account SAS and Service SAS are signed by the account key (hard to revoke); the user delegation SAS (Blob only, recommended) is signed by an Entra-issued key and revoked by revoking that key.
  • allowSharedKeyAccess=false — Rejects all Shared-Key-authorized requests (account/service SAS); user-delegation SAS and Entra ID still work. Prerequisite for applying Conditional Access to a storage account.
  • Immutable storage (WORM) — Write-Once-Read-Many. Time-based retention (1 day–400 years; lockable for SEC 17a-4(f)) vs legal hold. Container-level WORM needs no prerequisite; version-level WORM requires versioning.
  • TDE (Transparent Data Encryption) — Whole-database encryption at rest, on by default for new Azure SQL; transparent, protects files/backups, but does not protect from a DBA querying normally. Customer-managed TDE puts the TDE Protector in Key Vault.
  • Always Encrypted (AE) — Column-level encryption where keys (Column Master Key → Column Encryption Key) are never seen by the SQL engine, protecting from privileged users including DBAs. Deterministic (equality/join, leaks patterns) vs Randomized (stronger). Secure enclaves (VBS software / Intel SGX hardware) enable rich operations on encrypted columns.
  • Dynamic Data Masking (DDM) — Obfuscates fields in the result set only; not a security boundary (bypassable by direct query; admins always see plaintext).
  • Defender for Storage — Agentless workload protection: activity monitoring, malware scanning on upload, sensitive-data threat detection, and detection of abused/leaked SAS (“entities without identities”).
  • Defender for Databases — Workload protection for Azure SQL, SQL-on-machines, OSS (PostgreSQL/MySQL/MariaDB), and Cosmos DB (NoSQL API only) — SQLi, anomalous access, exfiltration.

Networking — Unit 2 — Secure Networking & Edge Protection

  • WAF (Web Application Firewall) — L7 firewall protecting against OWASP Top 10. Hosted on Application Gateway (regional) or Azure Front Door (global). Runs in Detection (log) or Prevention (block) mode. Not to be confused with WAF the Well-Architected Framework — see Unit 7 — Capstone: Apps, M365 Data Protection & Strategy.
  • Private Endpoint / Private Link — A private IP in your VNet for a PaaS service, removing public exposure.
  • Microsoft Entra Internet Access — Secure web gateway (SWG) component of Security Service Edge (SSE).
  • Microsoft Entra Private Access — Zero-Trust private-application access (ZTNA) component of SSE, replacing legacy VPN for app access.

Compute, containers & endpoints — Unit 4 — Secure Compute, Containers & Endpoint Baselines

  • Azure Bastion — Managed PaaS jump host providing RDP/SSH over TLS 443 with no public IP on the target VM. Deploys into a subnet named exactly AzureBastionSubnet.
  • Just-in-time (JIT) VM access — Defender for Cloud feature (requires Defender for Servers Plan 2) that keeps management ports closed until a time-boxed, RBAC-approved request opens one from the requester’s source IP. Bastion governs the path; JIT governs the window.
  • SSE (disk, always on) — Encrypts OS/data disks at rest but not temp disks/caches, so Defender for Cloud reports the VM Unhealthy for disk encryption.
  • Encryption at host — Extends encryption to temp disks, caches, and the compute↔storage flow at no CPU cost; Defender reports Healthy. Recommended for new VMs.
  • Azure Disk Encryption (ADE) — In-guest BitLocker (Windows) / dm-crypt (Linux) with a KEK in Key Vault; consumes VM CPU. Retiring September 15, 2028 — do not design new workloads on it.
  • Confidential disk encryption — Binds OS-disk keys to the VM’s vTPM on confidential VM SKUs (DCasv5/ECasv5); the control when the host/hypervisor operator is outside the trust boundary.
  • Disk Encryption Set (DES) — The resource that references a Key Vault Premium / Managed HSM key to provide CMK for SSE, encryption at host, and confidential disk encryption.
  • AKS local accounts — A built-in cluster-admin certificate that bypasses Entra; disable in production (--disable-local-accounts) and enforce via Azure Policy. Re-enabling them is the break-glass path during an Entra outage.
  • Microsoft Entra Workload ID (AKS) — OIDC federation letting pods authenticate to Azure resources without secrets; replaces the deprecated pod-managed identity.
  • ACR admin account — A single shared registry credential, disabled by default; keep it off and use Entra RBAC / managed-identity pulls instead.
  • ACR ABAC mode — In “RBAC Registry + ABAC Repository Permissions” mode, AcrPull/AcrPush/AcrDelete are not honored; use Container Registry Repository Reader/Writer/Contributor (with optional per-repository ABAC conditions).
  • Windows LAPS — Automatically generates, rotates, and backs up the built-in local administrator password (unique per device), defeating pass-the-hash/lateral movement. Backs up to Entra ID (RBAC-secured) or Active Directory (ACL-secured); configured via Intune or Group Policy.
  • Microsoft Defender for IoT — Agentless, passive network monitoring (SPAN/TAP) for OT/ICS asset discovery and anomaly detection; integrates with Sentinel. The designated SC-100 OT/ICS solution.
  • Defender for Containers — Workload protection for Kubernetes environments only — AKS, EKS, GKE, and Azure Arc-enabled Kubernetes (runtime threat detection, Kubernetes hardening, and image vulnerability assessment via Microsoft Defender Vulnerability Management). It does not protect Azure Container Instances (ACI) or Azure Container Apps (ACA) as runtime environments; container images are scanned only at the registry (ACR) level.

Posture, governance & compliance — Unit 5 — Posture, Governance, Multicloud & Compliance

  • Azure Policy — Governance engine that audits/denies/modifies/deploys to enforce rules across resources; initiatives group policies for compliance baselines.
  • Defender for Cloud Secure Score — Posture metric for Azure resource security. Distinct from the M365 Secure Score (productivity workloads, Unit 7 — Capstone: Apps, M365 Data Protection & Strategy) — a common distractor.
  • CSPM / CWPP — Cloud Security Posture Management (recommendations/Secure Score, with the Defender CSPM plan adding attack paths, Cloud Security Explorer, and CIEM) vs Cloud Workload Protection Platforms (the Defender for Servers/Storage/Databases/Containers plans).
  • Microsoft Defender Vulnerability Management (MDVM) — Vulnerability assessment for VMs, images, and workloads, powering Defender for Servers and Defender for Containers scanning.
  • Defender EASM (External Attack Surface Management) — Discovers and maps internet-facing assets from the attacker’s outside-in perspective.
  • Microsoft Security Exposure Management — Posture process surfacing attack paths, attack-surface reduction, security insights, and initiatives (including the Zero Trust initiative).
  • Azure Arc — Projects non-Azure and on-prem machines into Azure for unified policy, Defender, and monitoring.
  • MCSB (Microsoft cloud security benchmark) — The canonical, prescriptive control set, cloud-agnostic, mapped to CIS/NIST 800-53/PCI-DSS; the default standard in Defender for Cloud’s Regulatory Compliance dashboard. v1 has 12 domains; v2 (preview) adds an Artificial Intelligence Security domain.
  • Microsoft Purview — Data governance and compliance suite: sensitivity labels, DLP, retention, eDiscovery, Audit, Insider Risk Management.
  • Microsoft Priva — Privacy-risk management addressing data-privacy requirements.

Security operations — Unit 6 — Security Operations: Sentinel, Defender XDR, SOAR

  • Microsoft Sentinel — Cloud-native SIEM + SOAR built on a Log Analytics workspace (LAW); one Sentinel instance per LAW.
  • Microsoft Defender XDR — The XDR layer correlating Microsoft first-party endpoint/identity/email/SaaS/cloud signals into cross-domain incidents with automated investigation & response (AIR).
  • Unified security operations (Defender portal) — Onboarding the Sentinel workspace into the Defender portal. Workspaces first onboarded after July 1, 2025 by a subscription Owner/User Access Administrator are auto-onboarded. Azure-portal Sentinel retires March 31, 2027.
  • Data Collection Rule (DCR) — Azure Monitor resource defining what to collect, an optional ingestion-time KQL transformation (pre-billing — cuts cost and strips PII), and where to send it. The Azure Monitor Agent (AMA) (which replaced the retired MMA, August 31, 2024) is governed by DCRs.
  • Analytics rule — Detection logic in Sentinel. Scheduled (KQL + lookback) is the workhorse; NRT runs ~every minute; Anomaly writes to the Anomalies table (no alerts); Fusion correlates many low-fidelity alerts into multistage incidents; Microsoft security turns other MS alerts into incidents. Fusion and Microsoft-security rules auto-disable under the Defender portal (XDR owns incident creation).
  • Automation rule — Sentinel’s central orchestrator: triggers on incident create/update or alert create; can tag/assign/close/add-tasks/run-playbooks in order without code.
  • Playbook — An Azure Logic Apps workflow performing the actual response (isolate device, disable user, ticket). The Sentinel service account needs Microsoft Sentinel Automation Contributor on the playbook’s resource group to run it.
  • MITRE ATT&CK — The adversary tactics/techniques knowledge base; matrices Enterprise, Mobile, ICS. Sentinel’s MITRE page (aligned to ATT&CK v18) shows current coverage (active rules) and simulated coverage (available templates).
  • Microsoft Purview Audit — The M365 audit-log backbone. Standard gives baseline logging; Premium adds longer retention and intelligent insights such as MailItemsAccessed (essential for BEC forensics).

Apps, M365 & strategy — Unit 7 — Capstone: Apps, M365 Data Protection & Strategy

  • Azure API Management (APIM) — Managed API gateway applying security policies (validate-jwt, validate-azure-ad-token, ip-filter) at inbound/backend/outbound stages. Subscription keys are weak alone — use OAuth in addition; they have no built-in expiry/rotation. Deploy WAF upstream and have the backend re-validate tokens (defense in depth).
  • Defender for Office 365 — Email/collaboration protection: Safe Links, Safe Attachments, anti-phishing (P2 adds Threat Explorer, AIR, Attack Simulation).
  • Defender for Cloud Apps (MDCA) — CASB: Shadow IT discovery, OAuth app governance, real-time session policies via Conditional Access App Control.
  • Microsoft Intune — Device/app management (compliance policies, configuration profiles, app protection/MAM); compliance state feeds Conditional Access.
  • Microsoft 365 Copilot data controls — Copilot operates within the M365 service boundary and honors existing permissions; for encrypted content the user must have EXTRACT and VIEW usage rights. Generated content inherits the highest-priority (most restrictive) source label. Oversharing is the #1 risk. DLP for Copilot and Endpoint DLP add guardrails.
  • STRIDE — Threat-modeling framework: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.
  • DevSecOps (Defender for Cloud DevOps Security) — Connects GitHub / Azure DevOps / GitLab for in-pipeline code, secret, and IaC scanning.
  • MCRA (Microsoft Cybersecurity Reference Architectures) — Technical reference architectures (updated April 2025), part of the Security Adoption Framework (SAF). MCRA = what the architecture looks like; MCSB = which controls you must meet.
  • CAF (Cloud Adoption Framework) — Organizational/process adoption lifecycle (Strategy → Plan → Ready → Adopt → Govern → Manage); hosts Azure landing zones (management-group hierarchy, policy guardrails, hub-spoke, identity/management/connectivity subscriptions).
  • WAF (Well-Architected Framework) — Workload-level design across five pillars: Reliability, Security, Cost Optimization, Operational Excellence, Performance Efficiency. Not the Web Application Firewall.
  • Zero Trust — Principles: verify explicitly, use least-privilege access, assume breach.
  • RaMP (Rapid Modernization Plan) — The project-management layer of Zero Trust: prioritized quick-win checklists. Two distinct RaMPs exist — the Zero Trust RaMP (access) and the Privileged Access RaMP.
  • BCDR — Business Continuity & Disaster Recovery. Azure Site Recovery (ASR) = replication/failover (DR ≠ backup); Azure Backup immutable vault + soft delete + multi-user authorization (MUA) protect recovery points. Ransomware priority order: (1) secure backups → (2) privileged access → (3) the rest.

B. Exam-objective coverage map

Every objective is assigned to exactly one unit (verified: 78 AZ-500 + 81 SC-100 = 159, zero omissions, zero duplicates). The recurring pattern: AZ-500 = operate/configure; SC-100 = design/evaluate the same surface.

Per-unit counts

UnitAZ-500SC-100
Unit 1 — Identity1114
Unit 2 — Networking214
Unit 3 — Data/Key Vault177
Unit 4 — Compute/Containers811
Unit 5 — Posture/Governance1412
Unit 6 — SecOps66
Unit 7 — Capstone127
Total7881

AZ-500 objective → unit

Unit 1 — Identity, Access & Privileged Access (11)

  • Manage Azure built-in role assignments
  • Manage custom roles, including Azure roles and Microsoft Entra roles
  • Plan and manage Azure resources in Microsoft Entra Privileged Identity Management (PIM), including settings and assignments
  • Implement multi-factor authentication (MFA) for access to Azure resources
  • Implement Conditional Access policies for cloud resources in Azure
  • Manage access to enterprise applications in Microsoft Entra ID, including OAuth permission grants
  • Manage Microsoft Entra app registrations
  • Configure app registration permission scopes
  • Manage app registration permission consent
  • Manage and use service principals
  • Manage managed identities

Unit 2 — Secure Networking & Edge Protection (21)

  • Plan and implement Network Security Groups (NSGs) and Application Security Groups (ASGs)
  • Manage virtual networks by using Azure Virtual Network Manager
  • Plan and implement user-defined routes (UDRs)
  • Plan and implement Virtual Network peering or VPN gateway
  • Plan and implement Virtual WAN, including secured virtual hub
  • Secure VPN connectivity, including point-to-site and site-to-site
  • Implement encryption over ExpressRoute
  • Configure firewall settings on Azure resources
  • Monitor network security by using Network Watcher
  • Plan and implement virtual network Service Endpoints
  • Plan and implement Private Endpoints
  • Plan and implement Private Link services
  • Plan and implement network integration for Azure App Service and Azure Functions
  • Plan and implement network security configurations for an App Service Environment (ASE)
  • Plan and implement network security configurations for an Azure SQL Managed Instance
  • Plan and implement Transport Layer Security (TLS) to applications, including Azure App Service and API Management
  • Plan, implement, and manage an Azure Firewall, including Azure Firewall Manager and firewall policies
  • Plan and implement an Azure Application Gateway
  • Plan and implement an Azure Front Door, including Content Delivery Network (CDN)
  • Plan and implement a Web Application Firewall (WAF)
  • Recommend when to use Azure DDoS Protection Standard

Unit 3 — Data, Storage & Key Management (17)

  • Configure access control for storage accounts
  • Manage storage account access keys
  • Select and configure an appropriate method for access to Azure Files
  • Select and configure an appropriate method for access to Azure Blob Storage
  • Select and configure appropriate methods for protecting against data security threats, including soft delete, backups, versioning, and immutable storage
  • Configure Bring your own key (BYOK)
  • Enable double encryption at the Azure Storage infrastructure level
  • Enable Microsoft Entra database authentication
  • Enable database auditing
  • Plan and implement dynamic masking
  • Implement Transparent Data Encryption (TDE)
  • Recommend when to use Azure SQL Database Always Encrypted
  • Configure Azure Key Vault network settings
  • Configure access to Key Vault, including vault access policies and Azure RBAC
  • Manage certificates, secrets, and keys in Key Vault
  • Configure key rotation
  • Perform backup and recovery of certificates, secrets, and keys

Unit 4 — Secure Compute, Containers & Endpoint Baselines (8)

  • Plan and implement remote access to virtual machines, including Azure Bastion and just-in-time (JIT) VM access
  • Configure network isolation for Azure Kubernetes Service (AKS)
  • Secure and monitor AKS
  • Configure authentication for AKS
  • Configure security monitoring for Azure Container Instances (ACIs)
  • Configure security monitoring for Azure Container Apps (ACAs)
  • Manage access to Azure Container Registry (ACR)
  • Configure disk encryption, including Azure Disk Encryption (ADE), encryption at host, and confidential disk encryption

Unit 5 — Posture, Governance, Multicloud & Compliance (14)

  • Create, assign, and interpret policies and initiatives in Azure Policy
  • Implement security controls to protect backups
  • Implement security controls for asset management
  • Identify and remediate security risks by using the Microsoft Defender for Cloud Secure Score and Inventory
  • Assess compliance against security frameworks by using Microsoft Defender for Cloud
  • Manage compliance standards in Microsoft Defender for Cloud
  • Add custom standards to Microsoft Defender for Cloud
  • Connect hybrid cloud and multi-cloud environments to Microsoft Defender for Cloud, including AWS and GCP
  • Implement and use Microsoft Defender External Attack Surface Management (EASM)
  • Enable cloud workload protection plans in Microsoft Defender for Cloud
  • Configure Microsoft Defender for Servers, Microsoft Defender for Databases, and Microsoft Defender for Storage
  • Implement and manage agentless scanning for virtual machines in Microsoft Defender for Servers
  • Implement and manage Microsoft Defender Vulnerability Management for Azure virtual machines
  • Connect to and configure settings in Microsoft Defender for Cloud DevOps Security, including GitHub, Azure DevOps, and GitLab

Unit 6 — Security Operations: Sentinel, Defender XDR, SOAR (6)

  • Manage and respond to security alerts in Microsoft Defender for Cloud
  • Configure workflow automation by using Microsoft Defender for Cloud
  • Monitor network security events and performance data by configuring data collection rules (DCRs) in Azure Monitor
  • Configure data connectors in Microsoft Sentinel
  • Enable analytics rules in Microsoft Sentinel
  • Configure automation in Microsoft Sentinel

Unit 7 — Capstone: Apps, M365 Data Protection & Strategy (1)

  • Recommend security configurations for Azure API Management

SC-100 objective → unit

Unit 1 — Identity, Access & Privileged Access (14)

  • Design a solution for access to SaaS, PaaS, IaaS, hybrid/on-premises, and multicloud resources, including identity, networking, and application controls
  • Design a solution for Microsoft Entra ID, including hybrid and multi-cloud environments
  • Design a solution for external identities, including B2B and decentralized identity
  • Design a modern authentication and authorization strategy, including Conditional Access, continuous access evaluation, risk scoring, and protected actions
  • Validate the alignment of Conditional Access policies with a Zero Trust strategy
  • Specify requirements to harden Active Directory Domain Services (AD DS)
  • Design a solution for assigning and delegating privileged roles by using the enterprise access model
  • Evaluate the security and governance of Microsoft Entra ID, including PIM, entitlement management, and access reviews
  • Evaluate the security and governance of AD DS, including resilience to common attacks
  • Design a solution for securing the administration of cloud tenants, including SaaS and multicloud infrastructure
  • Design a solution for cloud infrastructure entitlement management
  • Evaluate an access review management solution
  • Design a solution for secure workstations for privileged access, including remote access
  • Design a solution for workload identities to authenticate and access Azure resources

Unit 2 — Secure Networking & Edge Protection (4)

  • Evaluate network designs to align with security requirements and best practices
  • Evaluate solutions that use Microsoft Entra Internet Access as a secure web gateway
  • Evaluate solutions that use Microsoft Entra Internet Access for Microsoft Services, including cross-tenant configurations
  • Evaluate solutions that use Microsoft Entra Private Access

Unit 3 — Data, Storage & Key Management (7)

  • Design a solution to manage secrets, keys, and certificates
  • Evaluate solutions for data discovery and classification
  • Specify priorities for mitigating threats to data
  • Evaluate solutions for encryption of data at rest and in transit, including Azure Key Vault and infrastructure encryption
  • Design a security solution for data in Azure workloads, including Azure SQL, Azure Synapse Analytics, and Azure Cosmos DB
  • Design a security solution for data in Azure Storage
  • Design a security solution that includes Microsoft Defender for Storage and Microsoft Defender for Databases

Unit 4 — Secure Compute, Containers & Endpoint Baselines (11)

  • Specify security requirements for servers, including multiple platforms and operating systems
  • Specify security requirements for mobile devices and clients, including endpoint protection, hardening, and configuration
  • Specify security requirements for IoT devices and embedded systems
  • Evaluate solutions for securing OT and ICS by using Microsoft Defender for IoT
  • Specify security baselines for server and client endpoints
  • Evaluate Windows Local Administrator Password Solution (Windows LAPS)
  • Specify security baselines for SaaS, PaaS, and IaaS services
  • Specify security requirements for IoT workloads
  • Specify security requirements for containers
  • Specify security requirements for container orchestration
  • Evaluate solutions that include Azure AI services security

Unit 5 — Posture, Governance, Multicloud & Compliance (12)

  • Evaluate security posture by using Microsoft Defender for Cloud, including the MCSB
  • Evaluate security posture by using Microsoft Secure Score
  • Design integrated security posture management solutions that include Microsoft Defender for Cloud in hybrid and multi-cloud environments
  • Select cloud workload protection solutions in Microsoft Defender for Cloud
  • Design a solution for integrating hybrid and multicloud environments by using Azure Arc
  • Design a solution for Microsoft Defender External Attack Surface Management (Defender EASM)
  • Specify requirements and priorities for a posture management process that uses Microsoft Security Exposure Management attack paths, attack surface reduction, security insights, and initiatives
  • Design Azure Policy solutions to address security and compliance requirements
  • Evaluate and validate alignment with regulatory standards and benchmarks by using Microsoft Defender for Cloud
  • Translate compliance requirements into security controls
  • Design a solution to address compliance requirements by using Microsoft Purview
  • Design a solution to address privacy requirements, including Microsoft Priva

Unit 6 — Security Operations: Sentinel, Defender XDR, SOAR (6)

  • Design a solution for detection and response that includes XDR and SIEM
  • Design a solution for centralized logging and auditing, including Microsoft Purview Audit
  • Design monitoring to support hybrid and multicloud environments
  • Design a solution for security orchestration and automated response (SOAR), including Microsoft Sentinel and Microsoft Defender XDR
  • Design and evaluate security workflows, including incident response, threat hunting, and incident management
  • Design and evaluate threat detection coverage by using MITRE ATT&CK matrices, including Enterprise, Mobile, and ICS

Unit 7 — Capstone: Apps, M365 Data Protection & Strategy (27)

  • Evaluate security posture for productivity and collaboration workloads by using metrics, including Microsoft Secure Score
  • Evaluate solutions that include Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps
  • Evaluate device management solutions that include Microsoft Intune
  • Evaluate solutions for securing data in Microsoft 365 by using Microsoft Purview
  • Evaluate data security and compliance controls in Microsoft Copilot for Microsoft 365 services
  • Evaluate the security posture of existing application portfolios
  • Evaluate threats to business-critical applications by using threat modeling
  • Design and implement a full lifecycle strategy for application security
  • Design and implement standards and practices for securing the application development process
  • Map technologies to application security requirements
  • Design a solution for API management and security
  • Design solutions that secure applications by using Azure Web Application Firewall (WAF)
  • Specify security requirements for web workloads
  • Design a resiliency strategy for ransomware and other attacks based on Microsoft Security Best Practices
  • Design a security strategy to support business resiliency goals, including identifying and prioritizing threats to business-critical assets
  • Design solutions for business continuity and disaster recovery (BCDR), including secure backup and restore for hybrid and multicloud environments
  • Design solutions for mitigating ransomware attacks, including prioritization of BCDR and privileged access
  • Evaluate solutions for security updates
  • Design solutions that align with the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft cloud security benchmark (MCSB)
  • Design solutions that align with best practices for cybersecurity capabilities and controls
  • Design solutions that align with best practices for protecting against insider, external, and supply chain attacks
  • Design solutions that align with best practices for Zero Trust security, including A Rapid Modernization Plan for Zero Trust (RaMP)
  • Design solutions that align with the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework (WAF)
  • Design a new or evaluate an existing strategy for security and governance based on CAF and WAF
  • Recommend solutions for security and governance based on CAF and WAF
  • Design solutions for implementing and governing security by using Azure landing zones
  • Design a DevSecOps process that aligns with best practices in the Microsoft Cloud Adoption Framework for Azure (CAF)

C. Consolidated authoritative references

Deduplicated across all units. The two official study guides are listed once each (URL variants normalized to the canonical learn.microsoft.com/credentials/... form).

Official exam study guides

Identity & access — Unit 1 — Identity, Access & Privileged Access

Data, storage & key management — Unit 3 — Data, Storage & Key Management

Compute, containers & endpoints — Unit 4 — Secure Compute, Containers & Endpoint Baselines

Security operations — Unit 6 — Security Operations: Sentinel, Defender XDR, SOAR

Apps, M365 & strategy — Unit 7 — Capstone: Apps, M365 Data Protection & Strategy