SC-500 cheat sheet — every exam topic on one page

Manage identity, access, and governance

SC-500 Microsoft Entra ID Access: PIM, Conditional Access, MFA, App Identity and Managed Identities

• Eligible vs active decides standing access; permanent vs time-bound decides when the assignment ends. Break-glass accounts are the one deliberate permanent-active exception.
• PIM activation maximum duration caps each elevation; an authentication context on activation (not the plain MFA checkbox) forces a specific strength such as phishing-resistant MFA.
• When a group carries the access, make group membership eligible with PIM for Groups; Azure subscription roles get PIM for Azure resources.
• Report-only measures a policy against real sign-ins; What If simulates one sign-in that hasn't happened. Exclude emergency access accounts from broad policies.
• Legacy authentication = Exchange ActiveSync and other clients; office IP ranges become a trusted named location reusable by every policy.
• Methods are enabled in the Authentication methods policy and required by Conditional Access authentication strengths; exact method lists need a custom strength.
• Windows Hello for Business is phishing-resistant but bound to one PC; passkeys on a key or in Authenticator travel with the user; smart cards without AD FS mean Entra CBA.
• App registration = what the app is (home tenant); enterprise application = who may use it here. Assignment required restricts sign-in, Visible to users only hides the tile, and nested groups aren't honoured.
• Changing consent settings never revokes existing grants: disable the app's sign-in and delete the grant.
• A managed identity's token is only authentication: the target still needs an RBAC role or a data-plane user. Use user-assigned when access must be shared or granted in advance.

Secure Secrets and Keys with Azure Key Vault (SC-500)

• Standard vaults protect keys in software; Premium adds multitenant HSM-protected keys and BYOK; Managed HSM is single-tenant with a customer-held security domain but stores keys only; Azure Cloud HSM is an IaaS HSM cluster that does not serve Azure service CMKs.
• Soft delete retention (7–90 days) is fixed at vault creation; purge protection is irreversible and blocks purging, not recovery; CMK integrations such as Azure Storage require both.
• Recovering a deleted vault restores its objects and properties but not its Azure RBAC role assignments or Event Grid subscriptions.
• Key Vault Contributor manages the vault (control plane) and gives no access to secret values; data-plane reads appear in the AuditEvent resource log, not the Activity log.
• Under legacy access policies a Contributor can grant itself data access; Azure RBAC closes that path, switching to it invalidates all access policies, and it is the default for new vaults from API 2026-02-01.
• Use Secrets User to read, Crypto Service Encryption User for CMK wrap/unwrap, Data Access Administrator to delegate Key Vault role assignments only, and a single-secret scope only for a secret shared between apps.
• The firewall filters the data plane only: IP rules take public IPv4 addresses (no private ranges, no service tags), virtual network rules need the Microsoft.KeyVault service endpoint, and the portal's object lists come from the user's own IP.
• A private endpoint plus disabled public access keeps clients off the public endpoint (trusted services still pass unless the bypass is off or Secure by perimeter is used), and clients must resolve through a linked privatelink.vaultcore.azure.net zone, or conditional forwarders to Azure DNS Private Resolver from on-premises.
• Trusted-services bypass covers listed Azure services such as ARM template deployment and Storage CMK — not Azure DevOps or your own app code — survives disabled public access, and never replaces permissions.
• Rotate keys with rotation policies and versionless URIs, rotate secrets with SecretNearExpiry events and a function, auto-renew certificates only from DigiCert, GlobalSign or self-signed issuers, and remediate scanned secrets by rotating them into Key Vault.

SC-500 Azure Governance: Policy, Defender for Cloud Compliance, Locks, RBAC and Backup Security

• Deny fails a non-compliant create or update; modify fixes it so the deployment succeeds; audit only reports; denyAction is the effect that blocks deletes.
• Existing resources are only reported until a remediation task runs; only modify and deployIfNotExists support remediation, and the task runs as the assignment's managed identity, which needs the definition's roleDefinitionIds roles (granted automatically only in the portal).
• Mode Indexed skips resource groups and subscriptions; resource properties enter a rule through aliases; existenceCondition decides which related resource counts for the IfNotExists effects.
• Exclusions stop evaluation for every definition; exemptions keep evaluating, can target single definitions, can expire, and are Waiver (accepted risk) or Mitigated (met another way).
• Microsoft cloud security benchmark is the default standard; extra regulatory standards need a paid Defender plan other than Servers P1 or APIs P1 plus Owner or Policy Contributor, and greyed-out controls are ones that cannot be assessed automatically.
• Multicloud custom recommendations are KQL-based and need Defender CSPM; Azure Policy-based custom recommendations are legacy and Azure-only.
• Locks override roles, act only on the control plane, and are inherited; ReadOnly also blocks POST calls such as listing storage keys; creating locks needs Microsoft.Authorization/locks/*.
• NotActions is not a deny; DataActions roles cannot be assigned at management group scope; defining a custom role needs roleDefinitions/write, which RBAC Administrator lacks; Entra custom roles need P1 or P2.
• Delegate role assignment with Role Based Access Control Administrator plus a condition; right-size with CIEM evidence from Defender CSPM.
• Irreversible backup protection is an immutable vault enabled and locked; MUA approvals grant Backup MUA Operator on a Resource Guard kept in a separate tenant or subscription; deployment stack deny settings, stored at a parent scope, stop even Owners.

Secure storage, databases, and networking

SC-500 Azure Storage Account Security: Firewall, Defender for Storage, Encryption, SAS and Access

• Secure transfer required refuses HTTP and unencrypted SMB; minimum TLS only constrains connections that already use TLS; neither is encryption at rest.
• Disabling Allow Blob anonymous access at the account overrides every container's access level; enforce it at scale with Azure Policy Deny (fail the deployment), Audit (report) or Modify (silently fix).
• Disallowing Shared Key breaks service and account SAS and default portal access to Azure Files, but not Entra ID callers or user delegation SAS; measure with metrics and resource logs first. Conditional Access only protects an account once Shared Key is disallowed.
• Customer-managed keys need a vault with soft delete and purge protection and an identity with Key Vault Crypto Service Encryption User; use a versionless key URI and wait 24 hours after rotation before disabling the old version. Disabling the key cuts off every caller.
• Infrastructure encryption and a container's default encryption scope can only be set at creation; encryption scopes give different keys to different containers in one account.
• Locked time-based retention can be extended but never shortened; a legal hold has no period and needs a tag; resource locks don't protect blob data.
• Point-in-time restore needs blob soft delete, versioning and change feed, a window shorter than soft delete retention, and can't restore deleted containers, which need container soft delete.
• IP rules take only public addresses, not /31 or /32 ranges, and don't see same-region Azure traffic; virtual network rules follow the subnet resource; resource instance rules admit one instance; exceptions survive a switch to Disabled.
• Enable Defender for Storage at subscription level with exclusions, or with the DeployIfNotExists 'Configure Microsoft Defender for Storage to be enabled' policy; malware scan results reach index tags (not tamper-resistant), alerts (malicious only), Event Grid (every result) and Log Analytics.
• User delegation SAS is signed via Entra ID and revoked by revoking user delegation keys; stored access policies work only with service SAS; the SAS expiration action is Log until you set Block.

SC-500 Database Security: Azure SQL Hardening, Auditing and Defender for Databases

• A database-level IP rule (T-SQL only, stored in the database) opens one database; any server-level rule opens every database on the server; virtual network rules match Azure subnets, not internet IPs.
• Allow Azure services (AllowAllWindowsAzureIps, 0.0.0.0) admits every Azure resource in every tenant; replace it with a virtual network rule or private endpoint and turn it off.
• Public network access = Disable rejects every public connection (error 47073) and blocks firewall-rule changes (error 42101); Selected networks lets rules decide.
• Minimum TLS is server-wide, can't return to 'no minimum' once set, and audit client_tls_version_name or connection metrics show which clients would break.
• Entra-only authentication needs an Entra admin first; SQL Security Manager toggles it but can't change the admin, SQL Server Contributor is the reverse; SQL logins stay but can't connect.
• Customer-managed TDE needs soft-delete and purge protection plus get/wrapKey/unwrapKey (Key Vault Crypto Service Encryption User) for the server identity; rotation = Key Vault rotation policy + server automatic key rotation.
• Prefer server-level auditing; add database-level auditing only for a database that needs a different destination, retention or event set; busy OLTP estates may switch to database-level for per-database folders.
• Firewalled audit storage needs GPv2, trusted Microsoft services, the server's managed identity and Storage Blob Data Contributor; a deleted SQLSecurityAuditEvents diagnostic setting fails silently, so alert on it.
• Managed Instance audits are T-SQL: TO URL with a SAS credential or TO EXTERNAL_MONITOR with a diagnostic setting, then enable the audit itself; support operations need a separate OPERATOR_AUDIT audit.
• Defender for Databases covers Azure SQL, SQL Server on machines, PostgreSQL/MySQL flexible server and Cosmos DB for NoSQL only; VA express needs no storage and applies baselines without a rescan.

SC-500 Network Security: NSGs, Virtual Network Manager, VPN, Private Link and Azure Firewall

• NSGs stop at the first matching rule by priority; specificity and action don't matter, and subnet and NIC NSGs must both allow a flow.
• AllowVnetInBound admits peered and gateway-connected networks; a custom deny-all also hides the AzureLoadBalancer probe allowance.
• ASGs replace IP lists for tier-based rules but stop at the virtual network boundary; use the remote prefix across a peering.
• Virtual Network Manager admin rules run before NSGs: Deny can't be overridden, Allow defers to NSGs, Always Allow skips them, and nothing applies until you deploy to the region.
• Virtual WAN inspection is routing intent: Private Traffic for branch and VNet flows, Internet Traffic for 0.0.0.0/0, on every hub that needs it.
• Point-to-site with Conditional Access means Entra ID authentication over OpenVPN on a non-Basic, route-based gateway; revoke one certificate by thumbprint.
• Private endpoints only work if DNS resolves the privatelink name to the private IP; on-premises needs a Private Resolver inbound endpoint and a conditional forwarder.
• Private endpoint network policies are off by default: enable them for NSGs or route tables, and use a UDR no broader than the VNet space to force traffic through a firewall.
• Azure Firewall processes DNAT, then network, then application rules; parent policy rules beat child rules, FQDN network rules need DNS proxy, and TLS inspection, IDPS and URL filtering are Premium.
• IP flow verify gives one TCP/UDP flow's verdict, NSG diagnostics adds ICMP and scale sets, effective security rules lists a NIC's whole rule set, and next hop explains routing.

Secure compute

SC-500 Security for AI: Copilot Oversharing, Purview DSPM, Entra Agent ID, Foundry Guardrails and Defender for AI

• Copilot only shows what users can already open, so oversharing is the AI risk: the site permissions snapshot report finds old exposure, while activity reports only look back 28 days.
• Restricted Content Discovery hides a site from Copilot and org-wide search without changing access; restricted access control denies entry outside chosen groups; a site access review hands the fix to site owners.
• The default DSPM data risk assessment covers the top 100 SharePoint sites by usage weekly; item-level fixes need a custom assessment with an item-level scan; label-scoped Copilot DLP keeps the rest of a site usable.
• Copilot activity reaches DSPM through auditing; third-party AI sites need onboarded devices plus the Purview browser extension for Chrome.
• Copilot Studio threat detection is set up per environment, fails open by default (choose Block the query), and covers generative-orchestration agents only; Defender's Default rule audits, custom rules block, and alerts need the Microsoft 365 connector.
• Conditional Access follows the token subject: agent identity or blueprint for app-only, the user for on-behalf-of; use custom security attributes to approve agents without editing policy, and the Agent risk condition in Report-only first.
• Sponsors can disable but not re-enable an agent; sponsor groups must be dynamic or assigned Microsoft 365 groups, never role-assignable; access packages give agents approved, expiring access.
• Foundry AI Gateway needs a v2-tier API Management instance in the same tenant and subscription; 429 means the per-minute limit, 403 means the token quota is used up.
• Defender for AI Services is enabled per subscription; prompt evidence adds prompt text to alerts and UserSecurityContext adds the end user and IP.
• An agent's own guardrail fully replaces its model's; agents can't use Groundedness yet, and tool-point controls only work for tools with moderation support.

SC-500 Server and VM Security: Disk Encryption, Bastion, JIT, Arc and Defender for Servers

• SSE never encrypts temp disks or caches; encryption at host does, on the host with no guest CPU. Azure Disk Encryption retires on 15 September 2028, and moving off it means new upload disks and a new VM, not snapshots.
• A disk encryption set reaches Key Vault as its managed identity: Key Vault Crypto Service Encryption User on RBAC vaults; turn on DES automatic key rotation; disabling the key shuts the VMs down.
• Bastion: Developer is free and single-VM; native client and file transfer start at Standard; session recording and private-only deployment need Premium.
• AzureBastionSubnet inbound needs 443 from Internet, GatewayManager and AzureLoadBalancer plus 8080/5701 within the VNet; target subnets allow 3389/22 from the Bastion subnet only.
• JIT needs Defender for Servers Plan 2, works with NSGs and classic-rule Azure Firewalls, and can't override existing allow rules for its ports.
• Requesting JIT is initiate/action plus reads; configuring it is policy write plus VM write. Audit JIT in the Activity log; find candidates through the just-in-time recommendation.
• Arc onboarding at scale uses a service principal with Azure Connected Machine Onboarding; only local azcmagent settings (allowlist, blocklist, monitor mode) stop even Azure Owners.
• Plan 1 (per resource possible) covers Defender for Endpoint EDR and MDVM; Plan 2 (subscription level) adds JIT, FIM, OS baselines, agentless malware scanning and MDVM premium.
• Agentless scanning needs Plan 2 or Defender CSPM (malware is Plan 2 only), runs daily on running VMs, skips Ultra and Premium SSD v2 disks, and needs key access for CMK disks.
• Trusted launch gives Secure Boot, vTPM and boot integrity monitoring; machine configuration needs the extension plus a system-assigned identity on Azure VMs, and ApplyAndAutoCorrect plus a remediation task to fix existing machines and drift.

SC-500 Application Platform Security: AKS, Containers, Functions, App Service, WAF and API Management

• Defender for Containers: registry scanning, discovery and audit-log alerts are agentless; process-level runtime detection, drift blocking and gated deployment need the Defender sensor.
• Azure Policy for Kubernetes blocks pod specs (privileged, host access) at admission; gated deployment blocks images on their existing vulnerability findings.
• Disable AKS local accounts so access goes through Entra ID, and on an existing cluster rotate certificates to revoke admin kubeconfigs already issued.
• AKS RBAC Reader/Writer/Admin roles can be scoped to a namespace; the Cluster User Role only downloads a kubeconfig.
• Private cluster = no public API endpoint; authorized IP ranges = a public endpoint filtered to listed CIDRs, settable on an existing cluster.
• Workload ID federates a service account to one identity: subject system:serviceaccount:<namespace>:<name>, audience api://AzureADTokenExchange; pod-managed identity is deprecated and retired.
• ACR: AcrPull via attach-acr for clusters, tokens with scope maps for non-Entra clients, and private endpoints or IP rules only on Premium.
• Functions: Consumption has no private endpoint or VNet integration; Flex Consumption adds both and still scales to zero; outbound to a private endpoint needs VNet integration plus the private DNS zone.
• Logic Apps: one auth scheme per Request-trigger call, separate IP controls for triggers and run history, secure inputs vs secure outputs per step.
• WAF only blocks in Prevention mode; Front Door managed rules and bot protection need Premium; custom rules run lowest priority number first and Allow stops evaluation.

Manage and monitor security posture

SC-500 Defender for Cloud Posture: Defender CSPM, Compliance, Workload Plans, AWS/GCP Connectors and EASM

• Secure score, the compliance dashboard with MCSB, workflow automation and continuous export are free; assessments against other standards (PCI DSS, ISO, CIS), custom recommendations, attack paths, cloud security explorer, governance rules, agentless scanning, data posture and the EASM integration need Defender CSPM.
• Classic secure score counts only GA built-in MCSB recommendations, and a resource earns a control's points only when every recommendation in that control is resolved.
• Attack paths need Defender CSPM plus agentless scanning; resolved paths can take up to 24 hours to drop off, and Additional recommendations don't break a path.
• Governance rules assign owners (by tag or email) and 7/14/30/90-day deadlines; the grace period protects the secure score and applying to existing recommendations covers the backlog.
• Download report is your status; Audit reports are Microsoft's certificates; manual controls are proven by attestation with evidence; Security Reader can't see compliance data but Reader can.
• Streaming export sends each change, Snapshots send the full state weekly (IsSnapshot); workflow automation triggers and their at-scale policies must match alerts, recommendations or regulatory compliance.
• Resource-level enablement works for Storage, SQL, open-source databases and Servers Plan 1; Servers Plan 2 is subscription-on, resource-off.
• AWS organizations onboard through the management account with a StackSet (trusted access on); GCP uses a generated gcloud script with workload identity federation, rerun after plan changes.
• Agent-based MDVM is Vulnerability assessment for machines (Servers Plan 1 or 2); agentless scanning comes with Servers Plan 2 or Defender CSPM, and CMK disks need key access for the Servers Scanner Resource Provider.
• The Defender CSPM EASM integration feeds attack paths; a standalone EASM resource adds discovery groups, asset states, dashboards and data connections that export Approved Inventory only.

SC-500 Microsoft Sentinel: Workspaces, Roles, Data Connectors, Automation Rules and Retention

• Enabling Microsoft Sentinel needs Contributor on the subscription; Defender for Cloud default workspaces aren't eligible, and a Sentinel workspace can't be moved afterwards.
• In the Defender portal one workspace is primary, and the Defender XDR connector follows it; the other workspaces stay connected as secondary.
• Reader views, Responder also manages incidents, Contributor also authors content; Workbook Contributor adds only workbook rights.
• Playbook Operator runs playbooks, Logic App Contributor builds them, and automation rules need Microsoft Sentinel's service account granted on the playbook resource group by an Owner.
• Install vendor solutions from the Content hub as Microsoft Sentinel Contributor, with Install with dependencies when they rely on a generic AMA connector.
• Azure resource connectors use Azure Policy-deployed diagnostic settings; existing resources need a remediation task. Entra sign-in logs need P1 or P2.
• Syslog lands in Syslog and CEF in CommonSecurityLog via a Linux forwarder; non-Azure forwarders need Azure Arc first, and shared facilities cause duplicates.
• Windows Security Events via AMA writes SecurityEvent (Custom XPath for exact event IDs); Windows Forwarded Events writes WindowsEvent.
• Custom tables end in _CL, and their DCR must be updated by hand when the schema changes; Auxiliary is the cheapest plan that stays queryable.
• Analytics retention reaches two years and total retention 12; use search jobs to find records and restore to work across a whole period.

SC-500 Microsoft Security Copilot: Workspaces, Roles, Plugins and Agents

• Data storage location is fixed when a workspace is created; new residency needs mean a new workspace, and in-region processing also needs prompt evaluation set to that geography instead of evaluate anywhere.
• One capacity serves one workspace and SCUs are never shared; provisioned units bill every hour, overage units bill only when used, and exhausted units throttle users until the next billing hour.
• Disassociating a capacity stops billing and keeps the workspace's data; deleting it permanently loses session history and feedback.
• Embedded and agent traffic is routed per product, tenant-wide, to the oldest workspace by default; users need a role in the target workspace, and agents must be stopped and set up again when you move them.
• Copilot owner and contributor aren't Entra roles and grant no data; on-behalf-of authentication means each plugin needs the user's own service role, such as Microsoft Sentinel Reader.
• Assign Copilot roles to role-assignable security groups (no dynamic membership); remove Everyone before adding the Recommended Microsoft Security roles, and know that Everyone can't come back.
• Owners alone change workspace-wide settings: plugin availability, upload permissions, data sharing, capacity and the usage dashboard; audit logging to Purview is tenant-wide and only a Security Administrator can change it.
• Restricting preinstalled plugins can break embedded Copilot and makes later new preinstalled plugins Owners only; plugins with a Set up button are configured per user.
• Custom plugins use a Descriptor and SkillGroups; KQL skills pick a Target (Defender needs no workspace values, Sentinel needs four), and API skills need an OpenAPI 3.0 or 3.0.1 spec.
• Prefer an agent identity over a user account, grant it exactly the service access it reads, buy and cancel partner agents in Security Store, and have a Global Administrator approve partner access to Microsoft data.