Cloud Pro: Azure Security and Identity: Choose, Compare and Launch

What's inside

1. Level 1: The Azure Security and Identity MapFree
   Put every Azure security and identity service on one page, grouped by job (workforce and customer identity, access control and governance, keys and secrets, threat detection and posture, logging and audit, data protection, zero trust access), with current and former names such as Azure AD → Microsoft Entra ID, Azure Security Center/Azure Defender → Defender for Cloud and Azure Sentinel → Microsoft Sentinel.
2. Level 2: The Standard Security ProfileFree
   Build a reusable security profile covering identities (workforce, customer, workload), privilege model, data classification, encryption and key control, compliance and residency, detection and response, logging, zero trust posture, team skills and cost model. Every later lesson and the scorecard use this profile.
3. Level 3: Entra ID Tenants and Licensing
   Understand what a Microsoft Entra ID tenant is, how it relates to Azure subscriptions, and which features each licence tier unlocks (Free, P1, P2 and the governance add-ons). This decides what every later identity control will cost.
4. Level 4: Conditional Access Policies
   Design and launch Conditional Access as the zero trust policy engine for sign-ins, covering signals, grant and session controls, report-only mode and the lockout mistakes that catch out experienced teams.
5. Level 5: Privileged Identity Management
   Use Entra Privileged Identity Management to replace standing admin rights with just-in-time, approved and time-limited activation of both Entra roles and Azure resource roles.
6. Level 6: Managed and Workload Identities
   Remove secrets from applications by choosing between system-assigned managed identities, user-assigned managed identities, service principals and workload identity federation for pipelines and Kubernetes.
7. Level 7: Entra External ID for Customers
   Choose and launch Microsoft Entra External ID for customer and partner identity, and know where Azure AD B2C stands now that new customers can no longer buy it, plus how monthly-active-user billing works.
8. Level 8: Azure RBAC: Roles, Scopes and Assignments
   Learn how Azure role-based access control evaluates built-in role assignments across management group, subscription, resource group and resource scopes, and how this differs from Entra directory roles.
9. Level 9: Custom Roles, Conditions and Deny Assignments
   Go beyond built-in roles with custom role definitions, attribute-based access conditions and deny assignments, and learn when this extra precision is worth the cost of maintaining it.
10. Level 10: Azure Policy: Definitions and Effects
    Use Azure Policy to enforce and audit resource configuration, choosing the right effect (Deny, Audit, Modify, Append, DeployIfNotExists, AuditIfNotExists, DenyAction) for each guardrail.
11. Level 11: Policy Initiatives, Remediation and Exemptions
    Scale Azure Policy into initiatives and regulatory baselines, run remediation tasks with managed identities, and manage exemptions and policy-as-code pipelines safely.
12. Level 12: Management Groups and Hierarchy
    Design a management group hierarchy that carries RBAC and Policy inheritance across many subscriptions, and understand the tenant root group, depth limits and subscription placement.
13. Level 13: Key Vault and Managed HSM
    Choose between Key Vault Standard, Key Vault Premium (HSM-backed keys) and Managed HSM for secrets, keys and certificates, considering access model, throttling, key custody and per-operation costs.
14. Level 14: Defender for Cloud: Posture Management
    Use Microsoft Defender for Cloud's free foundational CSPM and paid Defender CSPM plan to measure secure score, recommendations, attack paths and multicloud posture.
15. Level 15: Defender for Cloud: Workload Protection Plans
    Choose among Defender for Cloud workload protection plans (Servers, Storage, Containers, databases, Key Vault, App Service, APIs and others), each with its own billing unit and agent model.
16. Level 16: Microsoft Sentinel: Workspace and Data Ingestion
    Launch Microsoft Sentinel on a Log Analytics workspace, connect data sources and control the biggest cost lever: what you ingest, at which tier, and how long you keep it.
17. Level 17: Sentinel Detection, Automation and the Defender Portal
    Build analytics rules, incidents and automation in Sentinel, and plan the move to the unified Microsoft Defender portal before the Azure portal experience retires on 31 March 2027.
18. Level 18: Microsoft Purview in Brief
    Get a practical briefing on Microsoft Purview for data classification, sensitivity labels, data loss prevention and the data map, and see where it overlaps with Defender and Azure-native controls.
19. Level 19: Azure Confidential Computing
    Judge when to protect data while it is in use with confidential VMs, confidential containers and application enclaves, and what attestation, performance and region availability mean in practice.
20. Level 20: Azure Firewall and DDoS Protection in Brief
    Get a security-focused briefing on Azure Firewall tiers and DDoS Protection options, and how they fit into the identity, policy and detection stack (networking depth is covered in the networking course).
21. Level 21: Landing Zone Security Design
    Learners combine management groups, Policy, RBAC, Key Vault, Defender for Cloud and Sentinel into one secure Azure landing zone, using the Cloud Adoption Framework landing zone as a reference, and decide which controls sit at each layer of the hierarchy.
22. Level 22: Least-Privilege Access Model End to End
    Learners design a complete least-privilege model across Entra roles and Azure RBAC, covering human, privileged, workload and break-glass identities, Conditional Access and PIM, and they plan how to keep it least-privilege as it changes.
23. Level 23: Incident Response on the Azure Platform
    Learners run an incident from start to finish on Azure: Defender for Cloud and Sentinel raise the alert, they investigate with logs and KQL, contain it through identity and network controls, recover, and hold a post-incident review.
24. Level 24: Compliance Mapping and Evidence
    Learners map compliance frameworks and data residency requirements from the security profile to Azure controls, using the Microsoft cloud security benchmark, Policy initiatives and the Defender for Cloud regulatory compliance view, and they separate what Microsoft attests from what the customer must prove.
25. Level 25: Cost of Security Tooling at Scale
    Learners model the yearly cost of identity licences, Defender plans, Sentinel and Log Analytics ingestion and retention, Key Vault and Managed HSM, and edge protection for an enterprise estate, then apply the levers that cut the bill without losing coverage.
26. Level 26: Weighted Selection Scorecard
    Learners turn the standard security profile into a weighted scorecard with must-have gates, weighted criteria and evidence rules, so that service and cloud choices can be defended and repeated.
27. Level 27: Scoring Azure Against Another Cloud
    Learners use the scorecard to compare Azure's security and identity stack with an equivalent set of services on a second cloud, using dated, cited evidence and an honest look at gaps, lock-in and team skills.
28. Level 28: Final Challenge: Decision Workshop Exam
    Learners run a full decision workshop for a realistic scenario, reviewing the whole course (service map, profile, every service lesson, landing zone, access model, incident response, compliance and cost), and finish with a one-page selection record they can defend.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →