Microsoft Cloud and AI Security Engineer (SC-500) Exam Prep

What's inside

1. Level 1: How SC-500 Works and How to Answer ItFree
   [Exam orientation] You learn what the exam contains and how its questions are built. The skills-measured study guide is Microsoft's own document; it isn't reproduced here and you can read it free on Microsoft Learn. The four domains are weighted 20–25%, 25–30%, 20–25% and 20–25%. The exam time is whatever Microsoft's SC-500 exam page currently says. You need 700 or more to pass. Microsoft says most questions test generally available features, though popular Preview features can appear. This course is independent of Microsoft and can't promise you a pass. Some details of this new exam are still unconfirmed: third-party sources report a May 2026 beta and July 2026 general availability, and AZ-500 retiring on 31 August 2026, but question counts and formats should be checked on Microsoft's pages.
2. Level 2: Privileged Identity Management (PIM)Free
   [Manage identity, access, and governance] You implement and configure Microsoft Entra Privileged Identity Management. This means setting eligible and active assignments for Microsoft Entra roles and Azure resource roles, and configuring activation settings such as MFA, justification, approval and maximum duration. You also run access reviews of privileged roles.
3. Level 3: Conditional Access Policies
   [Manage identity, access, and governance] You implement Microsoft Entra Conditional Access policies. You build each one from assignments (users, target resources, conditions such as sign-in risk, device platform and location) plus grant and session controls, and test it safely in report-only mode.
4. Level 4: Authentication Methods: MFA and Passwordless
   [Manage identity, access, and governance] You implement and configure authentication methods in Microsoft Entra ID. That covers the Authentication methods policy, MFA methods, the passwordless options (passkeys/FIDO2, Windows Hello for Business, Microsoft Authenticator), number matching, and authentication strengths used in Conditional Access.
5. Level 5: Identity for Applications
   [Manage identity, access, and governance] You implement and configure identity for applications. You learn how an app registration (the application object) differs from an enterprise application (the service principal), and how to configure credentials, user assignment, app roles and ownership securely.
6. Level 6: OAuth Permission Grants and Consent
   [Manage identity, access, and governance] You manage OAuth permission grants and consent settings. That means the difference between delegated and application permissions, the user consent settings, the admin consent workflow, and how to review and revoke risky grants.
7. Level 7: Managed Identities for Azure Resources
   [Manage identity, access, and governance] You implement and configure managed identities for Azure resources. You compare system-assigned and user-assigned identities, then turn them on through the portal and Azure CLI and grant them least-privilege Azure RBAC roles on target resources.
8. Level 8: Deploy Key Vault and Configure Its Settings
   [Manage identity, access, and governance] You deploy Azure Key Vault and configure its settings. That includes choosing the tier (Standard or Premium) or Managed HSM, soft-delete and purge protection, retention periods, and diagnostic logging.
9. Level 9: Key Vault Access and Firewall Settings
   [Manage identity, access, and governance] You configure access to Key Vault, comparing the Azure RBAC permission model with legacy vault access policies. You also configure the Key Vault firewall: selected networks, trusted Microsoft services and private access.
10. Level 10: Manage Keys, Secrets and Certificates
    [Manage identity, access, and governance] You manage keys, secrets and certificates in Key Vault. That covers key types and rotation policies, secret versions and expiry, certificate issuance and auto-renewal, and backup and restore.
11. Level 11: Secret Scanning and Defender for Key Vault
    [Manage identity, access, and governance] You scan for exposed secrets with Defender Cloud Security Posture Management (Defender CSPM), and you implement Defender for Key Vault threat protection, including how to interpret and respond to its alerts.
12. Level 12: Azure Policy: Built-in and Custom Definitions
    [Manage identity, access, and governance] You implement security controls with Azure Policy. You assign built-in definitions and initiatives at management group, subscription or resource group scope, write custom policy definitions, and choose effects such as Deny, Audit, Modify and DeployIfNotExists, with remediation tasks.
13. Level 13: Defender for Cloud Standards and Compliance
    [Manage identity, access, and governance] You implement security controls in Microsoft Defender for Cloud. You assign security standards such as the Microsoft cloud security benchmark, act on recommendations, and use the regulatory compliance dashboard to evaluate compliance.
14. Level 14: Built-in Roles, Custom Roles and Overprivilege
    [Manage identity, access, and governance] You manage Azure built-in role assignments, create custom Azure roles and custom Microsoft Entra roles, and find and fix overprivileged access assignments with Azure RBAC.
15. Level 15: Resource Locks, Backup Security and IaC
    [Manage identity, access, and governance] You implement resource locks (CanNotDelete and ReadOnly). You configure Azure Backup security features: soft delete, immutable vaults, multi-user authorization with Resource Guard, and encryption. You also apply security controls through infrastructure as code, using Bicep or ARM templates and policy-as-code.
16. Level 16: Storage Account Security Configuration
    [Secure storage, databases, and networking] You implement and configure security for storage accounts. That covers secure transfer, minimum TLS version, turning off Shared Key authorization and anonymous blob access, infrastructure encryption, and customer-managed keys held in Key Vault.
17. Level 17: Azure Storage Firewall Rules
    [Secure storage, databases, and networking] You configure Azure Storage firewall rules: selected networks, virtual network service endpoint rules, IP rules, resource instance rules and the trusted Microsoft services exception. You also learn how these interact with public network access.
18. Level 18: Managing Access to Storage
    [Secure storage, databases, and networking] You manage access to storage. That covers Azure RBAC data roles with Microsoft Entra authorization, the shared access signature types (account, service and user delegation), stored access policies, and immutability policies for blobs.
19. Level 19: Defender for Storage Threat Protection
    [Secure storage, databases, and networking] You implement Defender for Storage threat protection configurations: activity monitoring, malware scanning, sensitive data threat detection, and turning the plan on at subscription level with per-account overrides.
20. Level 20: Azure SQL Platform-Level Security
    [Secure storage, databases, and networking] You implement platform-level security configurations in Azure SQL: Microsoft Entra authentication and Microsoft Entra-only authentication, server firewall rules and public network access, Transparent Data Encryption with customer-managed keys, Always Encrypted and dynamic data masking.
21. Level 21: Auditing Azure SQL Database and SQL Managed Instance
    [Secure storage, databases, and networking] This level covers the 'Configure database auditing for Azure SQL Database and Azure SQL Managed Instance' bullet: auditing at server level versus database level, where the logs go (a storage account, a Log Analytics workspace or Event Hubs), auditing Microsoft support operations, and how auditing on SQL Managed Instance differs, including server audit created with T-SQL.
22. Level 22: Defender for Databases Across Azure Database Services
    [Secure storage, databases, and networking] This level covers the 'Configure Defender for Databases protection across Azure database services' bullet: turning on the plan and choosing which resource types it covers (Azure SQL, SQL Server on machines, open-source relational databases and Azure Cosmos DB), plus vulnerability assessment and how to triage threat alerts such as SQL injection and unusual access.
23. Level 23: NSGs and Application Security Groups
    [Secure storage, databases, and networking] This level covers the 'Implement and manage network security groups (NSGs) and application security groups (ASGs)' bullet: rule priority and processing order, the default rules, service tags, how NSGs at subnet and NIC level combine, and how ASGs group VMs by role so rules don't depend on IP addresses.
24. Level 24: Network Access Policies with Azure Virtual Network Manager
    [Secure storage, databases, and networking] This level covers the 'Implement and configure network access policies by using Azure Virtual Network Manager' bullet: network groups, static membership and dynamic membership through Azure Policy, security admin rules and their Allow, Deny and Always Allow actions, and deploying configurations so they are enforced before NSGs are evaluated.
25. Level 25: Securing Azure Virtual WAN
    [Secure storage, databases, and networking] This level covers the 'Configure security for an Azure Virtual WAN' bullet: secured virtual hubs with Azure Firewall Manager, routing intent and routing policies for internet and private traffic, and adding approved partner security providers.
26. Level 26: Securing VPN Connections
    [Secure storage, databases, and networking] This level covers the 'Implement and configure security for virtual private network (VPN) connections' bullet: custom IPsec/IKE policies for site-to-site connections, point-to-site authentication options (certificate, RADIUS and Microsoft Entra ID with MFA through conditional access), and choosing the right gateway SKU and protocol for security needs.
27. Level 27: Microsoft Entra Private Access
    [Secure storage, databases, and networking] This level covers the 'Implement and configure Microsoft Entra Private Access' bullet: Global Secure Access, private network connectors, Quick Access and per-app access through enterprise applications, and applying conditional access to private apps as a Zero Trust replacement for broad VPN access.
28. Level 28: Private Endpoints for Azure PaaS Resources
    [Secure storage, databases, and networking] This level covers the 'Configure Azure private endpoints to secure access to Azure platform as a service (PaaS) resources' bullet: target sub-resources, private DNS zones and name resolution, turning off public network access, and NSG and UDR support for private endpoint subnets.
29. Level 29: Azure Private Link Services
    [Secure storage, databases, and networking] This level covers the 'Configure Azure Private Link services to secure access to network resources' bullet: publishing your own service behind a Standard Load Balancer, NAT IP configuration, visibility and auto-approval settings, and approving consumer connection requests. It sets this apart from private endpoints, a pairing the exam often tests.
30. Level 30: Azure Firewall Deployment and Rule Processing
    [Secure storage, databases, and networking] This level covers the first half of the 'Implement and configure Azure Firewall' bullet: the Basic, Standard and Premium SKUs, the AzureFirewallSubnet, forcing traffic through the firewall with UDRs, and how DNAT, network and application rule collections are processed within a firewall policy.
31. Level 31: Azure Firewall Premium and Policy Hierarchy
    [Secure storage, databases, and networking] This level covers the second half of the 'Implement and configure Azure Firewall' bullet: parent and child firewall policies, threat intelligence mode, DNS proxy, and Premium features (TLS inspection with a Key Vault certificate, IDPS, URL filtering and web categories), with diagnostics sent to Log Analytics.
32. Level 32: Network Watcher: Evaluating Effective Security Rules
    [Secure storage, databases, and networking] This level covers the 'Evaluate effective security rules by using Azure Network Watcher diagnostics' bullet: effective security rules, IP flow verify, NSG diagnostics, next hop, connection troubleshoot, and virtual network flow logs, which replace NSG flow logs.
33. Level 33: SharePoint Oversharing and Purview DSPM for AI Risk
    [Secure compute] This level covers the 'Identify overexposure of data in SharePoint' and 'Identify risks related to Microsoft Copilot and AI apps by using Microsoft Purview Data Security Posture Management (DSPM)' bullets: SharePoint data access governance and oversharing reports, DSPM oversharing assessments, and AI-related risk insights and recommended policies.
34. Level 34: Copilot Studio Agent Protection and M365 Agent Admin
    [Secure compute] This level covers the 'Enable and configure real-time protection for Microsoft Copilot Studio agents' and 'Manage agents in Microsoft 365 admin center' bullets: Microsoft Defender checks at runtime that can block unsafe tool calls (such as prompt injection) before they run, the alerts this raises, and how to approve, block and assign agents in the admin center.
35. Level 35: Entra Agent ID: Access, Conditional Access, Blast Radius
    [Secure compute] This level covers the 'Implement conditional access for Microsoft Entra Agent ID', 'Manage Entra Agent ID access' and 'Analyze blast radius for security risks related to Entra Agent ID by using Defender XDR' bullets: agent identities, agent users and agent identity blueprints, conditional access targeting agents and its licensing requirements, and assessing an agent's reach in Defender XDR.
36. Level 36: AI Gateway in API Management for Microsoft Foundry
    [Secure compute] This level covers the 'Configure and deploy AI Gateway in Azure API Management for Microsoft Foundry' bullet: adding an AI Gateway from the Foundry admin console with a new or existing API Management instance, then token limits, quotas, managed identity authentication to model back ends, and logging. The level points out which parts are still in preview.
37. Level 37: Guardrails for Agent Security in Microsoft Foundry
    [Secure compute] This level covers the 'Configure guardrails for agent security in Foundry' bullet: guardrail and content-filtering settings for model deployments and agents, prompt shields against direct and indirect prompt injection, and tightening an agent's tool and data access, with keyless Entra ID authentication and network isolation for Foundry endpoints.
38. Level 38: Defender for AI Services and the Data & AI Dashboard
    [Secure compute] This level covers the 'Enable Defender for AI Service in Cloud Workload Protection in Defender for Cloud' and 'Monitor AI security by using the Data and AI security dashboard in Defender for Cloud' bullets: turning on the AI services plan and user prompt evidence, how to triage AI threat alerts, and what the dashboard needs before it shows full data (Defender CSPM, sensitive data discovery, and the storage, database and AI plans).
39. Level 39: VM Disk Encryption and Trusted Launch Security
    [Secure compute] This level covers the 'Implement and configure disk encryption' and 'Configure security features on a VM, including secure boot, virtual Trusted Platform Module (vTPM), integrity monitoring, and security type' bullets: server-side encryption with customer-managed keys and disk encryption sets, encryption at host, Azure Disk Encryption (retiring 15 September 2028), and the Trusted Launch and confidential VM security types.
40. Level 40: Azure Bastion and Just-in-Time VM Access
    [Secure compute] This level covers the 'Plan and implement Azure Bastion' and 'Enable and enforce use of just-in-time (JIT) VM access' bullets: Bastion SKUs (Developer, Basic, Standard, Premium) and their features, the AzureBastionSubnet and its NSG needs, JIT policies in Defender for Servers, and using Azure Policy to require JIT and remove public management ports.
41. Level 41: Defender for Servers: MDVM, EDR and agentless scanning
    [Secure compute] Covers the guide's bullets on configuring Defender for Servers settings, including vulnerability scanning and endpoint detection and response (EDR), and on running agentless scanning for VMs. The learner configures the Defender for Servers plan settings, the Microsoft Defender for Endpoint integration and agentless machine scanning, including exclusion tags.
42. Level 42: Trusted Launch VM features and Machine Configuration
    [Secure compute] Covers the guide's bullets on configuring VM security features (secure boot, vTPM, integrity monitoring and security type) and on enforcing server security configuration with Azure Machine Configuration. The learner works through choosing the security type at deployment, the Trusted Launch settings, and assigning guest configuration policies with remediation.
43. Level 43: Defender for Containers and AKS security controls
    [Secure compute] Covers the guide's bullets on using Defender for Containers to detect misconfigurations and runtime risks in container workloads, and on implementing security controls for AKS. The topics are the plan's components, Azure Policy for Kubernetes, Entra ID integration with Kubernetes RBAC, private clusters and authorized IP ranges.
44. Level 44: Securing ACR, Container Instances and Container Apps
    [Secure compute] Covers the guide's bullets on security controls for Azure Container Registry, Azure Container Instances and Azure Container Apps. The learner applies registry authentication and network rules, image vulnerability assessment, managed identities for image pulls, and network isolation for the container runtimes.
45. Level 45: Securing App Service, Functions and Logic Apps
    [Secure compute] Covers the guide's bullets on security controls for Azure App Service, Azure Functions (including authentication and network access) and Azure Logic Apps. The topics are built-in authentication, access restrictions, private endpoints, virtual network integration, managed identities, Key Vault references and securing Logic Apps triggers.
46. Level 46: Azure WAF and API Management back-end protection
    [Secure compute] Covers the guide's bullets on implementing Azure Web Application Firewall and on using API Management security policies to protect back-end APIs. The learner compares WAF on Application Gateway with WAF on Azure Front Door and applies APIM policies such as validate-jwt, rate limits, IP filtering and managed-identity authentication to the back end.
47. Level 47: Identifying risk with Defender CSPM
    [Manage and monitor security posture] Covers the guide's bullet on identifying security risks with Defender CSPM. The learner uses attack path analysis, the cloud security explorer, the cloud security graph and risk-based prioritization of recommendations.
48. Level 48: Compliance against security frameworks across clouds
    [Manage and monitor security posture] Covers the guide's bullet on evaluating compliance against security frameworks with Defender for Cloud. It builds on the governance level by adding regulatory standards across Azure, AWS and GCP scopes, compliance reports and exports, and continuous export of compliance data.
49. Level 49: Enabling and configuring workload protection plans
    [Manage and monitor security posture] Covers the guide's bullet on enabling and configuring Defender for Cloud workload protection plans. It brings together the plan catalogue, plan settings, enablement at subscription or resource level, and enforcement at scale through Azure Policy.
50. Level 50: Connecting AWS, GCP and hybrid to Defender for Cloud
    [Manage and monitor security posture] Covers the guide's bullet on connecting hybrid and multicloud environments to Defender for Cloud, including AWS and GCP. The learner works with the AWS and GCP connectors, the CloudFormation and GCP setup scripts, account and organization-level onboarding, and Azure Arc for non-Azure machines.
51. Level 51: Defender Vulnerability Management and Defender EASM
    [Manage and monitor security posture] Covers the guide's bullets on configuring Microsoft Defender Vulnerability Management settings for Azure VMs and on finding unprotected assets and vulnerabilities with Microsoft Defender External Attack Surface Management (EASM).
52. Level 52: Sentinel workspaces and role assignment
    [Manage and monitor security posture] Covers the guide's bullets on creating and connecting workspaces in Microsoft Sentinel and on assigning Sentinel roles. The topics are workspace design, onboarding to the Microsoft Defender portal, and the Microsoft Sentinel Reader, Responder, Contributor and Automation Contributor roles.
53. Level 53: Content hub solutions and Azure data connectors
    [Manage and monitor security posture] Covers the guide's bullets on implementing and using content hub solutions and on configuring Microsoft data connectors for Azure resources. The learner installs solutions and connects Azure Activity, Entra ID, Defender for Cloud and diagnostic-settings sources.
54. Level 54: Syslog and CEF collection with the Azure Monitor Agent
    [Manage and monitor security posture] Covers the guide's bullet on implementing syslog and Common Event Format (CEF) event collection. The learner builds a Linux log forwarder, the Azure Monitor Agent and data collection rules (DCRs) with facility and severity filters.
55. Level 55: Windows Security events via DCRs and WEF
    [Manage and monitor security posture] Covers the guide's bullet on collecting Windows Security events with data collection rules, including Windows Event Forwarding (WEF). The topics are the Windows Security Events via AMA connector, event-set choices, XPath filtering and the forwarded-events path.
56. Level 56: Custom log tables for ingested data
    [Manage and monitor security posture] Covers the guide's bullet on creating custom log tables in the workspace to store ingested data. The learner creates _CL tables, uses DCRs and data collection endpoints with ingestion-time transformations, and chooses table plans.
57. Level 57: Sentinel automation rules and playbooks
    [Manage and monitor security posture] Covers the guide's bullet on implementing automation rules and playbooks in Microsoft Sentinel. The topics are rule triggers, conditions and order; Logic Apps playbooks with managed identities; and the permissions Sentinel needs to run playbooks.
58. Level 58: Sentinel retention and querying Purview Audit in XDR
    [Manage and monitor security posture] Covers the guide's bullets on implementing data retention in Microsoft Sentinel data stores and on querying Microsoft Purview Audit in Defender XDR. The topics are analytics-tier and data lake tier retention settings and searching audit records from the Defender portal.
59. Level 59: Implementing Microsoft Security Copilot
    [Manage and monitor security posture] Covers the guide's bullets on configuring Security Copilot workspaces, managing permissions and roles, enabling and configuring plugins, and enabling Microsoft agents and Security Store agents. The learner works through workspace capacity, the Owner and Contributor roles, plugin governance and agent setup approvals.
60. Level 60: Timed mock exam: SC-500 (50 questions, 100 minutes) Timed mock
    A timed mock exam of 50 original scenario questions in 100 minutes, with a 70% pass mark, weighted across all four SC-500 skill areas in proportion to the study guide's percentages, with every distractor explained afterwards.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →