Microsoft Azure Security Engineer AssociateStudy guide

Understand Microsoft Entra ID (formerly Azure AD), the starting point of Azure security: tenants/users/groups, hybrid identity (sync), and external identities (B2B, plus Microsoft Entra External ID for customers; the older Azure AD B2C is closed to new tenants since May 2025). The basis of "Manage identity and access" in AZ-500.

Understand multi-factor authentication (MFA) beyond passwords alone, and Conditional Access that controls access based on sign-in context (user, location, device, risk)—the core of Zero Trust.

Understand role-based access control (RBAC) that defines "who can do what," and Privileged Identity Management (PIM) that activates powerful roles only when needed—supporting least privilege.

Understand network security groups (NSGs) that allow/deny traffic at subnet/NIC level, and application security groups (ASGs) that group VMs by app role. The basis for minimizing traffic within a virtual network.

Understand Azure Firewall for centralized VNet traffic control, Azure Bastion for secure VM access without public IPs, and NAT gateway to consolidate outbound to one IP—the basics of perimeter defense and secure operational access.

Understand Web Application Firewall (WAF) and DDoS Protection for public apps, plus private endpoints that keep service connectivity inside the VNet. These defend against L7 attacks and volumetric attacks.

Understand Azure Key Vault for safely storing keys/secrets/certificates and the basics of encryption at rest. Combined with managed identity, keeping no credentials in code is core to AZ-500.

Understand storage account access control (SAS, disabling keys, Entra authorization) and network restrictions, plus Azure SQL authentication, firewall, Transparent Data Encryption (TDE), and Always Encrypted. Defend the data layer in depth.

Understand secure VM operations (Just-In-Time VM access, disk encryption, update management) and Microsoft Defender for Cloud (secure score, workload protection) for visualizing and strengthening cloud-wide posture.

Understand Azure Monitor, the Log Analytics workspace, and diagnostic settings as the foundation of security operations. Recording what happened and collecting/analyzing/retaining logs is the prerequisite for detection and investigation.

Understand Microsoft Sentinel, a cloud-native SIEM (security information and event management) and SOAR (automated response). It ingests broadly via data connectors, detects threats with analytics rules, and responds automatically with playbooks.

Understand Azure Policy to technically enforce organizational rules, Azure Blueprints to apply bundled configuration templates (note: deprecated and slated for retirement in July 2026; the successor is Azure Deployment Stacks with Azure Policy), and Defender for Cloud’s regulatory compliance to visualize alignment with standards. Keep large environments consistently secure.