What's changed: Created SC-100 Chapter 5 (Domain 4 "Application and data security": M365 protection (Microsoft Secure Score/Defender for Office 365/Defender for Cloud Apps (CASB)/Intune/Purview labels/DLP); Copilot for Microsoft 365 (permission/label inheritance/oversharing/DSPM for AI/Purview Audit); app protection (threat modeling/secure development lifecycle/workload identity/API Management/Azure WAF); data protection (discovery/classification/encryption at rest-in transit/CMK/Key Vault/Defender for Storage/Defender for Databases/Azure SQL/Synapse/Cosmos DB/Storage)).
5.3Securing applications
Understand evaluating the application portfolio posture, assessing business-critical apps via threat modeling, a full-lifecycle application-security strategy and secure-development standards, authentication via workload identity, API management and security, and Azure Web Application Firewall (WAF).
Applications are a primary entry point for attackers. Architects design not individual bug fixes but a lifecycle strategy for application security across "design→develop→operate," plus runtime defenses (WAF, API protection, workload identity).
5.3.1Threat modeling and secure development
First evaluate the existing application portfolio posture and analyze business-critical apps via threat modeling (where/how they could be attacked). A full-lifecycle strategy from design to operation embeds secure-development standards (code/dependency/secret scanning, IaC checks, SBOM) as DevSecOps (Chapter 1). Map technology choices to requirements (authentication, data protection, auditing) and standardize rather than relying on individuals. Architects guide a design that "weaves application security into the development process."
5.3.2Workload identity, API, and WAF
At runtime, apps authenticate to Azure resources via workload identity (managed identity / federated credentials) without holding keys. Public APIs use Azure API Management for authentication/authorization, rate limiting, and gateway aggregation, and web apps use Azure Web Application Firewall (WAF) to defend OWASP Top 10 (SQLi/XSS) and bots at L7 (integrated with Application Gateway or Azure Front Door). Architects secure the three points—"app identity, API entry, web attacks"—each with the right product.
Cues: "authenticate apps to Azure resources without distributing keys" = workload identity (managed identity). "API auth/rate limiting/gateway" = API Management. "defend SQLi/XSS/bots at L7" = Azure WAF (App Gateway/Front Door). "analyze where attacks happen at design time" = threat modeling.
Watch the mix-ups: (1) Distinguish WAF (L7 web-app defense) from NSG/firewall (L3/L4 network control). (2) Workload identity is for apps—a different layer from user authentication (Conditional Access). (3) Design application security across the development lifecycle (DevSecOps), not just runtime defense.
5.3.3Section summary
- Assess business-critical apps via threat modeling; embed secure development as a full-lifecycle strategy (DevSecOps)
- Runtime = workload identity (keyless auth), API Management (API protection), Azure WAF (L7 web defense)
- WAF (L7) vs network controls (L3/L4); workload identity (apps) vs user authentication are different layers
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To defend a web app against SQL injection and cross-site scripting (XSS) at L7, which is best?
Q2. Which design lets an app authenticate to Azure resources without holding keys or secrets?
Q3. To centrally handle public-API authentication/authorization, rate limiting, and gateway aggregation, which is best?
Q4. For a business-critical app, to systematically analyze "where/how it could be attacked" at design time, which is best?
Q5. Which best describes the scope of application-security design?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.