What's changed: Added per-section figures (cert-figure-retrofit). New SC-500 Chapter 1 (Domain 1 "Manage identity, access, and governance": Entra ID = PIM/conditional access/MFA-passwordless/app identities-OAuth consent/managed identities; Key Vault = RBAC vs access policies/network restriction/soft-delete-purge protection/Defender CSPM secret scanning-Defender for Key Vault; governance = Azure Policy/Defender for Cloud regulatory compliance/RBAC over-privilege remediation/resource locks/Azure Backup/IaC)
1.3Enforcing security and compliance through governance
Learn to enforce controls with Azure Policy (built-in/custom definitions), evaluate regulatory compliance and configure security standards/recommendations with Microsoft Defender for Cloud, apply resource locks, manage built-in/custom roles and remediate over-privileged access (RBAC), use Azure Backup security features, and implement security controls via infrastructure as code.
Manually protecting individual resources leaves gaps at scale. Governance is the practice of defining common rules across the organization, enforcing them automatically, and continuously evaluating compliance. For SC-500 you enforce rules with Azure Policy, evaluate posture with Microsoft Defender for Cloud, minimize permissions with Azure RBAC, prevent accidental changes with resource locks, protect recoverability with Azure Backup, and implement repeatably with IaC.
1.3.1Azure Policy—enforcing controls (built-in/custom)
Azure Policy expresses required conditions as policy definitions, evaluates them at create/update time, and applies an effect. Common effects: Deny (block non-compliant creation), Audit (record but allow), DeployIfNotExists (auto-deploy missing settings = remediation), and Modify (auto-add tags, etc.). A bundle of definitions is an initiative (policy set), applying a group of regulatory requirements at once. Example: "deny storage with public access," "auto-add diagnostic settings if missing." This is the core of preventive control.
1.3.2Defender for Cloud—posture evaluation and compliance
Microsoft Defender for Cloud is the heart of CSPM, continuously evaluating posture. It applies security standards such as the Microsoft Cloud Security Benchmark, surfaces violations as recommendations, and scores overall health as Secure Score. The regulatory compliance dashboard visualizes conformance to regulatory frameworks like PCI DSS and ISO 27001. If Azure Policy is "enforcement," Defender for Cloud is evaluation, visualization, and improvement guidance (many recommendations are implemented via Policy under the hood).
1.3.3RBAC—role management and remediating over-privilege
Azure RBAC expresses authorization as "which identity (who), at which scope (management group/subscription/RG/resource), gets which role (what they can do)." First check whether built-in roles (Reader, Contributor, Owner, and service-specific roles) suffice; if not, define a least-privilege custom role. The common problem of over-privileged access is inventoried and remediated via Entra access reviews, Defender for Cloud recommendations, and PIM eligibility. Watch especially for misuse of roles that can delegate permissions, such as Owner and User Access Administrator.
1.3.4Resource locks, Azure Backup, and IaC
- Resource locks: CanNotDelete (block delete, allow changes) and ReadOnly (block changes and delete). Prevent accidental deletion/modification of critical resources; effective independently of RBAC.
- Azure Backup security: soft delete, immutable vaults/storage, and Multi-User Authorization (MUA) prevent destruction of backups by ransomware or insiders.
- Security controls via IaC: codify security settings in Bicep/ARM/Terraform for review, repeatability, and scale; preview diffs before applying (e.g., What-If).
| Goal | Feature | Role |
|---|---|---|
| Block/auto-fix non-compliant resources | Azure Policy (Deny/DeployIfNotExists) | Preventive / enforcement |
| Evaluate posture / show compliance | Defender for Cloud (standards/recommendations/Secure Score/regulatory compliance) | Evaluation / visibility |
| Grant least privilege | Azure RBAC (built-in → custom) | Authorization |
| Prevent accidental delete/change | Resource locks (CanNotDelete/ReadOnly) | Protection (independent of RBAC) |
| Protect backups from destruction | Azure Backup (soft delete/immutable/MUA) | Recoverability |
Scenario: a compliance landing zone. Assign an ISO 27001 initiative to a management group; Deny non-compliant creation and DeployIfNotExists to auto-remediate missing diagnostics. Visualize conformance in Defender for Cloud’s regulatory compliance dashboard and burn down Secure Score recommendations. Grant least privilege via built-in roles plus custom roles where needed, and fix over-privilege with quarterly access reviews. Put CanNotDelete locks on production resources and make backups immutable + MUA. Codify everything in Bicep and review changes via pull request.
Watch the mix-ups: (1) Azure Policy (enforce rules: Deny/DeployIfNotExists) vs Defender for Cloud (evaluate/visualize posture: recommendations/Secure Score/regulatory compliance)—different roles (many recommendations are Policy under the hood). (2) RBAC (who can do what = authorization) vs resource locks (block the operation itself = independent of RBAC). (3) CanNotDelete (changes allowed) vs ReadOnly (no changes or deletion).
Common: requirement → governance feature. E.g., "block non-compliant creation" = Azure Policy (Deny); "auto-add missing settings" = DeployIfNotExists; "check PCI DSS conformance" = Defender for Cloud regulatory compliance; "create a least-privilege role" = RBAC custom role; "prevent accidental deletion of production" = CanNotDelete lock; "protect backups from ransomware" = immutable + MUA.
1.3.5Section summary
- Azure Policy = preventive/enforcement (Deny/Audit/DeployIfNotExists/Modify; bundle via initiatives)
- Defender for Cloud = posture evaluation (standards/recommendations/Secure Score) + regulatory compliance visibility
- RBAC = least privilege (built-in → custom); remediate over-privilege via access reviews/PIM/recommendations
- Use resource locks (CanNotDelete/ReadOnly), Azure Backup (immutable/MUA), and IaC for accident prevention and repeatability
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which service enforces rules by denying non-compliant resource creation and auto-deploying missing settings to remediate?
Q2. Which service visualizes conformance to frameworks like PCI DSS and ISO 27001 and evaluates posture via Secure Score and recommendations?
Q3. When built-in roles do not meet requirements, how do you define a least-privilege custom permission set?
Q4. Which resource lock prevents accidental deletion of production resources while still allowing configuration changes?
Q5. Which Azure Backup features help prevent destruction of backups by ransomware or insiders?
Q6. Which best describes the difference between Azure Policy and Microsoft Defender for Cloud?