What's changed: Added per-section figures (cert-figure-retrofit). New SC-500 Chapter 3 (Domain 3 "Secure compute": AI security = SharePoint overexposure/Purview DSPM for AI/Copilot Studio real-time protection/Entra Agent ID-conditional access/Defender XDR blast radius/APIM AI Gateway-Foundry guardrails/Defender for AI-Data and AI dashboard; servers/VMs = Bastion-JIT/disk encryption-trusted launch/Defender for Servers-agentless/Azure Arc/Machine Configuration; app platform = Defender for Containers/ACR-AKS/App Service-Functions-Logic Apps/WAF-API Management)
3.2Securing servers and virtual machines
Learn disk encryption, Azure Bastion, just-in-time (JIT) VM access, extending controls to hybrid/multicloud with Azure Arc, Defender for Servers (vulnerability scanning, EDR, agentless scanning), and secure boot/vTPM/integrity monitoring plus Azure Machine Configuration.
IaaS VMs and on-premises/other-cloud servers remain targets. The angles: secure admin access (Bastion/JIT) → encrypt disks → ensure OS integrity (trusted launch) → continuously detect vulnerabilities and threats (Defender for Servers) → enforce configuration (Machine Configuration) → extend to hybrid/multicloud (Arc).
3.2.1Secure admin access: Bastion and JIT
Azure Bastion is a managed service for secure browser-based remote connectivity without giving VMs a public IP or open RDP/SSH ports. Just-in-time (JIT) VM access (a Defender for Servers feature) keeps management ports closed by default and opens them only on request, for a limited time and source. Together they eliminate "always-open management ports."
3.2.2Disk encryption and trusted launch
Protect VM disks with at-rest encryption via Azure Disk Encryption (ADE) or platform/customer-managed keys (CMK). Additionally, Trusted Launch provides secure boot (only signed bootloaders run), a virtual TPM (vTPM) (protects keys/measurements), and integrity monitoring (verifies boot integrity), defending against rootkits and boot-level malware. These are configured as the VM’s security type.
3.2.3Defender for Servers and Azure Arc
Microsoft Defender for Servers provides vulnerability scanning (Defender Vulnerability Management), EDR (endpoint detection and response = Defender for Endpoint integration), and agentless scanning that requires no in-guest agent. Onboarding via Azure Arc extends the same protection to on-premises and AWS/GCP servers (hybrid/multicloud) (Arc bridges them to be treated as Azure resources). Enforce configuration against drift with Azure Machine Configuration (formerly guest configuration).
| Goal | Feature | Key point |
|---|---|---|
| Connect without open mgmt ports | Azure Bastion | No public IP / open RDP-SSH |
| Open mgmt ports only when needed | JIT VM access | Time/source limited (Defender for Servers) |
| Boot-level protection | Trusted launch (secure boot/vTPM/integrity monitoring) | Anti-rootkit; set via security type |
| Continuous vuln/threat detection | Defender for Servers (vuln mgmt/EDR/agentless) | A workload-protection plan |
| Extend to on-prem/other clouds | Azure Arc | Bring hybrid/multicloud under Azure management |
| Enforce against config drift | Azure Machine Configuration | Codify and audit/apply guest OS settings |
Watch the mix-ups: (1) Bastion (a connection path without open mgmt ports) vs JIT (temporarily opening mgmt ports only when needed)—complementary. (2) disk encryption (data at rest) vs trusted launch (boot integrity, anti-rootkit). (3) Defender for Servers (VM vuln/threats) vs Azure Arc (the bridge to extend management to on-prem/other clouds).
Map requirement → feature: "RDP securely without a public IP" = Bastion; "keep mgmt ports closed and open only on request" = JIT; "boot protection against rootkits" = trusted launch; "extend Defender protection to on-prem/AWS servers" = Azure Arc; "enforce guest OS settings" = Machine Configuration.
3.2.4Section summary
- Eliminate always-open ports with Bastion + JIT for admin access
- Disk encryption (at rest) + trusted launch (secure boot/vTPM/integrity monitoring) protect down to boot
- Extend Defender for Servers (vuln/EDR/agentless) to hybrid/multicloud via Azure Arc; enforce config with Machine Configuration
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which service provides secure browser-based remote connectivity to VMs without a public IP or open RDP/SSH ports?
Q2. Which Defender for Servers feature keeps management ports closed and opens them only on request, for a limited time and source?
Q3. Which is used to bring on-premises and AWS/GCP servers under Azure management to extend Defender for Servers protection?
Q4. Which VM feature uses secure boot, virtual TPM (vTPM), and integrity monitoring to defend against boot-level malware and rootkits?
Q5. Which Defender for Servers capability scans VMs for vulnerabilities and malware without installing an in-guest agent?
Q6. Which codifies guest OS configuration to audit/apply it and enforce remediation of configuration drift?