Training course

This is a free, self-paced reading course for SC-500: Microsoft Certified: Cloud and AI Security Engineer Associate, the associate-level credential that replaces AZ-500 and widens the job scope beyond Azure alone to the whole surface a security engineer defends. SC-500 asks you to design and operate controls across Microsoft Entra, Azure, Microsoft 365, and the AI stack, so the course is written to be read straight through before you start drilling practice questions: it builds the vocabulary and the control model first, so a wrong answer later becomes a gap you can name rather than a fact you memorize.

The course is organized as one module per official exam domain, in the order Microsoft publishes them, and each module carries the domain’s published weight. That structure matters more on SC-500 than on most exams, because the weights are not flat: securing storage, databases, and networking is the single heaviest domain, and the other three sit a band below it. Reading in weighted order keeps you from spending your first week on the AI-security material simply because it is the newest part of the blueprint. Every lesson ends with its key terms and suggested further reading, so the course works as a reference after the first pass as well as a syllabus during it.

SC-500 Associate level 4 modules Domain-weighted Self-paced Free account

What the course covers

Manage identity, access, and governance

Module 1 · 20-25%

Microsoft Entra ID identity protection and Conditional Access with authentication strengths, phishing-resistant MFA, multifactor, and passwordless; Privileged Identity Management for just-in-time role activation with approval workflows; workload identities and Entra Agent ID for governing AI-agent identity; Continuous Access Evaluation; Entra ID Governance access reviews and access packages; Azure RBAC and ABAC with the condition builder; Azure Policy at management-group scope with restricted exemption rights; and Microsoft Purview data governance touchpoints. This module sets the identity foundation the other three build on, an admin-role misassignment tends to defeat every downstream control in the chain.

Secure storage, databases, and networking

Module 2 · 25-30%

The heaviest domain, and the one to budget the most time for. Storage account hardening with private endpoints, disabled shared-key and anonymous access, a TLS 1.2 minimum, and customer-managed keys in Key Vault or Managed HSM; immutable blob storage with locked time-based retention; Azure Files authentication modes across AD DS, Entra Kerberos, and Entra Domain Services; Azure SQL Database and Managed Instance security (Always Encrypted with secure enclaves, Defender for SQL, and TDE with CMK) plus Cosmos DB CMK and private endpoints; Azure Firewall Premium with IDPS in alert-and-deny mode and TLS inspection; Azure Virtual Network Manager security admin rules that supersede subnet NSGs; Front Door Premium WAF with bot protection and rate limiting, and Application Gateway WAF; private endpoints and Private Link Service for partner-tenant access; ExpressRoute encryption using MACsec at layer 2 on ER Direct ports and IPsec-over-ExpressRoute at layer 3; and Azure DNS Private Resolver for hybrid resolution.

Secure compute (including AI workloads)

Module 3 · 20-25%

Where SC-500 diverges most sharply from the SOC-analyst track (SC-200, which continues). Microsoft Defender for Endpoint with direct-sensor onboarding; Defender for Servers Plans 1 and 2, where Plan 2 unlocks agentless machine scanning, full Defender Vulnerability Management, and just-in-time VM access; Azure Bastion Premium with session recording to a Log Analytics workspace; JIT VM access replacing scheduled NSG jobs; Trusted Launch VMs with Secure Boot and vTPM measuring the boot chain; Azure Confidential Computing VMs on AMD SEV-SNP or Intel TDX for memory-encrypted TEE workloads; Azure Machine Configuration applying Defender for Cloud baselines to Arc machines; Container Registry supply-chain security with content trust and signed-image admission policy; AKS ingress and egress control through internal-only environments, private endpoints for ACR, and a kubelet identity holding AcrPull. Then the AI-security stack: Microsoft Defender for AI Service for prompt-injection and credential-leak detection, Purview Data Security Posture Management for AI to surface oversharing before a broad Copilot rollout, Purview real-time protection for Copilot Studio, Foundry content filters and safety systems with custom categories, Azure API Management LLM policies such as llm-token-limit and llm-emit-token-metric used as an AI gateway, and Entra Agent ID with Conditional Access to govern AI-agent sign-in.

Manage and monitor security posture

Module 4 · 20-25%

Microsoft Defender for Cloud secure score and the split between foundational and paid Defender CSPM, where the paid tier adds attack path analysis, agentless secret scanning, and sensitive data discovery; the regulatory compliance dashboard and adding standards such as NIST SP 800-53 R5, ISO 27001, HIPAA HITRUST, PCI DSS 4.0, and NIST 800-171; Defender EASM for discovering forgotten public assets; MDVM findings across endpoints and servers; multicloud onboarding through the AWS connector with its CloudFormation stack and STS role, and the GCP connector; Microsoft Sentinel workspace design for multi-region residency with Azure Lighthouse projecting cross-workspace query rights; Sentinel roles: Responder for triage, Contributor for rule authoring, Reader for read-only; Content hub solutions that bundle connectors and analytic rules; Azure Monitor Agent with data collection rules in place of the retired Log Analytics agent; automation rules for incident-creation actions and playbooks authenticating with managed identity; interactive versus archive retention with Search jobs for long-tail queries; Defender XDR Advanced Hunting across the AuditLogs schema; and Microsoft Security Copilot workspaces provisioned with Security Compute Units, including Security Store agents that run inside those workspaces and consume SCU capacity.

How to use it

Read a module, then work the matching portion of the SC-500 practice exam rather than saving all the questions until the end. SC-500 items are scenario-based, so reading a domain and immediately testing it exposes the gap between recognizing a service name and knowing which control the scenario actually calls for, whether a given requirement wants a private endpoint or a service endpoint, Defender for Servers Plan 1 or Plan 2, a Sentinel Responder or a Contributor. Weight your reading the way the blueprint does: module 2 alone can carry up to 30% of the exam. The course modules themselves open once you are signed in to a free Certifym account.

The AI-security material in module 3 is the part with the least available hands-on practice, so treat it deliberately, if you have never looked at a Foundry content filter, a DSPM for AI oversharing report, or an API Management token-limit policy, open them in a tenant while you read rather than trusting recall. For exam logistics (item count, working time, the scaled 700 cut score, cost, prerequisites, and the free annual renewal) see the SC-500 certification guide.

SC-500: Microsoft Cloud and AI Security Engineer Associate

One module per SC-500 exam domain, weighted the way Microsoft weights them.

A self-paced reading course for SC-500: Microsoft Certified: Cloud and AI Security Engineer Associate, the associate-level credential for engineers who design and operate security controls across Microsoft Entra, Azure, Microsoft 365, and the AI stack. The course is organized as one module per official exam domain, in the order Microsoft publishes them, and each module carries the domain's published weight, so the time you spend maps to the time the exam spends.

You work through identity, access, and governance; the security of storage accounts, databases, and the network paths that reach them; compute security from Defender for Servers through confidential computing to the AI-workload controls in Microsoft Purview, Microsoft Foundry, and API Management; and finally posture management and detection engineering in Microsoft Defender for Cloud and Microsoft Sentinel. Every lesson ends with its key terms and further reading, so the course works as a reference after the first pass as well as a syllabus during it.

The course assumes you are comfortable with cloud fundamentals, identity concepts, and networking, and that you have met the material SC-900 covers. It does not assume you have operated Microsoft's security products before. Pair it with a tenant of your own and open the blades you read about — SC-500 is scenario-based and measures which control a requirement calls for, not recall of product names. Certifym is an independent study publisher and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation.

Module 1: Manage identity, access, and governance 24% of exam

The identity foundation the other three modules build on. You work through Microsoft Entra ID Protection risk detections, Conditional Access and authentication strengths, Continuous Access Evaluation, and Privileged Identity Management for just-in-time role activation with approval workflows.The module then moves to governance: workload identities and Entra Agent ID for AI agents, Entra ID Governance access reviews and access packages, Azure RBAC and ABAC with the condition builder, Azure Policy at management-group scope with restricted exemption rights, and the Microsoft Purview data governance surfaces SC-500 expects you to recognize.

1.1 The SC-500 control model: identity as the first control plane 6 min Free preview
1.2 Microsoft Entra ID Protection: risk detections and risk policies 5 min 🔒
1.3 Conditional Access policy design 5 min 🔒
1.4 Authentication strengths and phishing-resistant MFA 5 min 🔒
1.5 Continuous Access Evaluation and session security 5 min 🔒
1.6 Privileged Identity Management and just-in-time roles 5 min 🔒
1.7 Workload identities, managed identities, and Entra Agent ID 5 min 🔒
1.8 Entra ID Governance: access reviews, entitlement management, and lifecycle workflows 5 min 🔒
1.9 Azure RBAC: role definitions, scope, and effective access 6 min 🔒
1.10 Azure ABAC and the role assignment condition builder 5 min 🔒
1.11 Azure Policy, initiatives, and exemption control 5 min 🔒
1.12 Microsoft Purview: information protection and data governance touchpoints 5 min 🔒

Module 2: Secure storage, databases, and networking 28% of exam

The heaviest domain on the exam and the one to budget the most reading time for. The first half is data at rest: storage account hardening, the authorization models a storage account accepts, customer-managed keys in Key Vault and Managed HSM, immutable blob storage, Azure Files authentication, Azure SQL security including Always Encrypted with secure enclaves, and Cosmos DB.The second half is the network path to that data: private endpoints and Private Link Service, Azure Firewall Premium with IDPS and TLS inspection, Virtual Network Manager security admin rules, web application firewalls on Front Door Premium and Application Gateway, ExpressRoute encryption, and Azure DNS Private Resolver.

2.1 Hardening an Azure storage account 5 min 🔒
2.2 Storage authorization: keys, SAS, and Microsoft Entra 5 min 🔒
2.3 Customer-managed keys, Key Vault, and Managed HSM 6 min 🔒
2.4 Immutable blob storage and retention 5 min 🔒
2.5 Azure Files authentication and share security 6 min 🔒
2.6 Azure SQL Database and Managed Instance security 5 min 🔒
2.7 Always Encrypted and secure enclaves 5 min 🔒
2.8 Azure Cosmos DB security 5 min 🔒
2.9 Private endpoints, Private Link Service, and DNS 5 min Free preview
2.10 Azure Firewall Premium: IDPS and TLS inspection 5 min 🔒
2.11 Virtual Network Manager security admin rules and NSGs 5 min 🔒
2.12 Web application firewalls: Front Door Premium and Application Gateway 5 min 🔒
2.13 Hybrid connectivity and ExpressRoute encryption 5 min 🔒
2.14 Azure DNS Private Resolver and hybrid name resolution 5 min 🔒

Module 3: Secure compute (including AI workloads) 24% of exam

Where SC-500 diverges most sharply from the exam it replaces. The first half covers workload protection for machines and containers: Defender for Endpoint onboarding, Defender for Servers Plan 1 versus Plan 2, just-in-time VM access and Azure Bastion, Trusted Launch with Secure Boot and vTPM, confidential computing on hardware-based trusted execution environments, machine configuration baselines on Azure Arc, container registry supply-chain controls, and AKS ingress and egress restriction.The second half is the AI-security stack: Microsoft Defender for AI Service, Microsoft Purview Data Security Posture Management for AI, Foundry content filters and safety systems, and Azure API Management used as an AI gateway.

3.1 Microsoft Defender for Endpoint and onboarding methods 5 min 🔒
3.2 Defender for Servers Plan 1 and Plan 2 5 min 🔒
3.3 Just-in-time VM access and Azure Bastion 5 min 🔒
3.4 Trusted Launch, Secure Boot, and vTPM 5 min 🔒
3.5 Azure confidential computing and trusted execution environments 5 min 🔒
3.6 Azure Arc and machine configuration baselines 5 min 🔒
3.7 Container registry and supply-chain security 5 min 🔒
3.8 AKS cluster security: identity, network, and egress control 5 min 🔒
3.9 Microsoft Defender for AI Service and AI threat detection 6 min 🔒
3.10 Purview DSPM for AI and Copilot oversharing 5 min 🔒
3.11 Microsoft Foundry content filters and safety systems 5 min 🔒
3.12 Azure API Management as an AI gateway 5 min 🔒

Module 4: Manage and monitor security posture 24% of exam

Posture management and detection engineering across the estate. You start in Microsoft Defender for Cloud: secure score and how it is calculated, foundational versus paid Defender CSPM, the regulatory compliance dashboard, external attack surface management, vulnerability findings, and multicloud onboarding through the AWS and GCP connectors.The module then moves to Microsoft Sentinel: workspace design for data residency with Azure Lighthouse, the built-in roles, Content hub solutions, data collection through the Azure Monitor Agent and data collection rules, automation rules and playbooks, the retention tiers and Search jobs, and finally Advanced Hunting and Security Copilot.

4.1 Microsoft Defender for Cloud and secure score 5 min 🔒
4.2 Foundational and paid Defender CSPM 5 min 🔒
4.3 The regulatory compliance dashboard and standards 5 min 🔒
4.4 Defender External Attack Surface Management 5 min 🔒
4.5 Defender Vulnerability Management findings 5 min 🔒
4.6 Multicloud onboarding with the AWS and GCP connectors 5 min 🔒
4.7 Microsoft Sentinel workspace design and Azure Lighthouse 5 min 🔒
4.8 Sentinel roles, permissions, and Content hub 5 min 🔒
4.9 Data collection with the Azure Monitor Agent and data collection rules 5 min 🔒
4.10 Sentinel analytics, automation rules, and playbooks 5 min 🔒
4.11 Retention, archive, Search jobs, and restore 5 min 🔒
4.12 Advanced Hunting, Defender XDR, and Microsoft Security Copilot 5 min 🔒

Frequently asked questions about the SC-500 training course

Is the SC-500 training course free?

Yes. The course costs nothing to read and opens once you are signed in to a free Certifym account, no payment and no card.

How is the course structured?

One module per official SC-500 exam domain, in Microsoft’s published order, with each module weighted to the domain’s published percentage range. There are four modules, matching the four domains. Within each module the material is broken into short lessons, followed by key terms and further reading.

Does this replace Microsoft’s official training?

No. Microsoft Learn publishes the authoritative SC-500 skills outline and free official learning paths. This course is an independent study companion, written to be read quickly and to slot alongside practice questions, not a substitute for the official study guide.

Do I need any prerequisites before starting?

SC-500 has no formal prerequisites, but Microsoft recommends SC-900 first. The course assumes you can already manage identity and access in Microsoft Entra and are comfortable with Azure storage, networking, and compute as an administrator would use them, it teaches how to secure those surfaces, not how they work from scratch. If that grounding is thin, read the SC-900 course or the AZ-104 course first.

What should I do after finishing the course?

Move to the SC-500 practice exam and work it until you are clearing 75% consistently across all four domains rather than leaning on your strong ones. The 700 out of 1000 pass mark is a scaled score, so the extra margin is deliberate headroom, not perfectionism.

Is the course current with the latest SC-500 outline?

The course is built against the four-domain outline Microsoft publishes for SC-500, with the weights as published. SC-500 is a new credential replacing AZ-500, and the AI-security portion of the blueprint tracks fast-moving services, so Microsoft may revise the outline at any time. Verify the current skills outline and weightings on Microsoft Learn before you sit the exam.

Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation. Microsoft®, Microsoft Certified®, Azure®, Microsoft Entra™, Microsoft Defender™, Microsoft Sentinel™, Microsoft Purview™, Microsoft 365®, Copilot™, and SC-500 are trademarks or registered trademarks of Microsoft Corporation in the United States and/or other countries. Use of these marks is solely to identify the certification for which these study materials are intended. The SC-500 exam objectives and skills outline are the property of Microsoft Corporation; candidates should review the official, current study guide directly on Microsoft Learn.

All course content, questions, answers, and explanations on Certifym are original content created for study purposes. They are not actual Microsoft training materials or examination questions and are not represented as such. Studying with these materials does not guarantee a passing result on any live certification exam. Exam requirements, format, domain weights, pricing, and renewal policies are set by Microsoft and may change; always verify current details on Microsoft Learn before scheduling your exam.