AZ-500: Microsoft Azure Security Technologies Exam Study Notes

What better than to have started blogging about my exam preparation notes that with this perfectly representative AZ-500: Microsoft Azure Security Technologies exam from Microsoft! I had taken this when it was in Beta format and narrowly failed the exam, arguably because I hadn’t prepared one bit for the concepts being evaluated. Sure, you *could* rely on roughly 10 years of Azure experience, but as this technology changes daily, I highly recommend preparing fully for this expansive exam!

I also understand that there might be live labs with tasks you need to complete, but your mileage may vary – I wouldn’t be surprised, but if you have fully prepared for this exam, you should have NOTHING to worry about!

Let’s start with a link to the exam details itself, as these skills definitions sometimes change without notice: https://www.microsoft.com/en-us/learning/exam-az-500.aspx.

If you’re looking to take some of the pressure off of your exam tries, consider purchasing the MCP + exam retake package: https://us.mindhub.com/microsoft-exam-replay-mcp-exam-plus-retake/p/Microsoft-Exam-Replay

If you’re looking for courses to learn the materials, here are a few recommendations:
Skylines Academy ($99 USD): https://courses.skylinesacademy.com/p/az-500
EDx course (free): https://openedx.microsoft.com/courses/course-v1:Microsoft+AZ-500.0+2019_T2/course/

Below, I have broken out each of the exam sections into links for both docs.microsoft.com and MSLearn resources to jump start learning for each of the exam pillars/domains:

Manage identity and access (20-25%)

Configure Microsoft Azure Active Directory for workloads

• create App registration: https://docs.microsoft.com/en-us/azure/active-directory/develop/azure-ad-endpoint-comparison
  • V1 endpoint: https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-v1-add-azure-ad-app
  • V2 endpoint: https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-v2-register-an-app
• configure App registration permission scopes
  • https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent
• manage App registration permission consent
  • https://docs.microsoft.com/en-us/azure/active-directory/develop/application-consent-experience
• configure multi-factor authentication settings
  • https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings
  • https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted
• manage Microsoft Azure AD directory groups
  • https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-groups-view-azure-portal
  • https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-self-service-management
  • https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-settings-v2-cmdlets
• manage Microsoft Azure AD users
  • https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-users-azure-active-directory
  • https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal
  • https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/license-users-groups
  • https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-restore
• install and configure Microsoft Azure AD Connect
  • https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-express
  • https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-custom
  • https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-quick-start
  • Upgrading AD Connect: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-upgrade-previous-version
  • AD Connect Health: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-health-agent-install
• configure authentication methods
  • https://docs.microsoft.com/en-us/azure/security/fundamentals/choose-ad-authn
  • https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices
• implement conditional access policies
  • https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access
  • https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/best-practices
  • https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-adoption-kit
  • MS Learn course: https://docs.microsoft.com/en-us/learn/modules/secure-azure-resources-with-conditional-access/
• configure Microsoft Azure AD identity protection
  • https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview
  • https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/enable
  • https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/flows

Configure Microsoft Azure AD Privileged Identity Management

• monitor privileged access
  • https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started
  • https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-configure-security-alerts
• configure access reviews
  • https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-start-security-review
  • https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-perform-security-review
  • https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-complete-review
• activate Privileged Identity Management
  • https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-activate-role
  • https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-resource-roles-activate-your-roles

Configure Microsoft Azure tenant security

• transfer Microsoft Azure subscriptions between Microsoft Azure AD tenants
  • https://docs.microsoft.com/en-us/azure/billing/billing-subscription-transfer
  • https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-how-subscriptions-associated-directory
  • https://docs.microsoft.com/en-us/azure/billing/billing-mca-request-billing-ownership
• manage API access to Microsoft Azure subscriptions and resources
  • https://docs.microsoft.com/en-us/azure/api-management/
  • https://docs.microsoft.com/en-us/azure/api-management/get-started-create-service-instance
  • https://docs.microsoft.com/en-us/azure/api-management/powershell-create-service-instance
  • https://docs.microsoft.com/en-us/azure/api-management/transform-api

Implement platform protection (35-40%)

Implement network security

• configure virtual network connectivity
  • https://docs.microsoft.com/en-us/azure/virtual-network/quick-create-portal
  • https://docs.microsoft.com/en-us/azure/virtual-network/quick-create-powershell
  • https://docs.microsoft.com/en-us/azure/virtual-network/quick-create-cli
• configure Network Security Groups (NSGs)
  • https://docs.microsoft.com/en-us/azure/virtual-network/security-overview
  • https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group
  • https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic
• create and configure Microsoft Azure firewall
  • https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal
  • https://docs.microsoft.com/en-us/azure/firewall/tutorial-hybrid-portal
• create and configure application security groups
  • https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#application-security-groups
• configure remote access management
  • https://docs.microsoft.com/en-us/azure/security/fundamentals/management
  • https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-restrict-network-access-to-resources
• configure baseline
  • https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-baseline-protection
  • https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-auditing-powershell
• configure resource firewall
  • https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-dnat

Implement host security

• configure endpoint security within the VM
  • https://docs.microsoft.com/en-us/azure/virtual-machines/windows/tutorial-virtual-network
• configure VM security
  • https://docs.microsoft.com/en-us/azure/virtual-machines/windows/tutorial-azure-security
  • https://docs.microsoft.com/en-us/azure/virtual-machines/windows/virtual-machines-windows-security-controls
• harden VMs in Microsoft Azure
  • https://docs.microsoft.com/en-us/azure/virtual-machines/windows/security-policy
  • https://docs.microsoft.com/en-us/azure/virtual-machines/windows/isolation
• configure system updates for VMs in Microsoft Azure
  • https://docs.microsoft.com/en-us/azure/automation/automation-tutorial-update-management
• configure baseline
  • https://docs.microsoft.com/en-us/azure/security-center/security-center-virtual-machine-protection

Configure container security (MSLearn course on Administering containers in Azure: https://docs.microsoft.com/en-us/learn/paths/administer-containers-in-azure/ )

• configure network
  • https://docs.microsoft.com/en-us/virtualization/windowscontainers/container-networking/network-drivers-topologies
  • https://docs.microsoft.com/en-us/virtualization/windowscontainers/container-networking/advanced
• configure authentication
  • https://docs.microsoft.com/en-us/azure/container-registry/container-registry-authentication
  • https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal
  • https://docs.microsoft.com/en-us/azure/container-registry/container-registry-authentication-managed-identity
  • https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-aks
• configure container isolation
  • https://docs.microsoft.com/en-us/azure/aks/operator-best-practices-cluster-isolation
• configure AKS security
  • https://docs.microsoft.com/en-us/azure/aks/operator-best-practices-cluster-security
• configure container registry
  • https://docs.microsoft.com/en-us/azure/aks/tutorial-kubernetes-prepare-acr
• configure container instance security
  • https://docs.microsoft.com/en-us/azure/aks/developer-best-practices-pod-security
  • https://docs.microsoft.com/en-us/azure/container-instances/container-instances-image-security
• implement vulnerability management
  • https://docs.microsoft.com/en-us/azure/security-center/security-center-vulnerability-assessment-recommendations

Implement Microsoft Azure Resource management security (MSLearn course on Managing Azure Resources: https://docs.microsoft.com/en-us/learn/paths/manage-resources-in-azure/)

• create Microsoft Azure resource locks
  • https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-lock-resources
• manage resource group security
  • https://docs.microsoft.com/en-us/azure/azure-resource-manager/manage-resource-groups-portal
  • https://docs.microsoft.com/en-us/azure/role-based-access-control/overview
  • https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal
• configure Microsoft Azure policies
  • https://docs.microsoft.com/en-us/azure/governance/policy/overview
  • https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage
  • https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-custom-policy-definition
  • https://handsonlabs.microsoft.com/handsonlabs/SelfPacedLabs?storyId=story://content-private/content/sp-azuregovernance/1-azpolicy/a-policy
• configure custom RBAC roles
  • https://docs.microsoft.com/en-us/learn/modules/secure-azure-resources-with-rbac/index
  • https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles
  • https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles-powershell
  • https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles-cli
• configure subscription and resource permissions
  • https://docs.microsoft.com/en-us/azure/billing/billing-add-change-azure-subscription-administrator
  • https://docs.microsoft.com/en-us/azure/governance/management-groups/create?toc=%2Fazure%2Fbilling%2FTOC.json
  • https://docs.microsoft.com/en-us/azure/governance/management-groups/create
  • https://docs.microsoft.com/en-us/azure/governance/management-groups/manage

Manage security operations (15-20%)

Configure security services

• configure Microsoft Azure monitor
  • https://docs.microsoft.com/en-us/azure/azure-monitor/platform/design-logs-deployment
  • https://docs.microsoft.com/en-us/azure/azure-monitor/platform/manage-access
  • https://docs.microsoft.com/en-us/azure/azure-monitor/learn/quick-collect-azurevm
• configure Microsoft Azure log analytics
  • https://docs.microsoft.com/en-us/azure/azure-monitor/terminology
  • https://docs.microsoft.com/en-us/learn/modules/analyze-infrastructure-with-azure-monitor-logs/
  • https://docs.microsoft.com/en-us/azure/azure-monitor/insights/solutions
  • https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/log-query-overview
• configure diagnostic logging and log retention
  • https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/logs-structure
  • https://docs.microsoft.com/en-us/azure/azure-monitor/app/data-retention-privacy
• configure vulnerability scanning
  • https://docs.microsoft.com/en-us/azure/security-center/security-center-vulnerability-assessment-recommendations

Configure security policies

• configure centralized policy management by using Microsoft Azure Security Center
  • https://docs.microsoft.com/en-us/azure/security-center/security-center-policy-definitions
  • https://docs.microsoft.com/en-us/azure/security-center/security-center-onboarding
  • https://docs.microsoft.com/en-us/azure/security-center/tutorial-security-policy
  • https://docs.microsoft.com/en-us/azure/security-center/security-center-recommendations
• configure Just in Time VM access by using Microsoft Azure Security Center
  • https://docs.microsoft.com/en-us/azure/security-center/security-center-just-in-time

Manage security alerts

• create and customize alerts
  • https://docs.microsoft.com/en-us/azure/security-center/security-center-alerts-overview
• review and respond to alerts and recommendations
  • https://docs.microsoft.com/en-us/azure/security-center/security-center-managing-and-responding-alerts
  • https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-response
• configure a playbook for a security event by using Microsoft Azure Security Center
  • https://docs.microsoft.com/en-us/azure/security-center/security-center-playbooks
• investigate escalated security incidents
  • https://docs.microsoft.com/en-us/azure/security-center/tutorial-security-incident
  • https://docs.microsoft.com/en-us/azure/security-center/security-center-investigation

Secure data and applications (30-35%)

Configure security policies to manage data

• configure data classification
  • https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/govern/policy-compliance/data-classification
  • https://docs.microsoft.com/en-us/azure/sql-database/sql-database-data-discovery-and-classification
• configure data retention
  • https://docs.microsoft.com/en-us/azure/kusto/concepts/retentionpolicy
  • https://docs.microsoft.com/en-us/azure/automation/automation-managing-data
  • https://docs.microsoft.com/en-us/azure/sql-database/sql-database-temporal-tables-retention-policy
• configure data sovereignty
  • https://azure.microsoft.com/en-us/global-infrastructure/geographies/
  • https://docs.microsoft.com/en-us/azure/china/overview-sovereignty-and-regulations
  • https://docs.microsoft.com/en-us/azure/security/fundamentals/physical-security
  • https://docs.microsoft.com/en-us/azure/security/fundamentals/protection-customer-data

Configure security for data infrastructure

• enable database authentication
  • https://docs.microsoft.com/en-us/azure/sql-database/sql-database-aad-authentication-configure
  • https://docs.microsoft.com/en-us/azure/sql-database/sql-database-control-access
• enable database auditing
  • https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auditing
  • https://docs.microsoft.com/en-us/azure/sql-database/sql-database-managed-instance-auditing
• configure Microsoft Azure SQL Database threat detection
  • https://docs.microsoft.com/en-us/azure/sql-database/sql-database-threat-detection-overview
• configure access control for storage accounts
  • https://docs.microsoft.com/en-us/azure/storage/common/storage-account-manage
  • https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-create-account-block-blob
  • https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad
• configure key management for storage accounts
  • https://docs.microsoft.com/en-us/azure/key-vault/key-vault-ovw-storage-keys
  • https://docs.microsoft.com/en-us/azure/key-vault/key-vault-overview-storage-keys-powershell
• create and manage Shared Access Signatures (SAS)
  • https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview
  • https://docs.microsoft.com/en-us/azure/key-vault/storage-keys-sas-tokens-code
• configure security for HDInsights
  • https://docs.microsoft.com/en-us/azure/hdinsight/hdinsight-storage-sharedaccesssignature-permissions
  • https://docs.microsoft.com/en-us/azure/hdinsight/hdinsight-hadoop-linux-use-ssh-unix
  • https://docs.microsoft.com/en-us/azure/hdinsight/hdinsight-linux-ambari-ssh-tunnel
• configure security for Cosmos DB
  • https://docs.microsoft.com/en-us/azure/cosmos-db/database-security
  • https://docs.microsoft.com/en-us/azure/cosmos-db/secure-access-to-data
  • https://docs.microsoft.com/en-us/azure/cosmos-db/cosmos-db-security-controls
• configure security for Microsoft Azure Data Lake
  • https://docs.microsoft.com/en-us/azure/data-lake-store/data-lake-store-access-control
  • https://docs.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control

Configure encryption for data at rest

• implement Microsoft Azure SQL Database Always Encrypted
  • https://docs.microsoft.com/en-us/azure/sql-database/sql-database-always-encrypted
• implement database encryption
  • https://docs.microsoft.com/en-us/azure/sql-database/transparent-data-encryption-azure-sql
  • https://docs.microsoft.com/en-us/azure/sql-database/transparent-data-encryption-byok-azure-sql
• implement Storage Service Encryption
  • https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption
• implement disk encryption
  • https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-prerequisites
  • https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-windows
  • https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-overview
  • https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-extension-sequencing
• implement backup encryption
  • https://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-encryption
  • https://docs.microsoft.com/en-us/azure/backup/backup-azure-manage-vms

Implement security for application delivery

• implement security validations for application development
  • https://docs.microsoft.com/en-us/azure/devops/migrate/security-validation-cicd-pipeline?view=azure-devops
  • https://docs.microsoft.com/en-us/azure/security/fundamentals/paas-deployments
• configure synthetic security transactions
  • https://docs.microsoft.com/en-us/azure/azure-monitor/app/usage-overview

Configure application security

• configure SSL/TLS certs
  • https://docs.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth
  • https://docs.microsoft.com/en-us/azure/app-service/app-service-web-ssl-cert-load
• configure Microsoft Azure services to protect web apps
  • https://docs.microsoft.com/en-us/azure/app-service/app-service-authentication-how-to
  • https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions
  • https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity
  • https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references
• create an application security baseline
  • https://docs.microsoft.com/en-us/azure/app-service/overview-security

Configure and manage Key Vault

• manage access to Key Vault
  • https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault
• manage permissions to secrets, certificates, and keys
  • https://docs.microsoft.com/en-us/azure/key-vault/about-keys-secrets-and-certificates
• manage certificates
  • https://docs.microsoft.com/en-us/azure/key-vault/certificate-scenarios
• manage secrets
  • https://docs.microsoft.com/en-us/azure/key-vault/quick-create-portal
  • https://docs.microsoft.com/en-us/azure/key-vault/quick-create-template?tabs=CLI
• configure key rotation
  • https://docs.microsoft.com/en-us/azure/key-vault/key-vault-key-rotation-log-monitoring

Best of luck to you on your studies and learning journeys, and do let me know how you did when you sit the exam. Also, if this resource helps you, please share with others!

Last, but certainly not least, I owe the inspiration to blog my cloud experience and expertise to both Gregor Suttie and Richard Hooper (aka Pixel Robots). They have fully embraced #HustleAsAService for the past few years, and have made the Azure community better with their efforts! I can only hope to follow in their footsteps and provide the #AzureFamily community yet another learning perspective!