Implement End-to-End Security Controls For Cloud And AI Workloads: SC-500T00 Course in Lima

Implement End-to-End Security Controls for Cloud and AI Workloads: SC-500T00 Course Outline

Module 1: Manage and Implement Authentication Methods in Microsoft Entra ID

• Introduction
• Explore Microsoft Entra ID Authentication Methods
• Configure Multifactor Authentication in Microsoft Entra ID
• Implement Passwordless Authentication in Microsoft Entra ID
• Configure Self-Service Password Reset in Microsoft Entra ID
• Exercise - Configure Authentication Methods in Microsoft Entra ID

Module 2: Implement and Configure Privileged Identity Management (PIM)

• Introduction
• Why Privileged Identity Management and Just-in-Time Access Matter
• Core Capabilities of Privileged Identity Management (PIM)
• Implement Just-in-Time Access for Microsoft Entra Roles
• Implement Just-in-Time Access for Azure Roles and Resources
• Scaling with PIM for Groups
• Applying JIT Access to AI Workloads, Agents, and Applications
• JIT Design Patterns and Best Practices

Module 3: Authenticate Your API Plugin for Declarative Agents with Secured APIs

• Introduction
• Integrate an API Plugin with an API Secured with a Key
• Exercise - Integrate an API Plugin with an API Secured with a Key
• Integrate an API Plugin with an API Secured with OAuth
• Exercise - Integrate an API Plugin with an API Secured with OAuth

Module 4: Configure and Secure Azure Key Vault

• Introduction
• Deploy Azure Key Vault with Security Controls
• Configure Access to Azure Key Vault
• Configure Key Vault Firewall and Network Settings

Module 5: Manage Keys and Secrets in Azure Key Vault

• Introduction
• Manage Cryptographic Keys in Azure Key Vault
• Manage Secrets in Azure Key Vault

Module 6: Manage Certificates and Monitor Azure Key Vault

• Introduction
• Manage Certificates in Azure Key Vault
• Enable Key Vault Audit Logging

Module 7: Protect Azure Key Vault with Microsoft Defender for Cloud

• Introduction
• Scan for Exposed Secrets Using Defender Cloud Security Posture Management (CSPM)
• Enable Microsoft Defender for Key Vault
• Investigate and Respond to Defender for Key Vault Alerts

Module 8: Enforce Governance with Azure Policy and Resource Locks

• Introduction
• Assign Built-In Azure Policy Definitions
• Create and Deploy Custom Policy Definitions
• Implement Resource Locks

Module 9: Configure Security Controls and Remediate Recommendations in Defender for Cloud

• Introduction
• Configure Defender for Cloud and Manage Security Standards
• Deploy Remediation Controls at Scale

Module 10: Evaluate Regulatory Compliance in Defender for Cloud

• Introduction
• Understand Compliance Standards and Controls in Defender for Cloud
• Navigate the Regulatory Compliance Dashboard and Investigate Control Gaps
• Assign Standards and Communicate Compliance Posture

Module 11: Manage and Right-Size RBAC Role Assignments for Least Privilege

• Introduction
• Assign and Manage Azure Built-In Roles
• Create Custom Azure Roles and Microsoft Entra Roles
• Evaluate and Remediate Overprivileged Access

Module 12: Protect Backup Data with Azure Backup Security Features

• Introduction
• Enable Soft Delete and Immutable Vaults
• Configure Multi-User Authorisation and RBAC for Backup

Module 13: Implement Security Controls in Infrastructure as Code

• Introduction
• Scan IaC Templates Using Microsoft Defender for DevOps
• Enforce Policy Compliance in IaC Deployments

Module 14: Describe Azure Storage Services

• Introduction
• Describe Azure Storage Accounts
• Describe Azure Storage Redundancy
• Describe Azure Storage Services
• Identify Azure Data Migration Options
• Identify Azure File Movement Options

Module 15: Implement Security and Manage Access for Azure Storage

• Introduction
• Configure Storage Account Security Settings
• Select an Authorisation Model for Azure Storage
• Manage Access with Stored Access Policies
• Disable Shared Key Authorisation and Enforce with Azure Policy

Module 16: Configure Network Security for Azure Storage

• Introduction
• Describe Azure Storage Network Security Controls
• Configure Virtual Network and IP Rules
• Configure Resource Instance Rules and Trusted Services
• Implement Private Endpoints for Storage Accounts

Module 17: Implement Microsoft Defender for Storage

• Introduction
• Explore Microsoft Defender for Storage Capabilities
• Enable and Deploy Defender for Storage
• Configure Malware Scanning and Sensitive Data Detection
• Configure Alert Routing and Validate Defender Coverage

Module 18: Configure Platform-Level Security for Azure SQL

• Introduction
• Configure Authentication and Managed Identity Access
• Implement Network Isolation
• Encrypt and Protect Data in Transit and at Rest
• Apply Data Masking and Row-Level Security

Module 19: Configure Auditing for Azure SQL Database and SQL Managed Instance

• Introduction
• Describe Azure SQL Auditing Capabilities
• Configure Audit Destinations for Azure SQL Database
• Configure Auditing for SQL Managed Instance
• Design a Compliant Audit Strategy

Module 20: Implement Microsoft Defender for Databases

• Introduction
• Explore Microsoft Defender for Databases Capabilities
• Enable Defender for Azure SQL Databases at Subscription Scope
• Enable Defender for Open-Source Relational Databases
• Configure Vulnerability Assessment
• Configure Alert Routing and Validate Coverage

Module 21: Segment and Isolate Azure Workloads Using Network Security Controls

• Introduction
• Assess Network Segmentation Gaps
• Control Traffic with Network Security Groups (NSGs)
• Simplify Rule Management with Application Security Groups
• Enforce Consistent Policy with Azure Virtual Network Manager
• Verify Effective Network Security Rules with Network Watcher

Module 22: Centralise and Enforce Traffic Inspection Using Azure Firewall

• Introduction
• Determine When Centralised Traffic Inspection Is Required
• Configure Azure Firewall Rules and Policies
• Secure a Virtual WAN Hub with Azure Firewall

Module 23: Secure Remote and Hybrid Connectivity Using VPN Gateways and Microsoft Entra Private Access

• Introduction
• Assess Security Risks in Hybrid Connectivity
• Harden VPN Gateway Security
• Replace Broad VPN Access with Microsoft Entra Private Access

Module 24: Eliminate Public Network Exposure of Azure PaaS Services

• Introduction
• Assess the Risk of Public PaaS Endpoint Exposure
• Configure Private Endpoints to Eliminate Public PaaS Exposure
• Expose Internal Services Securely Using Azure Private Link Service
• Enforce and Audit Private Endpoint Adoption

Module 25: Secure Access for Microsoft Entra Agent Identity

• Introduction
• Map Authentication Flows and Conditional Access Scope
• Configure Conditional Access Policies for Agents
• Control Agent Access and Lifecycle

Module 26: Analyse AI Identity Risks Using Microsoft Defender XDR

• Introduction
• Discover AI Agents in the Microsoft Defender Portal
• Assess Blast Radius and Attack Paths

Module 27: Enable Real-Time Protection for Copilot Studio Agents

• Introduction
• Explore Copilot Studio AI Agent Protection
• Enable Protection in Microsoft Defender
• Review AI Agent Protection Outputs

Module 28: Configure AI Gateway Security in Microsoft Foundry

• Introduction
• Examine AI Gateway Architecture
• Create and Configure AI Gateway
• Secure and Monitor AI Gateway Access

Module 29: Configure and Manage Guardrails in Microsoft Foundry

• Introduction
• Understand Guardrails and Microsoft Content Safety
• Understand Safety Controls in Microsoft Foundry
• Try Out Built-In Guardrails
• Create and Manage Blocklists in Microsoft Foundry
• Configure and Apply Guardrails in Microsoft Foundry
• Choose and Refine the Right Guardrails for Your AI Workloads

Module 30: Protect AI Workloads with Microsoft Defender for Cloud

• Introduction
• Enable the AI Workloads Plan
• Review Insights in the Data & AI Security Dashboard
• Assess and Improve AI Security Posture with Cloud Security Posture Management (CSPM)
• Detect AI Threats at Runtime with Cloud Workload Protection (CWP)
• Investigate AI Security Alerts with Prompt Evidence in Microsoft Defender XDR

Module 31: Enable Defender for AI Services Workload Protection in Microsoft Defender for Cloud

• Introduction
• Enable and Configure the Defender for AI Services Plan
• Monitor AI Security with the Data and AI Dashboard

Module 32: Manage Agents Using Microsoft Agent 365

• Introduction
• Enable and Navigate Microsoft Agent 365
• Register Agents and Apply Access Controls
• Monitor Agent Activity and Enforce Governance

Module 33: Identify AI Data Risks Using Microsoft Purview Data Security Posture Management

• Introduction
• Configure Data Security Posture Management (DSPM) for AI
• Assess SharePoint Overexposure
• Identify Risks in Copilot and AI App Interactions

Module 34: Implement Disk Encryption for Azure Virtual Machines

• Introduction
• Choose the Right Disk Encryption Option for Azure VMs
• Configure Encryption at Host with Customer-Managed Keys
• Apply Confidential Disk Encryption to Confidential Virtual Machines

Module 35: Configure Trusted Launch Security Features for Azure Virtual Machines

• Introduction
• Identify Trusted Launch Components and VM Security Types
• Enable Trusted Launch on New and Existing Gen2 VMs
• Migrate Gen1 VMs and Configure Trusted Launch Components
• Enforce Trusted Launch Adoption with Azure Policy

Module 36: Plan and Implement Azure Bastion

• Introduction
• Plan Azure Bastion Deployment
• Deploy and Configure Azure Bastion
• Connect to VMs Through Azure Bastion

Module 37: Manage Security for Arc-Enabled Hybrid Servers

• Introduction
• Control Access and Extension Security for Arc-Enabled Servers
• Apply Azure Policy to Arc-Enabled Servers
• Monitor Arc Server Security Posture in Defender for Cloud

Module 38: Implement Microsoft Defender for Servers

• Introduction
• Onboard Servers to Defender for Servers
• Configure Vulnerability Scanning with Defender Vulnerability Management
• Configure Defender for Endpoint Integration, Agentless Scanning, and File Integrity Monitoring

Module 39: Enable and Enforce Just-in-Time VM Access

• Introduction
• Examine Just-in-Time VM Access Requirements and VM Eligibility
• Enable and Configure JIT Access Policies
• Request Just-in-Time (JIT) Access and Audit Access Activity

Module 40: Enforce VM Security Configuration with Azure Machine Configuration

• Introduction
• Explore Azure Machine Configuration Extension Capabilities and Modes
• Apply Built-In Security Baseline Policies
• Author and Assign Custom Machine Configurations

Module 41: Detect Container Risks Using Microsoft Defender for Containers

• Introduction
• Explore Microsoft Defender for Containers
• Enable and Configure Defender for Containers
• Assess Container Image Vulnerabilities
• Detect Container Runtime Threats and Misconfigurations

Module 42: Implement Security Controls for Azure Kubernetes Service

• Introduction
• Control AKS Cluster Access with Microsoft Entra ID and RBAC
• Secure AKS Network Access
• Implement Workload Identity and Secrets Management for AKS
• Enforce Pod and Container Security

Module 43: Implement Security Controls for Azure Container Registry, Container Instances, and Container Apps

• Introduction
• Secure Azure Container Registry
• Implement Security Controls for Azure Container Instances
• Implement Security Controls for Azure Container Apps

Module 44: Implement Security Controls for Azure Function Apps and Logic Apps

• Introduction
• Configure Authentication and Authorisation for Function Apps
• Secure Network Access for Function Apps
• Implement Security Controls for Logic Apps

Module 45: Implement Security Controls for Azure App Services and Web Application Firewall

• Introduction
• Implement Security Controls for Azure App Service
• Configure Web Application Firewall Policies
• Protect App Service with Web Application Firewall

Module 46: Implement API Backend Security Using Azure API Management

• Introduction
• Configure API Authentication and Authorisation Policies
• Implement API Network Security and Threat Protection
• Secure API Management Backend Connections
• Configure AI Gateway in API Management for Azure AI Foundry

Module 47: Connect Hybrid and Multicloud Environments to Microsoft Defender for Cloud

• Introduction
• Explore the Defender for Cloud Multicloud Connectivity Model
• Plan a Connector Strategy for Hybrid and Multicloud Environments
• Connect On-Premises Machines Using Azure Arc
• Connect AWS Accounts to Defender for Cloud
• Connect GCP Projects to Defender for Cloud
• Verify Multicloud Coverage and Validate Protection

Module 48: Identify Security Risks by Using Cloud Security Posture Management

• Introduction
• Explore CSPM Plans and Posture Visibility
• Analyse Security Recommendations with Risk Prioritisation
• Identify Attack Paths and Choke Points
• Hunt for Risks with Cloud Security Explorer

Module 49: Discover Unprotected Assets and Vulnerabilities by Using Microsoft Defender External Attack Surface Management

• Introduction
• Explore EASM Features and Capabilities
• Discover Assets Using Recursive Discovery
• Analyse Your Attack Surface with Dashboards
• Integrate EASM Insights with Defender for Cloud

Module 50: Evaluate Regulatory Compliance in Defender for Cloud

• Introduction
• Understand Compliance Standards and Controls in Defender for Cloud
• Navigate the Regulatory Compliance Dashboard and Investigate Control Gaps
• Assign Standards and Communicate Compliance Posture

Module 51: Enable and Configure Workload Protection Plans in Microsoft Defender for Cloud

• Introduction
• Understand the Defender for Cloud CWPP Plan Catalog
• Enable Workload Protection Plans in Environment Settings
• Configure Defender for Storage and Defender for Databases
• Deploy Plans at Scale and Verify Coverage

Module 52: Configure Microsoft Defender Vulnerability Management Settings for Azure VMs

• Introduction
• Explore Microsoft Defender Vulnerability Management (MDVM) Integration with Defender for Servers
• Configure Vulnerability Scanning for Azure VMs
• Review and Manage Vulnerability Findings
• Apply Plan 2 Premium MDVM Capabilities

Module 53: Create and Manage Microsoft Sentinel Workspaces

• Introduction
• Plan for the Microsoft Sentinel Workspace
• Create a Microsoft Sentinel Workspace
• Manage Workspaces Across Tenants Using Azure Lighthouse
• Understand Microsoft Sentinel Permissions and Roles
• Manage Microsoft Sentinel Settings
• Configure Logs

Module 54: Manage Content in Microsoft Sentinel

• Introduction
• Use Solutions from the Content Hub
• Use Repositories for Deployment

Module 55: Connect Microsoft Services to Microsoft Sentinel

• Introduction
• Plan for Microsoft Services Connectors
• Connect the Microsoft 365 Connector
• Connect the Microsoft Entra Connector
• Connect the Microsoft Entra ID Protection Connector
• Connect the Azure Activity Connector

Module 56: Connect Syslog Data Sources to Microsoft Sentinel

• Introduction
• Plan for Syslog Data Collection
• Collect Data from Linux-Based Sources Using Syslog
• Configure the Data Collection Rule for Syslog Data Sources
• Parse Syslog Data with KQL

Module 57: Connect Common Event Format Logs to Microsoft Sentinel

• Introduction
• Plan for Common Event Format Connector
• Connect Your External Solution Using the Common Event Format Connector

Module 58: Connect Windows Hosts to Microsoft Sentinel

• Introduction
• Plan for Windows Hosts Security Events Connector
• Connect Using the Windows Security Events via AMA Connector
• Connect Using the Security Events via Legacy Agent Connector
• Collect Sysmon Event Logs

Module 59: Implement Automation Rules and Playbooks in Microsoft Sentinel

• Introduction
• Understand Microsoft Sentinel Automation Options
• Create Automation Rules in Microsoft Sentinel
• Configure and Activate a Content Hub Playbook
• Author a Custom Playbook with Azure Logic Apps

Module 60: Manage Data Storage and Query Audit Logs in Microsoft Sentinel

• Introduction
• Create Custom Log Tables in Microsoft Sentinel
• Implement Data Retention in Microsoft Sentinel
• Connect Microsoft Purview Audit to Microsoft Sentinel
• Query Purview Audit Logs in Microsoft Defender XDR

Module 61: Describe Microsoft Security Copilot

• Introduction
• Get Acquainted with Microsoft Security Copilot
• Describe Microsoft Security Copilot Terminology
• Describe How Microsoft Security Copilot Processes Prompt Requests
• Describe the Elements of an Effective Prompt
• Describe How to Enable Microsoft Security Copilot

Module 62: Configure Workspaces for Microsoft Security Copilot

• Introduction
• Plan a Workspace Deployment
• Create a Security Copilot Workspace
• Configure Workspace Access and Settings
• Assign Workspaces for Integrated Agents
• Monitor and Manage Workspace Capacity

Module 63: Manage Plugins and Agents in Microsoft Security Copilot

• Introduction
• Configure Plugin Settings in Security Copilot
• Discover and Set Up Microsoft-Built Agents
• Acquire and Configure Partner Agents from Security Store
• Manage Security Copilot Agents

Who Should Attend This Implement End-to-End Security Controls for Cloud and AI Workloads: SC-500T00 Course? 

This SC-500T00 Course is suitable for professionals responsible for securing cloud, hybrid, multicloud, application, data, and AI environments. It is particularly relevant to those involved in implementing and managing security controls across modern enterprise environments. The following professionals can benefit from this training:

• Cloud Security Engineers
• Security Administrators
• Security Operations Analysts
• Identity and Access Administrators
• DevSecOps Engineers
• Cloud Infrastructure Engineers
• Cloud Security Architects
• Application Security Engineers

Prerequisites of the Implement End-to-End Security Controls for Cloud and AI Workloads: SC-500T00 Course

There are no formal prerequisites for attending this SC-500T00 Course. However, practical experience with Microsoft Azure and hybrid environments, along with familiarity with Microsoft Entra ID and Microsoft 365 administration, is recommended.

Implement End-to-End Security Controls for Cloud and AI Workloads: SC-500T00 Course Overview

The SC-500T00 Course covers security across Microsoft cloud, hybrid, and AI environments. It includes identity protection, privileged access, Azure security, governance, networking, workload protection, Microsoft Sentinel, and Security Copilot.

Delegates will develop skills in securing identities, data, infrastructure, applications, containers, and AI workloads. They will also gain practical knowledge of compliance, vulnerability management, security posture, threat detection, monitoring, and automation.

This 4-Day course by The Knowledge Academy enables delegates to implement end-to-end Microsoft security controls. They will be able to protect workloads, manage security risks, investigate threats, and support cloud and AI security operations.

SC-500T00 Course Objectives

• To manage authentication, privileged access, and identity security
• To secure Azure data, storage, databases, keys, and secrets
• To apply governance, compliance, and security posture controls
• To protect networks, infrastructure, applications, and containers
• To secure AI agents, AI workloads, and associated data risks
• To use Microsoft Sentinel and Security Copilot for security operations

After completing this course, delegates will be able to apply security controls across Microsoft cloud, hybrid, application, data, and AI environments. They will be better prepared to manage access, security posture, threats, compliance, monitoring, and security operations.

What’s Included in the Implement End-to-End Security Controls for Cloud and AI Workloads: SC-500T00 Course? 

• World-Class Training Sessions from Experienced Instructors 
• Interactive Learning with 24*7 Support 
• Digital Delegate Pack