Updated February 2021

Azure has a sole security focused exam, AZ-500 Microsoft Azure Security Technologies. Passing this single exam will allow you to earn a Microsoft Certified: Azure Security Engineer Associate certification.

So, if you’re interested and wondering if you should take this exam? Here is what Microsoft have to say:

Candidates for this exam are Microsoft Azure security engineers who implement security controls, maintain the security posture, manages identity and access, and protects data, applications, and networks. Candidates identify and remediate vulnerabilities by using a variety of security tools, implements threat protection, and responds to security incident escalations. As a Microsoft Azure security engineer, candidates often serve as part of a larger team dedicated to cloud-based management and security and may also secure hybrid environments as part of an end-to-end infrastructure.

Candidates for this exam should have strong skills in scripting and automation, a deep understanding of networking, virtualization, and cloud N-tier architecture, and a strong familiarity with cloud capabilities, Microsoft Azure products and services, and other Microsoft products and services.

Below, I’ve put together a collection of links relevant to the sections highlighted as being part of the skills measured for this exam. As always, these are only guide links, sometimes you need to explore a topic much more deeply if you are not familiar with it.

If you spot something, or have a better link for a topic, get in touch! I will update this post as regularly as possible and always appreciate any feedback.

A good place to start is the Azure Security Documentation page. This site includes most of the key concepts and services covered in this exam, as well as several best practice approaches you should consider.

Manage Identity and Access (30-35%)

Manage Azure Active Directory identities

• https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-overview
• https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/
• https://docs.microsoft.com/en-us/microsoft-365/enterprise/identity-self-service-group-management
• https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-custom
• https://docs.microsoft.com/en-us/azure/security/azure-ad-choose-authn
• https://docs.microsoft.com/en-us/azure/billing/billing-subscription-transfer

Configure secure access by using Azure AD

• https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/enable
• https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started
• https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-deployment-plan
• https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview
• https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/best-practices

Manage application access

• https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-v1-add-azure-ad-app
• https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-permissions-and-consent
• https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent
• https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-aad
• https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-api-authentication

Manage access control

• https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal
• https://docs.microsoft.com/en-us/azure/role-based-access-control/scope-overview
• https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles
• https://docs.microsoft.com/en-us/azure/role-based-access-control/role-definitions
• https://docs.microsoft.com/en-us/azure/role-based-access-control/best-practices
• https://docs.microsoft.com/en-us/azure/role-based-access-control/check-access

Implement Platform Protection (15-20%)

Implement advanced network security

• https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vnet-vnet-rm-ps?toc=%2fazure%2fvirtual-network%2ftoc.json
• https://docs.microsoft.com/en-us/azure/virtual-network/security-overview
• https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal
• https://docs.microsoft.com/en-us/azure/firewall-manager/overview
• https://docs.microsoft.com/en-us/azure/frontdoor/front-door-waf
• https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal
• https://docs.microsoft.com/en-us/azure/bastion/tutorial-create-host-portal
• https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security
• https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure
• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview
• https://docs.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview

Configure advanced security for compute

• https://docs.microsoft.com/en-us/azure/security/azure-security-antimalware
• https://docs.microsoft.com/en-us/azure/security/azure-security-iaas
• https://blogs.msdn.microsoft.com/mvpawardprogram/2018/01/09/just-in-time-access-azure-vms/
• https://docs.microsoft.com/en-us/azure/security/azure-security-management
• https://docs.microsoft.com/en-us/azure/security-center/security-center-customize-os-security-config
• https://docs.microsoft.com/en-us/azure/security/security-network-overview
• https://docs.microsoft.com/en-us/azure/virtual-network/container-networking-overview
• https://docs.microsoft.com/en-us/azure/security/abstract-container-security-microsoft-azure
• https://docs.microsoft.com/en-us/azure/aks/concepts-security
• https://docs.microsoft.com/en-us/azure/container-registry/container-registry-authentication
• https://docs.microsoft.com/en-us/azure/container-instances/
• https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-lock-resources
• https://docs.microsoft.com/en-us/azure/security/fundamentals/azure-disk-encryption-vms-vmss
• https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization
• https://docs.microsoft.com/en-us/azure/aks/concepts-identity
• https://docs.microsoft.com/en-us/azure/automation/update-management/manage-updates-for-vm

Manage Security Operations (25-30%)

Monitor security by using Azure Monitor

• https://docs.microsoft.com/en-us/azure/azure-monitor/azure-management
• https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-overview
• https://docs.microsoft.com/en-us/azure/azure-monitor/platform/manage-access
• https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-logs-overview

Monitor security by using Azure Security Center

• https://docs.microsoft.com/en-us/azure/security-center/tutorial-security-policy
• https://docs.microsoft.com/en-us/azure/security-center/security-center-just-in-time
• https://docs.microsoft.com/en-us/azure/security-center/deploy-vulnerability-assessment-vm
• https://docs.microsoft.com/en-us/azure/security-center/update-regulatory-compliance-packages

Monitor security by using Azure Sentinel

• https://docs.microsoft.com/en-us/azure/sentinel/quickstart-get-visibility
• https://docs.microsoft.com/en-us/azure/sentinel/connect-data-sources
• https://docs.microsoft.com/en-us/azure/sentinel/tutorial-investigate-cases
• https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

Configure Security Policies

• https://docs.microsoft.com/en-us/azure/security-center/tutorial-security-policy
• https://docs.microsoft.com/en-us/azure/governance/blueprints/samples/azure-security-benchmark-foundation

Secure Data and Applications (20-25%)

Configure security for storage

• https://docs.microsoft.com/en-us/azure/storage/common/storage-security-guide
• https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1
• https://docs.microsoft.com/en-us/azure/security-center/defender-for-storage-introduction
• https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption
• https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad
• https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-domain-service-enable

Configure security for databases

• https://docs.microsoft.com/en-us/azure/sql-database/sql-database-aad-authentication
• https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auditing
• https://docs.microsoft.com/en-us/azure/sql-database/sql-database-threat-detection
• https://docs.microsoft.com/en-us/azure/security-center/defender-for-sql-introduction
• https://docs.microsoft.com/en-us/azure/sql-database/sql-database-always-encrypted
• https://docs.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-tde-overview
• https://docs.microsoft.com/en-us/azure/azure-sql/database/always-encrypted-azure-key-vault-configure

Configure and manage Key Vault

• https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault
• https://docs.microsoft.com/en-us/azure/key-vault/about-keys-secrets-and-certificates
• https://docs.microsoft.com/en-us/azure/key-vault/key-vault-network-security
• https://docs.microsoft.com/en-us/azure/key-vault/key-vault-key-rotation-log-monitoring
• https://docs.microsoft.com/en-us/azure/key-vault/general/backup
• https://docs.microsoft.com/en-us/azure/security-center/defender-for-key-vault-introduction