Complete AZ-500 study guide — identity, compute, storage, networking security, and security operations on Azure.
This guide works best as a loop: read a chapter, test yourself with practice questions, look up unfamiliar terms in the glossary, then move to the next chapter.
103 chapters covering every exam objective. Each chapter includes key concepts, exam tips, common traps, comparison tables, and a 5-question quiz at the end.
Start Chapter 1Free timed and untimed practice with instant feedback and full explanations. Pick 10–120 questions per session. Filter by domain to drill your weak areas.
Go to practice testEvery AZ-500 term defined and searchable. Use it when a chapter mentions a concept you haven't seen before or want a quick refresher on.
Browse glossaryExam blueprint, domain weights, passing score, duration, cost, and registration links. Start here if you're new to this certification.
View exam guide22 chapters
Securing Microsoft Entra ID
Objective 1.1 · Identity Access
Privileged Identity Management (PIM)
Objective 1.2 · Identity Access
Managed Identities for Azure Resources
Objective 1.3 · Identity Access
Conditional Access Policies
Objective 1.4 · Identity Access
Just-In-Time (JIT) VM Access
Objective 1.2
Managed Identities vs Service Principals
Objective 1.3
Privileged Identity Management for AZ-500
Objective 1.2
Access Reviews and Governance
Objective 1.4
Zero Trust Architecture in Azure
Objective 1.4
Microsoft Entra Identity Protection
Objective 1.4
Workload Identity and Federated Credentials
Objective 1.3
App Registrations and Service Principals
Objective 1.3
Subscription Security and Management Group Policy
Objective 1.4
Entra ID Named Locations and Conditional Access
Objective 1.4
Azure Lighthouse for Managed Security Services
Objective 1.2
Guest User Policies and External Collaboration
Objective 1.1
Entra ID Built-In Directory Roles
Objective 1.1
Azure RBAC Role Assignments at Scale
Objective 1.1
Custom RBAC Roles in Azure
Objective 1.1
Microsoft Entra External ID Security
Objective 1.1
OAuth 2.0 and OpenID Connect in Azure
Objective 1.1
Microsoft Entra Identity Secure Score
Objective 1.4
25 chapters
Azure VM Security
Objective 2.1 · Compute Security
Container Registry and AKS Security
Objective 2.2 · Compute Security
Azure Storage Security
Objective 2.4 · Compute Security
Azure SQL Database Security
Objective 2.5 · Compute Security
Azure Key Vault
Objective 2.3 · Compute Security
Encryption at Rest in Azure
Objective 2.3
Encryption in Transit: TLS and HTTPS
Objective 2.3
Shared Access Signatures (SAS) for Storage
Objective 2.4
Azure SQL Auditing and Advanced Threat Protection
Objective 2.5
Customer-Managed Keys (CMK) in Key Vault
Objective 2.3
Azure Disk Encryption with Azure Key Vault
Objective 2.1
Azure Container Security Best Practices
Objective 2.2
AKS Security: RBAC, Network Policies, Pod Identity
Objective 2.2
App Service Security and Authentication
Objective 2.1
Cognitive Services and AI Security
Objective 2.5
Azure SQL Advanced Threat Protection
Objective 2.5
Dynamic and Static Data Masking in Azure SQL
Objective 2.5
TDE with Customer-Managed Keys in Key Vault
Objective 2.3
Key Vault Access Policies vs RBAC
Objective 2.3
Key Vault Soft Delete and Purge Protection
Objective 2.3
Key Vault Firewall and Private Endpoint
Objective 2.3
Container Registry Security Scanning
Objective 2.2
Azure Managed HSM vs Key Vault Standard
Objective 2.3
Storage Threat Detection and Defender for Storage
Objective 2.4
Azure Functions Security
Objective 2.1
17 chapters
Virtual Network Security
Objective 3.1 · Network Security
Azure Firewall and DDoS Protection
Objective 3.2 · Network Security
Private Endpoints and Service Endpoints
Objective 3.3 · Network Security
NSG Flow Logs and Network Watcher
Objective 3.1
Application Security Groups (ASGs)
Objective 3.1
Web Application Firewall (WAF)
Objective 3.2
Azure Bastion for Secure Access
Objective 3.3
Azure DDoS Protection: Basic vs Standard Tiers
Objective 3.2
Azure Network Security Perimeter
Objective 3.1
Azure Private Link Service
Objective 3.3
Azure DDoS Protection Tiers and Policies
Objective 3.2
Azure Firewall Premium: IDPS and TLS Inspection
Objective 3.2
Private Endpoints and DNS Resolution
Objective 3.3
Service Tags in Network Security Groups
Objective 3.1
Azure API Management Security Policies
Objective 3.3
Azure DDoS Telemetry and Diagnostics
Objective 3.2
VNet Peering Security Considerations
Objective 3.1
39 chapters
Microsoft Defender for Cloud
Objective 4.1 · Security Operations
Microsoft Sentinel SIEM
Objective 4.2 · Security Operations
Security Policies and Benchmarks
Objective 4.3 · Security Operations
Incident Response in Azure
Objective 4.4 · Security Operations
Azure Policy for Security Compliance
Objective 4.3
Azure Blueprints for Regulatory Compliance
Objective 4.3
Microsoft Defender for Servers
Objective 4.1
Microsoft Defender for SQL
Objective 4.1
Microsoft Defender for Containers and AKS
Objective 4.1
Log Analytics Workspace for Security
Objective 4.2
Microsoft Cloud Security Benchmark
Objective 4.3
Regulatory Compliance Dashboard in Defender
Objective 4.3
Microsoft Defender for Endpoint Integration
Objective 4.1
Microsoft Defender for Identity
Objective 4.1
Microsoft Defender for Cloud Apps (MCAS)
Objective 4.1
Sentinel Analytics Rules and Incidents
Objective 4.2
Sentinel Playbooks and Logic Apps Automation
Objective 4.2
KQL Queries for Security Operations
Objective 4.2
UEBA in Microsoft Sentinel
Objective 4.2
Threat Hunting in Microsoft Sentinel
Objective 4.2
MITRE ATT&CK Mapping in Defender
Objective 4.2
Security Alerts and Smart Alert Groups
Objective 4.1
Microsoft Defender for DevOps
Objective 4.1
Securing GitHub Actions Pipelines
Objective 4.1
Azure DevOps Security Controls
Objective 4.1
Azure Policy Exemptions and Compliance Scoring
Objective 4.3
Defender for APIs
Objective 4.1
Software Supply Chain Security on Azure
Objective 4.1
Azure Policy Effects: Deny, Audit, DeployIfNotExists
Objective 4.3
Microsoft Secure Score Strategy
Objective 4.3
Sentinel Security Workbooks and Dashboards
Objective 4.2
Log Analytics Workspace Design for Security
Objective 4.2
NIST, CIS, PCI-DSS Compliance in Azure
Objective 4.3
Defender for Cloud Attack Path Analysis
Objective 4.1
Entra ID Audit Logs and Sign-In Logs
Objective 4.2
Defender for Cloud Alert Rules and Suppression
Objective 4.1
Sentinel Threat Maps and Security Dashboards
Objective 4.2
Policy as Code with Bicep and Terraform
Objective 4.3
Azure Monitor Diagnostic Settings for Security
Objective 4.2
Free AZ-500 practice questions with full explanations. Test what you learn chapter by chapter.
AZ-500 Practice Questions