Implement end‑to‑end security controls for cloud and AI workloads
SC-500(4 days)
Implement end‑to‑end security controls for cloud and AI workloads
18.800 DKK
(excl. VAT)
Course calendar
Description
Securing modern IT environments today is about more than networks and servers. Identities, data, applications, compute and the AI services that draw on them must be protected as a coherent whole across cloud, hybrid and multicloud. In this course, you learn to design, implement and operate exactly this kind of end-to-end security controls with Microsoft's security technologies in Azure and Microsoft 365.
You start with identity, access and governance, the foundation of all cloud security. You work with Microsoft Entra ID, including Privileged Identity Management (PIM), conditional access, MFA, passwordless and managed identities, and you learn to protect secrets and keys in Azure Key Vault. You also get a handle on governance with Azure Policy, RBAC and compliance assessment in Microsoft Defender for Cloud.
From there, you move on to securing storage, databases and networks: storage accounts and Azure SQL, network security groups, private endpoints, Azure Firewall and secure connectivity via VPN and Microsoft Entra Private Access. You also work with securing compute, both servers and virtual machines (with disk encryption, Azure Bastion and just-in-time access) and container-based platforms such as AKS, App Service and Azure Functions.
A key focus of the course is securing AI workloads. You learn to identify data exposure in SharePoint, assess risks around Microsoft Copilot and AI apps with Microsoft Purview DSPM, and control access for autonomous agents with Microsoft Entra Agent ID. You also work with guardrails for agents in Microsoft Foundry and monitoring of AI security in Microsoft Defender for Cloud.
Finally, you learn to keep an eye on your overall security posture. You work with posture management in Microsoft Defender for Cloud, collection and analysis of events in Microsoft Sentinel, and how Microsoft Security Copilot can support your security work. The course combines instructor-led teaching with hands-on labs in real Azure environments.
After the course, you can:
- Secure access to resources with Microsoft Entra ID, PIM and conditional access
- Protect secrets, keys and certificates in Azure Key Vault
- Implement governance and compliance with Azure Policy, RBAC and Defender for Cloud
- Secure storage accounts, Azure SQL databases and Azure networks
- Protect servers, virtual machines and container-based platforms
- Secure AI workloads, Copilot scenarios and autonomous agents
- Monitor security posture with Defender for Cloud and Microsoft Sentinel
- Use Microsoft Security Copilot in your day-to-day security work
The course is aimed at security engineers who plan and implement security controls across cloud, hybrid and multicloud environments. It is a good fit if you work closely with architects, administrators and developers to protect identities, infrastructure, data and AI solutions with Microsoft's security stack.
Related exam
Prerequisites
To get the most out of the course, we recommend experience or knowledge equivalent to:
Next steps
If you want to build on your skills, these may be relevant:
Certification bundles
Module overview
Learn to design and implement strong authentication controls, apply Just-in-Time privileged access strategies, and extend identity-based security to AI-powered applications using Microsoft Entra.
Lessons:
- Manage and implement authentication methods in Microsoft Entra ID
- Implement and configure Privileged Identity Management (PIM)
- Authenticate your API plugin for declarative agents with secured APIs
Implement a defense-in-depth security strategy for Azure Key Vault. Configure hardened vault settings, control access through RBAC and just-in-time privilege, manage keys, secrets, and certificates, and detect threats using Microsoft Defender for Key Vault and Defender CSPM.
Lessons:
- Configure and secure Azure Key Vault
- Manage keys and secrets in Azure Key Vault
- Manage certificates and monitor Azure Key Vault
- Protect Azure Key Vault with Microsoft Defender for Cloud
Enforce security governance and regulatory compliance across Azure environments using Azure Policy, Microsoft Defender for Cloud, Azure RBAC. Then enable Azure Backup security features, and infrastructure as code scanning.
Lessons:
- Enforce governance with Azure Policy and resource locks
- Configure security controls and remediate recommendations in Defender for Cloud
- Evaluate regulatory compliance in Defender for Cloud
- Manage and right-size RBAC role assignments for least privilege
- Protect backup data with Azure Backup security features
- Implement security controls in infrastructure as code
Implement a defense-in-depth security strategy for Azure Storage. Harden storage accounts, govern access with Microsoft Entra ID and stored access policies, enforce network perimeter controls using firewall rules and private endpoints, and enable Microsoft Defender for Storage to detect threats from malicious uploads and compromised AI agent credentials.
Lessons:
- Describe Azure storage services
- Implement security and manage access for Azure Storage
- Configure network security for Azure Storage
- Implement Microsoft Defender for Storage
Implement end-to-end security for Azure SQL Database and SQL Managed Instance. Configure Entra ID authentication with managed identity access, deploy private endpoints, and apply encryption and access controls to protect sensitive financial data. Establish compliant audit trails and enable Microsoft Defender for Databases to detect SQL injection, anomalous access, and vulnerability exposures.
Lessons:
- Configure platform-level security for Azure SQL
- Configure auditing for Azure SQL Database and SQL Managed Instance
- Implement Microsoft Defender for Databases
Implement defense-in-depth network security controls in Azure. Segment workloads to control lateral movement, centralize traffic inspection with Azure Firewall, harden remote and hybrid connectivity, and eliminate public network exposure of PaaS and AI services using private endpoints.
Lessons:
- Segment and isolate Azure workloads using network security controls
- Centralize and enforce traffic inspection using Azure Firewall
- Secure remote and hybrid connectivity using VPN gateways and Microsoft Entra Private Access
- Eliminate public network exposure of Azure PaaS services
Implement a defense-in-depth security strategy for AI workloads across Microsoft's AI platform. Configure data security posture management in Microsoft Purview, secure agent identities in Microsoft Entra, and analyze AI identity risks in Microsoft Defender XDR. Then, enable real-time agent protection in Microsoft Defender, configure AI Gateway security in Microsoft Foundry, manage guardrails, protect AI workloads with Defender for Cloud, and govern agents with Microsoft Agent 365.
Lessons:
- Secure access for Microsoft Entra Agent Identity
- Analyze AI identity risks using Microsoft Defender XDR
- Enable real-time protection for Copilot Studio agents
- Configure AI Gateway security in Microsoft Foundry
- Configure and manage guardrails in Microsoft Foundry
- Protect AI workloads with Microsoft Defender for Cloud
- Enable Defender for AI Services workload protection in Microsoft Defender for Cloud
- Manage agents using Microsoft Agent 365
- Identify AI data risks using Microsoft Purview Data Security Posture Management
Implement layered security controls across Azure virtual machines and Arc-enabled hybrid servers. Configure disk encryption, Trusted Launch, Azure Bastion, Microsoft Defender for Servers, just-in-time VM access, and Azure Machine Configuration to close security gaps across your server estate.
Lessons:
- Implement disk encryption for Azure virtual machines
- Configure trusted launch security features for Azure virtual machines
- Plan and implement Azure Bastion
- Manage security for Arc-enabled hybrid servers
- Implement Microsoft Defender for Servers
- Enable and enforce just-in-time VM access
- Enforce VM security configuration with Azure Machine Configuration
Implement security controls across Azure application platform services—from container workloads to the API layer. Configure Microsoft Defender for Containers, secure Azure Kubernetes Service (AKS), Azure Container Registry (ACR), Container Instances, and Container Apps. Then apply authentication, network access, and policy controls across Azure Function apps, Logic apps, App Services, Web Application Firewall, and Azure API Management.
Lessons:
- Detect container risks using Microsoft Defender for Containers
- Implement security controls for Azure Kubernetes Service
- Implement security controls for Azure Container Registry, Container Instances, and Container Apps
- Implement security controls for Azure Function apps and Logic apps
- Implement security controls for Azure App Services and Web Application Firewall
- Implement API backend security using Azure API Management
Learn to manage cloud security posture using Microsoft Defender for Cloud. You connect hybrid and multicloud environments, identify risks, and assess compliance—then protect your workloads with threat detection and vulnerability management.
Lessons:
- Connect hybrid and multicloud environments to Microsoft Defender for Cloud
- Identify security risks by using Cloud Security Posture Management
- Discover unprotected assets and vulnerabilities by using Microsoft Defender External Attack Surface Management
- Evaluate regulatory compliance in Defender for Cloud
- Enable and configure workload protection plans in Microsoft Defender for Cloud
- Configure Microsoft Defender Vulnerability Management settings for Azure VMs
Build a complete event collection and response architecture in Microsoft Sentinel. Set up and secure a Microsoft Sentinel workspace, deploy Content Hub solutions, connect Azure resource data, collect Linux and Windows security events with data collection rules, implement automated response workflows with Logic Apps playbooks, and manage data retention for compliance.
Lessons:
- Create and manage Microsoft Sentinel workspaces
- Manage content in Microsoft Sentinel
- Connect Microsoft services to Microsoft Sentinel
- Connect syslog data sources to Microsoft Sentinel
- Connect Common Event Format logs to Microsoft Sentinel
- Connect Windows hosts to Microsoft Sentinel
- Implement automation rules and playbooks in Microsoft Sentinel
- Manage data storage and query audit logs in Microsoft Sentinel
Build hands-on expertise with Microsoft Security Copilot. Start with enabling the solution and writing effective prompts to configuring enterprise workspaces and managing plugins and agents at scale.
Lessons:
- Describe Microsoft Security Copilot
- Configure workspaces for Microsoft Security Copilot
- Manage plugins and agents in Microsoft Security Copilot
Free course advice
We care a lot about helping you find the course path that creates the most value for you and your workplace. Get in touch with our course advisors — they're ready to help you, free of charge and with no obligation.
I can't give anything less than 5 stars across the board. Either you're truly in a class of your own, or I've just been to the wrong course venues before. Fantastic place and atmosphere.... once you've learned to find your way around :-)
Your instructors are exceptional; skilled, competent and good at teaching - so you have everything you need to get off to a good start.
You have fantastic facilities, good food and lovely people throughout the building.
A really good, in-depth course. Your course facilities at Karlebogaard are nothing short of fantastic. A beautiful historic house with lots of fun stories and great course rooms. The course itself was very useful. I learned everything I had hoped to and then some. My instructor was damn good and really funny. He made it a pleasure, and the hours flew by.
Probably the best course I've ever taken and the best instructor I've ever had!! Really good depth and thorough explanations, and on top of that, fantastic food!!!
Delicious food, cozy facilities, good structure and atmosphere. I'll be back when I can.
Absolutely the best course I've ever taken!
The course venue is so inviting and welcoming that it has been a pleasure to be here. Clean, tidy and full of charm. I attended a course where all the individual parts came together into a greater whole that can hardly be described.
I got a lot out of the course. It opened my eyes to possibilities I didn't know existed. I'm sure this won't be the last time we're in touch with SuperUsers.
I never in my wildest dreams imagined that a course venue could be so beautiful. I don't know if it's true, but I have a feeling that the surroundings rub off on the people who work here, so everyone seems incredibly happy.
There's a really great atmosphere. All the way from the woman at the reception desk to the people who work in the kitchen.
The instructor tailored the course to my level to a very large extent and was flexible. I had very high expectations, and they were exceeded.
Great precision, good exercises, good pace, a great atmosphere and maximum learning.
The instructor was very pleasant and the exercises were extremely good. I really learned a lot about the topics the course covered.
On top of that, really nice, calm and green surroundings with good catering - especially good food. I would like to take my courses here again next time.
It was a real pleasure to take a course at SuperUsers. The week we spent on the course was worth the money and means that we can now save many consultant hours. It's always nice to have the knowledge in-house.
There is a relaxed atmosphere in the classroom, lovely surroundings in the building itself, and skilled instructors who do a really good job.
I started using all the knowledge I soaked up on the course almost right away, and now we are well underway with developing our future cloud solution.
There is no doubt about who we will turn to if we need other courses.
This is my first time at SuperUsers. It has been a really good experience. The instructor seems very experienced and competent.
The instructor's strong technical background made the course and the in-depth answers to questions a good experience.
A really nice course venue in pleasant surroundings that make for a good setting for focused learning. The instructor came across as well prepared, with extensive knowledge of the relevant topics.
The instructor also showed a strong ability to answer any questions that came up during the course.
I'll be back the next time I need to take a course. It's a lovely place, the food is fantastic, and the instructor is very knowledgeable and happy to share that knowledge!
The technical depth of the course was really good. The instructor's knowledge went much deeper than the curriculum necessarily requires.
You could throw all kinds of curveballs at the instructor, and he had it all under control - he also made the content exciting.
We have now completed Microsoft 365 courses for a total of 5 people here in our department. Everyone agrees that it was an excellent course with a skilled instructor and communicator who could discuss and explain things at the right level, while also being efficient and bringing humor.
It has been a really good experience.
It's calm and quiet at SuperUsers' country venue. Good atmosphere and catering. Some thought has gone into healthy eating when it comes to food and cake, so it doesn't get completely out of hand.
The instructor is knowledgeable about the topics and readily puts them in a broader perspective by relating them to other relevant areas. It's rewarding that this is possible too, and it gives you ideas for further study.
In addition, the instructor was engaged and entertaining to have presenting the content.
As always, it was a great experience, and you learn a lot in a short time from some very skilled instructors.
I work in Azure almost every day, and both courses have been really good at helping me understand Azure better.
The instructor is very presentation-oriented and gets you involved in the teaching and the material. He is good at varying the teaching so it never gets monotonous.
It is clear that the instructor has hands-on experience and not just the theory, with many good examples that related to real-world challenges we might encounter.
Good facilities and good food, without drowning in unhealthy habits.
Very good course, the instructor was the best. I've been here at SuperUsers before, now I'm here again, and hopefully coming back another time.
The instructor seemed very competent and has extensive knowledge of his field. He was good at explaining things in a clear and humorous way. There were also simple exercises that gave a good understanding.
The instructor was really good at going in depth while still making sure everyone was keeping up. A really nice venue and room, and great food.
There was no doubt that the instructor knew exactly what he was talking about, and even the simplest questions were answered gladly, without anyone being made to feel stupid.
A lovely, cozy place where the receptionist, the kitchen and the instructors make you feel at home. A good setting makes for good learning. Really good food that helps round out the whole experience of taking a course at SuperUsers.
Really happy with the venue and the stay over in the horse stable. I'll see if I can come back here for the next course I take. A really beautiful building, and great to experience a place like this. A fantastic place to hold a course.
