Azure AZ-500 cheat sheet

Microsoft Entra ID roles govern directory objects such as users and groups; Azure RBAC roles govern management-plane actions on Azure resources; the two role systems are independent.

Conditional Access policy evaluation combines user/group, device state, location, application, and sign-in risk; access is granted only when all configured grant controls are satisfied.

Risk-based Conditional Access conditions (user risk and sign-in risk) require Microsoft Entra ID P2; baseline Conditional Access requires Microsoft Entra ID P1.

Privileged Identity Management eligible assignments require activation and can enforce approval, MFA, justification, and maximum activation duration.

System-assigned managed identities are created with and deleted with the Azure resource; user-assigned identities are standalone and can be attached to multiple resources.

Azure RBAC assignments are additive and inherited down management group, subscription, resource group, and resource scopes; deny assignments take precedence over allow assignments.

A custom role definition contains Actions, NotActions, DataActions, NotDataActions, and AssignableScopes; AssignableScopes limits where the role can be assigned.

Password protection combines a global banned-password list, an optional custom banned list, and smart lockout; SSPR password writeback requires on-premises infrastructure and Microsoft Entra ID P1.

NSG security rules are evaluated by priority from 100 to 4096, lowest number first; once a rule matches, evaluation stops, and NSGs are stateful.

Default NSG rules allow inbound traffic from the virtual network and Azure load balancer, deny inbound internet traffic, and allow outbound internet traffic.

Application security groups group VM network interfaces so NSG rules can reference an application role instead of individual IP addresses.

Azure Firewall application rules filter HTTP and HTTPS traffic by FQDN; network rules filter by IP address, port, and protocol.

A private endpoint assigns a private IP address from a subnet to a PaaS service; a service endpoint extends the VNet identity to the service over the Azure backbone without a private IP.

Azure Bastion provides browser-based RDP and SSH to VMs without public IP addresses or exposing RDP/SSH ports to the internet.

Network Watcher IP flow verify checks whether a packet is allowed or denied to or from a VM and identifies the NSG rule responsible.

Route-based VPN gateways support BGP, multiple site-to-site connections, and point-to-site; policy-based gateways support only static routing with a single tunnel.

Azure Storage supports authorization with Microsoft Entra ID, shared key, or shared access signatures; disabling shared key forces Entra ID and SAS authorization.

A user delegation SAS is secured with Microsoft Entra credentials and is supported only for Blob storage; service and account SAS are secured with the storage account key.

The storage firewall can allow selected virtual networks and IP addresses, allow trusted Microsoft services, or route access through private endpoints.

Transparent data encryption for Azure SQL can use a service-managed key or a customer-managed key stored in Azure Key Vault; TDE encrypts data and log files at rest.

Always Encrypted protects sensitive columns client-side so the database engine never sees plaintext; it uses column encryption keys wrapped by a column master key.

Key Vault soft delete retains deleted vaults and objects for a retention period; purge protection blocks permanent deletion until the retention period expires.

Just-in-time VM access in Defender for Cloud opens NSG ports only for an approved source IP and time window, then closes them automatically.

An AKS private cluster assigns a private IP to the API server endpoint; access requires a network path such as a jump box, VPN, or ExpressRoute.

Microsoft Defender for Cloud secure score measures security posture; recommendations increase or decrease the score based on resource configuration.

Defender for Servers Plan 2 adds file integrity monitoring, adaptive application controls, just-in-time VM access, and endpoint detection and response.

Adaptive application controls create allowlists of applications for VMs; Defender for Cloud learns application behavior and generates recommendations.

A Microsoft Sentinel scheduled analytics rule runs a KQL query at a set frequency and creates alerts or incidents when the query returns results.

A Sentinel automation playbook is an Azure Logic App triggered by an incident or alert to perform response actions such as isolating a machine or posting to Teams.

Sentinel data connectors ingest logs from sources such as Microsoft 365 Defender, Azure Activity, Microsoft Entra ID, and syslog into the Log Analytics workspace.

Defender for Cloud regulatory compliance dashboards map recommendations to standards such as PCI DSS, ISO 27001, and the Microsoft cloud security benchmark.

Sentinel Fusion analytics uses machine learning to correlate alerts from multiple products into high-fidelity incidents.