SC-100 case studies
SC-100 · Put your knowledge to work in context.
SC-100, Microsoft Cybersecurity Architect, is the single exam required for the Microsoft Certified: Cybersecurity Architect Expert credential - but it is not the only requirement. Candidates must first hold at least one associate-level certification from the security, compliance, and identity portfolio: Identity and Access Administrator Associate, Security Operations Analyst Associate, or Cloud and AI Security Engineer Associate. The SC-100 case studies are 5 cases and about 4,079 words.
1Sequencing a 90-Day Hardening Programme at Woodgrove Bank
Woodgrove Bank runs Microsoft 365 E5 for 4,200 staff with password hash sync from a single on-premises AD forest, plus 320 Azure VMs and 900 on-premises servers. Last quarter a peer bank was breached through password spray against legacy IMAP/SMTP authentication, then domain-wide compromise.
849 words, about 4 min2Multi-Tenant SOC Architecture and 24x7 Coverage at Litware
Litware has completed two acquisitions in twelve months and now operates three Microsoft Entra tenants: HQ (5,000 users, contractual EU data residency commitments to customers, Microsoft Sentinel workspace in West Europe), North America (1,800 users, no Sentinel), and APAC (900 users, no Sentinel). All three use Microsoft 365 E5 with the Defender XDR suite.
817 words, about 4 min3Private Endpoint DNS at Scale in a Hub-and-Spoke Manufacturer
A manufacturer runs a hub-and-spoke estate in West Europe: one hub VNet with Azure Firewall and ExpressRoute, 40 spoke VNets owned by six application teams, 1,200 VMs, and 60 PaaS services spanning Storage, SQL, Key Vault and Service Bus. All PaaS resources are migrating to private endpoints.
797 words, about 4 min4Secrets, Customer-Managed Keys and Copilot at a Multi-Tenant SaaS Provider
A SaaS provider runs a multi-tenant platform on AKS: 120 microservices, 35 clusters across three regions, Cosmos DB and Azure SQL holding tenant data, and a Key Vault per region. An external penetration test found that 61 percent of application secrets still live in Kubernetes Secrets or pipeline variables, and that container images reach production without a blocking scan.
828 words, about 4 min5Non-Human Identities and MFA Friction at a National Retailer
A retailer has 8,000 employees, 2,400 enterprise applications and service principals, and 900 app registrations, most created self-service by developers. An audit found that 41 percent of application credentials expire in more than two years, 60 app registrations hold Graph Mail.ReadWrite or Directory.ReadWrite.All, and 300 registrations have no recorded owner.
788 words, about 4 min