SC-100 cheat sheet

Zero Trust rests on three principles: verify explicitly, use least privilege access, and assume breach; every design decision should map to at least one of them.

Shared responsibility by service model: IaaS leaves the guest OS, runtime, apps, identity and data with the customer; PaaS adds OS/runtime to Microsoft's side; SaaS leaves only data, identity configuration and device posture with the customer.

Defense in depth order is physical, identity, perimeter, network, compute, application, data; in cloud designs identity and data layers carry the most weight because the physical and network perimeter is Microsoft-managed.

The Microsoft Cloud Security Benchmark (MCSB) is the control framework behind Defender for Cloud Secure Score; it maps to NIST SP 800-53, CIS Controls and PCI DSS so one control set satisfies several regulations.

Cloud Adoption Framework phases are strategy, plan, ready, adopt, govern and manage; landing zones are produced in the Ready phase and supply identity, network, policy and logging baselines before workloads land.

STRIDE enumerates threats as Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege; apply it per data flow during threat modeling of a proposed architecture.

Ransomware resilience baseline: three copies of data on two media with one offline or immutable, plus soft delete and immutable blob containers on the backup vault so recovery points cannot be purged by a compromised admin.

Data residency and regulatory scope are decided before feature selection: pick geography, sovereign or regional cloud, and Azure Policy initiatives that deny resource creation outside approved regions.

Microsoft Sentinel is the cloud-native SIEM/SOAR layer: data connectors ingest logs, analytics rules create detections, automation rules and playbooks (Logic Apps) respond, watchlists enrich, workbooks visualize.

Defender XDR correlates incidents across Defender for Endpoint, Identity, Office 365, Cloud Apps and Sentinel inside a single portal; advanced hunting uses KQL across all of those signal sources.

A Conditional Access policy is assignments (users/groups, cloud apps) plus conditions (sign-in risk, user risk, device state, location, client app) producing grant controls (MFA, compliant or hybrid-joined device, terms of use) or block.

Conditional Access needs Entra ID P1; risk-based policies driven by Identity Protection sign-in and user risk require Entra ID P2, where risky users can be forced into a password reset.

Privileged Identity Management makes roles eligible rather than permanent, requiring approval, MFA, justification and a time bound, and access reviews provide periodic attestation of who still needs the role.

Entra Permissions Management is the CIEM tool for Azure, AWS and GCP: it discovers, right-sizes and monitors entitlements to remove unused permissions that create lateral movement paths.

A Purview sensitivity label applies encryption, content marking and usage rights that travel with the item; a DLP policy instead acts on items in specific locations such as Exchange, SharePoint, OneDrive, Teams and endpoints.

Compliance Manager maps Microsoft-managed and customer-managed controls to a regulation, lists improvement actions worth points, and rolls them into a tenant compliance score per assessment.

Adaptive Protection links Purview insider risk management risk levels to DLP policy enforcement, so users under elevated risk get stricter blocking without a separate policy authoring cycle.

Network security groups are stateful Layer 3/4 rule sets evaluated by priority from 100 to 4096 on subnets and NICs; default rules allow VNet-to-VNet traffic and deny inbound internet, and application security groups group VMs by workload role instead of IP.

Layer choice for inbound protection: DDoS Protection Standard or Network absorbs volumetric attacks, WAF on Application Gateway or Front Door handles Layer 7 web exploits, and NSGs segment east-west traffic.

Azure Firewall Premium adds TLS inspection, IDPS and URL filtering; Standard already provides FQDN filtering, threat intelligence and centralized policy; Firewall Manager pushes one policy to many hubs.

A private endpoint consumes a private IP from your VNet for a PaaS service via Private Link; set public network access to Disabled so the private path is enforced, not optional.

Azure Bastion gives browser or native-client RDP/SSH over TLS without public IPs on VMs and without opening 3389/22 to the internet; Defender for Cloud just-in-time access instead opens NSG rules temporarily for approved source IPs and revokes them.

Azure Policy pipeline: definition to initiative to assignment with scope and exclusions; effects are Deny, Audit, Append, Modify, DeployIfNotExists and AuditIfNotExists, and DeployIfNotExists/Modify require a managed identity plus a remediation task for existing resources.

Encryption tiers: platform-managed keys are default, customer-managed keys in Key Vault give control and revocation, and double encryption at the platform adds a second independent layer for specific regions and services.

Key Vault Standard/Premium keeps keys in software or a FIPS 140-2 Level 2 HSM; Managed HSM gives single-tenant, FIPS 140-3 Level 3 validated hardware when key custody rules demand it.

Defender for Cloud provides CSPM posture scoring plus optional workload plans (servers, storage, SQL, containers, Key Vault, App Service) and extends multicloud coverage through AWS/GCP connectors and Azure Arc for on-premises servers.

Shift-left pipeline controls: secret scanning for committed credentials, code scanning with CodeQL for injection and auth flaws, dependency scanning for vulnerable packages, and IaC scanning; Defender for Cloud DevOps security aggregates GitHub and Azure DevOps findings as recommendations.

Prefer managed identities over service principals with secrets: system-assigned identity shares the resource lifecycle and cannot be reused, user-assigned identity is standalone and shareable across resources for least-privilege scoping.

API and app edge design: validate OAuth2/OIDC tokens at API Management with rate limiting and IP filtering, put Front Door WAF in front for Layer 7 protection, and never embed secrets in client-side code.

SQL data protection splits by state: TDE encrypts database, log and backup at rest; Always Encrypted protects data in use because the client driver holds the keys, with the trade-off that the engine cannot compute on those columns.

Confidential computing uses hardware trusted execution environments so memory is encrypted while in use and the host OS or hypervisor cannot read enclave contents; used for multi-party and key-management workloads.

Purview classification combines built-in sensitive information types, trainable classifiers and exact data match; auto-labeling applies sensitivity labels at rest or in flight so encryption follows the content.

Purview encryption binds usage rights to identities through Azure Rights Management, so a labeled file stays protected after it leaves the tenant, unlike transport-only protections.

Restrict Microsoft engineer access to tenant data with Customer Lockbox, which requires explicit, audited, time-limited customer approval before any support access to content occurs.

Backup and recovery design for data: enable soft delete, immutable vaults and multi-region redundancy on the recovery service so an attacker with data-plane rights cannot destroy retention.