Design security solutions for applications and data
Protect the code path and the data path
Application security here splits into build-time, run-time, and identity-for-apps. At build time, Defender for Cloud DevSecOps capabilities connect to repositories and pipelines to surface code, secret, and dependency findings alongside infrastructure-as-code misconfiguration. At run time, Web Application Firewall on Azure Front Door or Application Gateway covers OWASP-class attacks, API Management with Defender for APIs covers API discovery and abuse detection, and Defender for Cloud Apps (a CASB) covers sanctioned and unsanctioned SaaS - shadow IT discovery, session controls, app governance.
For application identity, prefer managed identities over secrets so there is nothing to rotate or leak; where secrets are unavoidable, use Key Vault with RBAC and rotation. Microsoft Entra External ID handles customer-facing CIAM; B2B collaboration handles partner access into your tenant.
Data protection is layered. Classification comes first - sensitivity labels in Microsoft Purview drive DLP, encryption, and retention wherever data travels, including endpoints and SaaS. In Azure SQL, Transparent Data Encryption protects the database file and backups; Always Encrypted protects individual columns so even administrators see ciphertext, with the key held by the client - that distinction is what exam questions test.
Traps: TDE does not protect data from a privileged database user; Always Encrypted does. Sensitivity labels are policy metadata that travel with the file; DLP is the enforcement. WAF defends against web attack patterns but is not a substitute for authentication.
Rule of thumb: identify the asset (app, secret, data), then the boundary it crosses. Encryption choice follows the boundary, not the service name.
Worked example: DBAs must not read card numbers, but queries must still filter on them. Answer: Always Encrypted with deterministic encryption on the searched column, keys in Key Vault, client driver authorized.