Cloud Security — Verify, Limit, Watch

Course overview

Most cloud breaches don't start with movie-style hacking. They start with a stolen password, an account with too much access, or activity nobody was watching. DCT's Cloud Security program is built around three controls:

1. Verify sign-in — every person and app proves who they are, strongly.
2. Limit access — least privilege, just-in-time, segmented networks, protected data.
3. Watch activity — logs, alerts, posture scores and a plan for when something goes wrong.

You'll practice each in Microsoft Entra, Azure and Microsoft Purview, and finish ready for SC-900: Microsoft Security, Compliance, and Identity Fundamentals.

Certification alignment

Where this leads: SC-500 Cloud and AI Security Engineer Associate (replaced AZ-500, which retired August 31, 2026), SC-200 (Security Operations Analyst), SC-300 (Identity and Access Administrator). Existing AZ-500 holders keep their credential until it expires but cannot renew it — they must pass SC-500 to stay current.

Learning outcomes

1. Explain shared responsibility, defense in depth, Zero Trust, encryption vs. hashing, and GRC.
2. Configure MFA, passwordless methods and Conditional Access; protect emergency ("break glass") accounts.
3. Apply least privilege with RBAC, PIM and access reviews.
4. Describe and use Azure network and infrastructure protections: NSGs, Firewall, WAF, DDoS, Bastion, Key Vault.
5. Read a Defender for Cloud secure score; explain Defender XDR and Microsoft Sentinel.
6. Describe Purview: sensitivity labels, DLP, retention, insider risk, eDiscovery, audit, Compliance Manager.
7. Run a basic incident response tabletop.

Lab environment

A free Azure subscription plus a Microsoft Entra ID P2 / Microsoft 365 E5 trial (or a Microsoft 365 Developer Program sandbox if eligible) to try Conditional Access, PIM and Purview. Never practice on your employer's production tenant.

Module 1 — Security concepts that never change

1.1 Shared responsibility

The provider secures the cloud; you secure what you put in it. Data, devices, accounts and identities are always yours (see AZ-900 Lesson 1).

1.2 Defense in depth

Layers: physical → identity & access → perimeter → network → compute → application → data. Each layer buys time and limits damage.

1.3 Zero Trust

• Verify explicitly — use every signal: user, device health, location, risk.
• Use least-privilege access — just-in-time and just-enough.
• Assume breach — segment, encrypt, monitor, and limit blast radius.

Dope Translation: Old-school security was the club with one bouncer at the front door — get past him and you can go anywhere, VIP included. Zero Trust puts a check at every door inside, and the wristband expires at midnight.

1.4 Encryption and hashing

1.5 Governance, risk and compliance (GRC)

• Governance: the rules and who owns decisions.
• Risk: what could go wrong × how likely × how bad.
• Compliance: meeting laws, regulations and standards (e.g., NIST SP 800-53, FedRAMP, HIPAA, FERPA, CJIS, PCI DSS). Also: data residency, data sovereignty, data privacy.

1.6 Identity concepts

Authentication vs. authorization; identity providers (IdP) like Microsoft Entra ID; directory services (Active Directory); federation (trust between IdPs so one sign-in works across organizations).