Skip to main content
Ace Skills Consulting
Microsoft logoIntermediate

SC-500: Cloud and AI Security Engineer

Protect Azure workloads and the AI services built on them, from identity to posture management — and prepare for SC-500.

  • 32 hours of live, lab-focused sessions
  • Secures a sample workload layer by layer across four days
  • Dedicated day on securing AI and model endpoints
  • Defender for Cloud posture and threat protection in practice
  • Successor path for learners who planned to take AZ-500
Aligned to Microsoft exam SC-500
Duration
4 Days | 32 Hrs
Next batch
Batches on request
Delivery
Live Online · Onsite · Corporate
Level
Intermediate
Exam
SC-500
Language
English

Why learn SC-500 with Ace Skills

  • AI security, not just cloud security

    You secure model endpoints, grounding data and AI search indexes, and examine threats such as prompt injection with practical mitigations.

  • Defence in depth you build yourself

    Identity, network, data and compute controls are layered onto one workload, so you see how each control limits the next attack step.

  • Posture management that scales

    Defender for Cloud, Azure Policy and compliance dashboards show you how to keep many subscriptions secure, not just one.

  • Ready for the AZ-500 successor

    If you were preparing for AZ-500, the course maps your existing knowledge onto the newer SC-500 outline and fills the gaps.

Course overview

Cloud security work has widened. Engineers who once focused on network rules and role assignments now also need to secure model endpoints, prompt data, AI search indexes and the identities that applications use to reach them. This four-day course prepares you for that broader role by securing a realistic Azure workload one layer at a time.

Day one establishes identity and access: Microsoft Entra ID, Conditional Access, Privileged Identity Management, managed identities and Azure role-based access control. Day two hardens the network and platform with network security groups, Azure Firewall, private endpoints, Key Vault and encryption choices for storage and databases.

Day three is dedicated to AI workloads. You will lock down access to AI services, apply network isolation and keyless authentication, configure content safety, protect sensitive data used for grounding and review the threats specific to generative AI applications, such as prompt injection and data leakage. Day four covers security operations: Microsoft Defender for Cloud, regulatory compliance dashboards, workload protection plans and sending signals to Microsoft Sentinel.

Labs build on each other, so you finish with a sample application whose identity, network, data and AI layers you have secured yourself, together with a checklist you can reuse at work.

This course is aligned to the SC-500 exam, reported as the successor to AZ-500, which retired on 31 August 2026. As the exam is new, verify the current skills outline on Microsoft Learn before booking; we revise the course as Microsoft publishes changes.

Key features

  • Layer-by-layer hardening of one sample workload
  • Dedicated AI workload security day
  • Privileged Identity Management and Conditional Access labs
  • Private endpoints, Azure Firewall and Key Vault in practice
  • Defender for Cloud recommendations and secure score
  • Reusable security review checklist
  • 30 days of post-training doubt support

Who should attend

  • Azure security engineers and cloud security specialists
  • Azure administrators taking on security responsibilities
  • Learners who were preparing for the retired AZ-500 exam
  • Engineers deploying AI services in regulated environments
  • Security architects reviewing cloud and AI designs

Prerequisites

  • Hands-on Azure administration experience (AZ-104 level recommended)
  • Understanding of networking and identity concepts
  • Familiarity with security fundamentals (SC-900 level helps)

Curriculum

4 Days · 32 Hours · 13 Modules · 10 Labs

  1. Microsoft Entra ID protection

    • Conditional Access policy design
    • Phishing-resistant MFA
    • Identity Protection risk policies
    • Emergency access accounts
    • Lab: Build Conditional Access policies with report-only testing · 50 min

    Privileged access

    • Privileged Identity Management for Entra and Azure roles
    • Access reviews
    • Least privilege with Azure RBAC and custom roles
    • Just-enough administration
    • Lab: Configure PIM activation with approval for an Azure role · 45 min

    Application and workload identities

    • Managed identities
    • Service principals and credential hygiene
    • Workload identity federation
    • App consent and permissions
    • Lab: Replace stored credentials with a managed identity · 35 min

  2. Network security

    • NSGs and application security groups
    • Azure Firewall and firewall policies
    • Private endpoints and service endpoints
    • Web Application Firewall
    • DDoS protection
    • Lab: Isolate a workload with private endpoints and Azure Firewall · 60 min

    Data protection

    • Azure Key Vault access models
    • Encryption at rest with customer-managed keys
    • Storage account hardening
    • Azure SQL security features
    • Lab: Encrypt storage with a customer-managed key from Key Vault · 40 min

    Compute security

    • VM hardening and Azure Bastion
    • Just-in-time VM access
    • Container registry and AKS security basics
    • App Service authentication and access restrictions

  3. AI service access

    • Keyless authentication to AI services
    • RBAC roles for AI resources
    • Network isolation for model endpoints
    • Quotas and abuse controls
    • Lab: Lock down an AI service with private networking and keyless access · 55 min

    Generative AI threats

    • Prompt injection and jailbreak attempts
    • Data leakage through grounding data
    • Content safety and filtering configuration
    • Threat modelling an AI application
    • Lab: Configure content filters and test with adversarial prompts · 45 min

    Protecting AI data

    • Securing AI Search indexes and data sources
    • Sensitivity labels and Microsoft Purview for AI
    • Logging and auditing AI usage
    • Lab: Restrict a search index with role-based access · 35 min

  4. Microsoft Defender for Cloud

    • Secure score and recommendations
    • Defender plans for servers, storage, databases and AI
    • Regulatory compliance dashboards
    • Attack path analysis
    • Lab: Remediate recommendations and raise secure score · 50 min

    Governance for security

    • Azure Policy for security baselines
    • Security benchmarks
    • Multi-subscription posture management
    • Lab: Assign a security initiative and review compliance · 35 min

    Monitoring and response

    • Diagnostic settings and log collection
    • Connecting Defender for Cloud to Microsoft Sentinel
    • Investigating security alerts

    Exam readiness

    • Exam format and scenario questions
    • Common distractors in security questions
    • Practice questions with review
Download full syllabus (PDF)

Skills you will gain

  • Microsoft Entra ID
  • Conditional Access
  • Privileged Identity Management
  • Managed identities
  • Azure Firewall
  • Private endpoints
  • Azure Key Vault
  • Encryption
  • AI security
  • Content safety
  • Defender for Cloud
  • Azure Policy
  • Threat modelling

Tools & technologies

  • Azure portal
  • Microsoft Entra admin center
  • Microsoft Defender for Cloud
  • Azure Key Vault
  • Azure AI Foundry
  • Azure CLI
  • Microsoft Sentinel

Certification exam

Exam details
Exam nameCloud and AI Security Engineer (SC-500)
Exam codeSC-500
Voucher includedNo — book directly with the vendor
DeliveryOnline proctored or Test centre
Validity & renewal1 year (free online renewal assessment)

Skill areas measured

  1. Secure identity and access
  2. Secure networking
  3. Secure compute, storage and databases
  4. Secure AI workloads
  5. Manage security posture and operations

Exam details are pending verification. Vendors change exams; confirm on the official vendor page before booking. Official exam page (opens in a new tab)

Schedule & Pricing

Live Online

Individual

Price on request

  • 32 hours of live, trainer-led sessions
  • 10 hands-on labs
  • Ace Skills course completion certificate

Onsite

At your office or our centre

Pricing depends on location, group size and dates.

  • Delivered at your premises or an Ace centre
  • Same curriculum and labs as live online
  • Dates planned around your team

Corporate / Team

Private batch for your organisation

A private batch with content adapted to your environment and goals.

  • Customised curriculum
  • Private batch, online or onsite
  • Progress and assessment reports
  • GST invoice and PO-based billing

No public batches scheduled — Talk to an Advisor for a private batch.

Projects & labs you will build

  • Day 2 · 60 min

    Isolate a workload with private endpoints and Azure Firewall

  • Day 3 · 55 min

    Lock down an AI service with private networking and keyless access

Your certificate

Certificate of Completion — Ace Skills Consulting

Awarded on completing the course. It records the course title and training hours, and you can share it on your LinkedIn profile.

The Microsoft certification itself is awarded by Microsoft when you pass exam SC-500.

Frequently asked questions

I was preparing for AZ-500. Should I switch to this course?

Yes. AZ-500 retired on 31 August 2026, and SC-500 is the reported successor; most AZ-500 topics carry over, with added depth on AI workloads.

Do I need AI experience?

No. We explain how AI services are deployed and used before securing them, so a general Azure background is enough.

How much of the course is hands-on?

Every day has two or three guided labs, and together they harden a single sample workload from identity through to posture management.

What happens if Microsoft updates the SC-500 exam?

We map the curriculum to the current published skills outline and revise it when Microsoft changes the exam. Always check the latest outline on Microsoft Learn before booking.

Do you run weekend batches?

Yes. Weekend batches cover the same 32 hours across consecutive Saturdays and Sundays, with timings in IST that also suit learners in the Gulf.

Can you run a private batch for our team?

Yes. We run private online or onsite batches for corporate teams, and we can weight the labs towards your security baseline and compliance needs. Request a corporate quote with your team size and preferred dates.

Related courses

Explore more

All Microsoft Azure courses Microsoft certifications

Microsoft, Azure, Microsoft 365, Power BI and Microsoft Entra are trademarks of the Microsoft group of companies.

Train your team on SC-500

Private batches online or at your office in India and the GCC, with a curriculum adapted to your environment.