SC-500 identity, access and governance
Manage identity, access, and governance is worth 20–25% of SC-500. It has three parts: securing access with Microsoft Entra ID, protecting secrets with Azure Key Vault, and enforcing governance across the estate. Experienced engineers tend to be strong on the first two and casual about the third — which is where the marks leak.
Securing access with Entra ID
Six objectives, each with a clear scenario signature:
| Objective | The scenario that wants it |
|---|---|
| Privileged Identity Management | Standing admin access must become time-bound and approved |
| Conditional access | Access depends on conditions — device, location, risk |
| MFA and passwordless | Authentication strength must increase |
| Identity for applications | An app needs its own identity (enterprise apps, app registrations) |
| OAuth permission grants and consent | Users are consenting to third-party apps unchecked |
| Managed identities | An Azure resource must authenticate without a stored secret |
The distinction worth drilling: PIM controls how long you hold a role, conditional access controls the conditions under which you sign in. Questions frequently offer both, and only one matches the requirement.
Managed identities remain the reliable heuristic across the whole exam: whenever an option removes a stored credential, it is usually right.
Key Vault
Deploy it, configure its settings, control access to it, and configure its firewall. Manage keys, secrets and certificates. Then two protection objectives that are easy marks because they name the product:
- Scan for secrets using Defender CSPM — finding credentials that escaped into code and configuration.
- Defender for Key Vault — threat protection on the vault itself.
Key Vault questions usually hinge on layering: a vault with permissive network access is not secured by access policies alone, and a vault reachable from anywhere is a finding regardless of who can read it.
Governance
Nine objectives and the most underestimated section of the domain:
- Azure Policy, built-in and custom definitions — the mechanism for enforcing a configuration standard rather than reporting on it.
- Regulatory compliance in Defender for Cloud — evaluating against frameworks.
- Security standards and recommendations in Defender for Cloud — assessing posture.
- Resource locks — preventing deletion or modification of a resource.
- Built-in role assignments and custom roles, both Azure and Entra.
- Remediating overprivileged access with RBAC — finding and cutting excessive permissions.
- Backup protection with Azure Backup security features.
- Security controls through infrastructure as code.
The recurring distinction here is enforce versus assess. Azure Policy prevents or remediates non-compliant resources. Defender for Cloud evaluates and recommends. A scenario saying “must not be able to create” wants Policy; one saying “need visibility into compliance” wants Defender for Cloud.
Backup protection with Azure Backup security features
The governance objective on backup is not about choosing backup types or RPO targets. It asks you to configure the controls that keep backups recoverable when an attacker, or a careless admin, already has access to the vault. Know which control answers which threat:
| Control | What it stops |
|---|---|
| Soft delete | Deleted backup data is kept in a soft-deleted state for 14 days by default, extendable up to 180 days, and can be recovered. Microsoft now enforces it by default (“secure by default”), so it can’t be switched off in regions where that applies. |
| Immutable vault | Blocks operations that would lose recovery points, such as stopping protection with data deletion or cutting policy retention. Enabled can be reversed; enabled and locked cannot. |
| Multi-user authorization (MUA) | Critical operations (disabling soft delete, removing MUA, reducing retention, changing encryption settings) also need permission on a separate Resource Guard, owned by a security admin. |
| Encryption | Platform-managed keys by default; customer-managed keys from Key Vault via the vault’s managed identity, with soft delete and purge protection on the key vault. |
| Private endpoints | Backup and restore traffic from SQL Server or SAP HANA in VMs and from the MARS agent stays on private IPs, with public network access set to Deny. |
| Azure RBAC | Backup Contributor, Backup Operator and Backup Reader separate duties on the vault. |
MUA is the control most likely to be tested as a scenario. The backup admin gets only Reader on the Resource Guard, which is enough to link it to the vault. For a critical operation they request the Backup MUA Operator role, ideally just in time through PIM, and the security admin removes it afterwards. Putting the Resource Guard in a different subscription, or even a different tenant, gives the strongest separation. Azure Backup also rates vault security levels: Excellent needs immutability or soft delete made irreversible plus MUA.
Two settings must be planned before the first item is protected. Customer-managed key encryption can only be enabled on a vault that has never had items registered, and you can’t go back to platform-managed keys afterwards. Private endpoints for a Recovery Services vault likewise have to be created before any item is protected.
Exam pitfall: if the backup admin holds Contributor, Backup MUA Admin or Backup MUA Operator on the Resource Guard, MUA protects nothing, because those roles override it. A scenario where “one compromised admin account must not be able to destroy backups” wants a Resource Guard owned by someone else, not a stronger role on the vault. Immutability does not stop that admin either, unless it is locked. For RTO, RPO and backup types themselves, see the backup types and RTO/RPO guide.
Sample questions
Question 1. Storage accounts must not be creatable with public blob access enabled, anywhere in the subscription. Reporting on violations after the fact is not acceptable. What should you implement?
- A. An Azure Policy definition with a deny effect
- B. A Defender for Cloud recommendation
- C. A regulatory compliance dashboard in Defender for Cloud
- D. A resource lock on the subscription
Show answer
Answer: A
Azure Policy with a deny effect prevents non-compliant resources from being created, which is what a requirement that rules out after-the-fact reporting demands. Defender for Cloud recommendations and a compliance dashboard both report rather than prevent, and a resource lock stops changes to existing resources rather than governing new ones.
Want more questions like this? Full SC-500 practice tests →
Question 2. A review finds several service principals with Contributor on production subscriptions, far beyond what their workloads use. What should you do?
- A. Enable MFA for the service principals
- B. Apply a resource lock to each production subscription
- C. Evaluate and remediate the overprivileged assignments using Azure RBAC
- D. Rotate the service principal credentials
Show answer
Answer: C
Evaluating and remediating overprivileged assignments with Azure RBAC is the objective that directly addresses excessive standing permissions, replacing them with least-privilege roles. Enabling MFA does not apply to service principals in this sense, a resource lock does not reduce permissions, and rotating credentials leaves the excessive access intact.
Want more questions like this? Full SC-500 practice tests →
Question 3. Developers occasionally commit connection strings into repositories. Security wants these detected across the cloud estate. What should you use?
- A. Defender for Key Vault
- B. Secret scanning using Defender CSPM
- C. A conditional access policy on developer accounts
- D. A custom Entra role for developers
Show answer
Answer: B
Scanning for secrets using Defender CSPM is the objective covering discovery of exposed credentials across the estate. Defender for Key Vault protects the vault rather than finding secrets elsewhere, a conditional access policy governs sign-in, and a custom Entra role changes permissions rather than detecting exposure.
Want more questions like this? Full SC-500 practice tests →
Question 4. Backup admins manage a Recovery Services vault with the Backup Contributor role. Security requires that no single backup admin can disable soft delete or reduce backup retention, even if their account is compromised. What should you configure?
- A. Replace Backup Contributor with Backup Operator for the backup admins
- B. A delete lock on the Recovery Services vault
- C. Customer-managed key encryption on the vault
- D. Multi-user authorization with a Resource Guard owned by the security team
Show answer
Answer: D
Multi-user authorization with a Resource Guard owned by a security admin makes those critical operations also require a role on the Resource Guard, which the backup admin gets only temporarily. Backup Operator is still a role on the vault, so one compromised account still needs no second approver. A delete lock on the vault does not block policy changes or soft delete settings. Customer-managed keys change encryption, not who can delete.
Want more questions like this? Full SC-500 practice tests →
What to practise
Set up PIM on one role and actually activate it. Write one custom Azure Policy with a deny effect and watch a deployment fail. Put a firewall on a Key Vault and break your own access, then fix it. Those three exercises cover the shape of most questions in this domain far better than reading the objective list again.