The SC-500 training teaches you to implement end-to-end security controls across the cloud and AI workloads running in Microsoft Azure. In four days you cover identity protection with Microsoft Entra ID and Privileged Identity Management, hardening for storage, databases, networks and virtual machines, governance with Azure Policy, and the protection of AI agents and services. This official Microsoft course succeeds AZ-500, retired on 31 August 2026, and extends the scope to AI workload security.
Delivered in Geneva and Lausanne by MCT certified trainers, the course alternates demonstrations and hands-on labs. You enable Microsoft Defender for Cloud protection plans, analyse identity and AI agent risks in Microsoft Defender XDR, connect your data sources to Microsoft Sentinel and get started with Microsoft Security Copilot. The official outline holds 63 modules for four days: the pace is demanding and your trainer prioritises topics according to the environments and the challenges of the group. By the end of the course you are ready for the SC-500 exam and the Cloud and AI Security Engineer Associate certification.
Module 1: Manage and implement authentication methods in Microsoft Entra ID
Module 2: Implement and configure Privileged Identity Management (PIM)
Module 3: Authenticate your API plugin for declarative agents with secured APIs
Module 4: Configure and secure Azure Key Vault
Module 5: Manage keys and secrets in Azure Key Vault
Module 6: Manage certificates and monitor Azure Key Vault
Module 7: Protect Azure Key Vault with Microsoft Defender for Cloud
Module 8: Enforce governance with Azure Policy and resource locks
Module 9: Configure security controls and remediate recommendations in Defender for Cloud
Module 10: Evaluate regulatory compliance in Defender for Cloud
Module 11: Manage and right-size RBAC role assignments for least privilege
Module 12: Protect backup data with Azure Backup security features
Module 13: Implement security controls in infrastructure as code
Module 14: Describe Azure storage services
Module 15: Implement security and manage access for Azure Storage
Module 16: Configure network security for Azure Storage
Module 17: Implement Microsoft Defender for Storage
Module 18: Configure platform-level security for Azure SQL
Module 19: Configure auditing for Azure SQL Database and SQL Managed Instance
Module 20: Implement Microsoft Defender for Databases
Module 21: Segment and isolate Azure workloads using network security controls
Module 22: Centralize and enforce traffic inspection using Azure Firewall
Module 23: Secure remote and hybrid connectivity using VPN gateways and Microsoft Entra Private Access
Module 24: Eliminate public network exposure of Azure PaaS services
Module 25: Secure access for Microsoft Entra Agent Identity
Module 26: Analyze AI identity risks using Microsoft Defender XDR
Module 27: Enable real-time protection for Copilot Studio agents
Module 28: Configure AI Gateway security in Microsoft Foundry
Module 29: Configure and manage guardrails in Microsoft Foundry
Module 30: Protect AI workloads with Microsoft Defender for Cloud
Module 31: Enable Defender for AI Services workload protection in Microsoft Defender for Cloud
Module 32: Manage agents using Microsoft Agent 365
Module 33: Identify AI data risks using Microsoft Purview Data Security Posture Management
Module 34: Implement disk encryption for Azure virtual machines
Module 35: Configure trusted launch security features for Azure virtual machines
Module 36: Plan and implement Azure Bastion
Module 37: Manage security for Arc-enabled hybrid servers
Module 38: Implement Microsoft Defender for Servers
Module 39: Enable and enforce just-in-time VM access
Module 40: Enforce VM security configuration with Azure Machine Configuration
Module 41: Detect container risks using Microsoft Defender for Containers
Module 42: Implement security controls for Azure Kubernetes Service
Module 43: Implement security controls for Azure Container Registry, Container Instances, and Container Apps
Module 44: Implement security controls for Azure Function apps and Logic apps
Module 45: Implement security controls for Azure App Services and Web Application Firewall
Module 46: Implement API backend security using Azure API Management
Module 47: Connect hybrid and multicloud environments to Microsoft Defender for Cloud
Module 48: Identify security risks by using Cloud Security Posture Management
Module 49: Discover unprotected assets and vulnerabilities by using Microsoft Defender External Attack Surface Management
Module 50: Evaluate regulatory compliance in Defender for Cloud
Module 51: Enable and configure workload protection plans in Microsoft Defender for Cloud
Module 52: Configure Microsoft Defender Vulnerability Management settings for Azure VMs
Module 53: Create and manage Microsoft Sentinel workspaces
Module 54: Manage content in Microsoft Sentinel
Module 55: Connect Microsoft services to Microsoft Sentinel
Module 56: Connect syslog data sources to Microsoft Sentinel
Module 57: Connect Common Event Format logs to Microsoft Sentinel
Module 58: Connect Windows hosts to Microsoft Sentinel
Module 59: Implement automation rules and playbooks in Microsoft Sentinel
Module 60: Manage data storage and query audit logs in Microsoft Sentinel
Module 61: Describe Microsoft Security Copilot
Module 62: Configure workspaces for Microsoft Security Copilot
Module 63: Manage plugins and agents in Microsoft Security Copilot
Cloud security no longer stops at virtual machines and virtual networks. Organisations now run copilots, conversational agents and language models that handle sensitive business data, call internal APIs and act on behalf of users. Every agent becomes an identity to govern, every prompt a potential path for data leakage. The SC-500 training answers that reality by covering Azure platform security and AI workload security in a single journey.
The course runs over four days in Geneva or Lausanne, in the classroom or in a virtual class. It targets professionals who already operate an Azure environment and now have to guarantee its security posture, from identity control through to the monitoring of AI models deployed in Microsoft Foundry.
SC-500 succeeds AZ-500, retired by Microsoft on 31 August 2026. The foundation remains: identity and privileged access management, storage and database protection, network security, policy driven governance and monitoring with Microsoft Sentinel. That foundation is completed by a brand new AI scope: agent identities in Microsoft Entra, guardrails and blocklists in Microsoft Foundry, AI gateway security, real time protection for Copilot Studio agents, agent governance with Microsoft Agent 365 and data risk assessment with Microsoft Purview Data Security Posture Management.
The related certification changes name as well. Microsoft Certified: Azure Security Engineer Associate gives way to Microsoft Certified: Cloud and AI Security Engineer Associate, earned by passing the SC-500 exam. For an engineer already holding AZ-500, SC-500 is the natural route to stay aligned with the current Microsoft catalogue.
The first part of the outline revisits Azure security fundamentals and treats them at an operational level of detail. You configure multifactor and passwordless authentication, deploy just in time access with Privileged Identity Management, and right size RBAC role assignments to enforce least privilege. Azure Key Vault is covered in depth: deployment, firewall rules, key rotation, certificate management and audit logging.
Storage and database protection follow, then network isolation with security groups, Azure Firewall, Azure Virtual Network Manager and private endpoints, then the hardening of virtual machines, containers, Azure Kubernetes Service, web applications and APIs. Every building block is tied back to the overall posture measured in Microsoft Defender for Cloud, including resources hosted on AWS, GCP or on premises through Azure Arc.
The AI section carries significant weight. You discover the agents deployed in your tenant from the Microsoft Defender portal, assess their blast radius and attack paths, enable real time protection for Copilot Studio agents and configure Microsoft Foundry guardrails. The Defender for Cloud AI workloads plan provides the alerts, the prompt evidence and the Data and AI dashboard needed to investigate an incident involving a model.
The operations section covers Microsoft Sentinel workspace creation, Microsoft 365, Entra, Syslog, CEF and Windows connectors, automation rules and Logic Apps playbooks, data retention and audit log queries. The course closes with Microsoft Security Copilot: workspaces, plugins, embedded agents and effective prompt writing.
The official outline holds 63 modules for four days. That is a lot of ground, and it is exactly where a guided course pays off: the trainer sets priorities, drills into the topics that matter for your context and leaves aside what belongs to personal reading. Self study is possible, but Microsoft documentation is scattered and the AI portion evolves too quickly to follow without a clear thread. In class you gain a structured view in four days, official labs and the chance to test your real scenarios with a certified trainer.
To cover the whole Microsoft security domain, two ITTA courses complement SC-500 naturally: SC-200, focused on security operations, threat hunting and incident response, and SC-300, dedicated to identity governance in Microsoft Entra. After the course, book the SC-500 exam within four to six weeks, replay the labs on a test subscription and apply two or three Defender for Cloud recommendations to your production environment as soon as possible.
Does SC-500 really replace AZ-500?
Yes. Microsoft retired AZ-500 on 31 August 2026 and SC-500 becomes the reference course for cloud workload security. The Azure content is kept and extended with AI security.
Do I need the AZ-500 certification before attending SC-500?
No. Practical Azure administration experience along with identity, networking and encryption concepts is enough. AZ-500 certified attendees will mainly gain the new material on AI agents and models.
How does it differ from SC-200?
SC-500 is about designing and configuring security controls, so about prevention. SC-200 is about detection, investigation and response inside a security operations centre. The two paths complement each other.
Are all 63 modules covered in four days?
The official outline is deliberately broad. The trainer covers every exam domain and goes deeper on the modules that matter most to the group, while the remaining ones are outlined and pointed to the official material for personal study.
Is the course available as a virtual class?
Yes. It is offered in the classroom in Geneva and Lausanne and as an interactive virtual class, with the same outline, the same official Microsoft labs and the same certified trainer.
Does SC-500 help with Swiss data protection requirements?
The controls covered (encryption, access management, classification, logging, regulatory compliance in Defender for Cloud) map directly onto nFADP and GDPR expectations, including for generative AI use cases.
Monday to Friday
8:30 AM to 6:00 PM
Tel. 058 307 73 00
ITTA
Route des jeunes 35
1227 Carouge, Suisse
Monday to Friday, from 8:30 am to 06:00 pm.
