1.2 Skills Measured & Weightings

1.2 Skills Measured & Weightings

Microsoft publishes a skills measured outline for every role-based exam. For SC-500, that outline is your contract with the test: if a task appears there, it is fair game. If you only memorize marketing feature lists, you will struggle when items ask which control, which portal blade, or which Defender plan solves a concrete risk.

Why the blueprint drives everything

Study time is finite. The official weightings tell you where Microsoft expects the most depth. They are also the best defense against random YouTube playlists that over-teach one product and ignore another. Treat the four domains as a portfolio: under-investing in the heaviest domain is the most expensive mistake you can make before exam day.

Skills at a glance (official weights)

Weights are ranges, not fixed percentages on your personal form. Still, plan as if storage/databases/networking will be the largest set of scored decisions, and as if no domain is optional.

Domain 1: Manage identity, access, and governance (20–25%)

This domain answers: Who can do what, with which secrets, under which policy?

Secure access with Microsoft Entra ID

Expect tasks around:

• Privileged Identity Management (PIM) — eligible vs permanent assignments, activation, just-in-time admin access.
• Conditional Access — conditions (user, location, device, risk, app) versus grant controls (MFA, compliant device, session controls).
• Authentication methods — multifactor authentication (MFA) and passwordless options.
• Application identities — enterprise applications, app registrations, OAuth permission grants and consent settings.
• Managed identities for Azure resources (system-assigned and user-assigned) as the preferred alternative to embedding secrets in code.

Secure secrets and keys with Azure Key Vault

You should be able to deploy a vault, configure settings and access models, apply firewall restrictions, manage keys, secrets, and certificates, scan for secrets with Defender Cloud Security Posture Management (Defender CSPM), and enable Defender for Key Vault.

Governance and regulatory compliance

Microsoft ties governance to:

• Azure Policy (built-in and custom definitions).
• Microsoft Defender for Cloud regulatory compliance views and security standards/recommendations.
• Resource locks, built-in and custom Azure roles and Microsoft Entra roles.
• Finding and remediating overprivileged role-based access control (RBAC) assignments.
• Azure Backup security features and security controls expressed as infrastructure as code (IaC).

Engineer mindset: Prefer least privilege, short-lived elevation (PIM), policy-as-code, and vault-backed secrets over standing Global Admin rights and plaintext connection strings.

Domain 2: Secure storage, databases, and networking (25–30%) — the heaviest

This is Microsoft’s largest SC-500 domain. If you only have time for one deep lab week, put it here.

Storage accounts

Harden storage account configuration, Azure Storage firewall rules, Defender for Storage threat protection, and access models (including access policies / identity-based access patterns as tested on the outline).

Databases

Focus on Azure SQL platform security configurations, auditing for Azure SQL Database and Azure SQL Managed Instance, and Defender for Databases across Azure database services.

Azure network services

This cluster is broad and scenario-rich:

• Network security groups (NSGs) and application security groups (ASGs).
• Azure Virtual Network Manager network access / security admin policies.
• Azure Virtual WAN security configuration.
• Virtual private network (VPN) connection security.
• Microsoft Entra Private Access.
• Private endpoints for platform as a service (PaaS) resources and Azure Private Link services.
• Azure Firewall implementation and configuration.
• Evaluating effective security rules with Azure Network Watcher diagnostics.

Typical exam trap: Confusing service endpoints with private endpoints, or assuming an NSG alone replaces a Web Application Firewall (WAF) or Azure Firewall Premium inspection features. Learn when each control is the right layer.

Domain 3: Secure compute (20–25%), including Security for AI

Secure compute covers three pillars: AI, servers/VMs, and application platforms.

Implement security for AI (the SC-500 differentiator)

This is the clearest content gap versus classic AZ-500. Microsoft’s outline includes tasks such as:

• Identifying SharePoint data overexposure risks relevant to Copilot scenarios.
• Using Microsoft Purview Data Security Posture Management (DSPM) for AI to surface risks related to Microsoft Copilot and AI apps.
• Enabling real-time protection for Microsoft Copilot Studio agents.
• Implementing Conditional Access for Microsoft Entra Agent ID, analyzing blast radius with Defender XDR, and managing Agent ID access.
• Configuring AI Gateway in Azure API Management for Microsoft Foundry.
• Enabling Defender for AI Service in Cloud Workload Protection within Defender for Cloud.
• Configuring guardrails for agent security in Foundry.
• Monitoring AI security via the Data and AI security dashboard in Defender for Cloud.
• Managing agents in the Microsoft 365 admin center.

If your study plan ignores Purview DSPM, Entra Agent ID, and Foundry/Defender for AI, you are studying for yesterday’s exam.

Servers and virtual machines

Disk encryption, Azure Bastion, just-in-time (JIT) VM access, Azure Arc for hybrid/multicloud servers, onboarding and configuring Defender for Servers (including vulnerability scanning, endpoint detection and response (EDR), and agentless scanning), trusted launch features (secure boot, virtual Trusted Platform Module (vTPM), integrity monitoring), and Azure Machine Configuration for managed server baselines.

Application platform services

Defender for Containers, Azure Kubernetes Service (AKS), Azure Container Registry, Container Instances/Apps, Azure Functions, Logic Apps, App Service, Azure Web Application Firewall, and API back-end protection with API Management.

Domain 4: Manage and monitor security posture (20–25%)

Defender for Cloud posture

Use Defender CSPM to identify risks, evaluate compliance frameworks, enable workload protection plans, connect hybrid/multicloud (including Amazon Web Services (AWS) and Google Cloud Platform (GCP)), configure Microsoft Defender Vulnerability Management settings for Azure VMs, and discover external exposure with Microsoft Defender External Attack Surface Management (EASM).

Microsoft Sentinel activity and event collection

Workspace creation and connection, roles, content hub solutions, Microsoft data connectors, syslog / Common Event Format (CEF) collection, Windows Security events via data collection rules (including Windows Event Forwarding (WEF)), custom log tables, automation rules and playbooks, data retention, and querying Microsoft Purview Audit in Defender XDR.

Microsoft Security Copilot

Workspace configuration, permissions/roles, plugins, and Microsoft agents / Security Store agents for investigation workflows.

How AI security differentiates SC-500 from AZ-500

Takeaway: SC-500 is not “AZ-500 with a new code.” It is Azure security plus operational AI security across identity, data, platform guardrails, and monitoring.

Mapping Microsoft’s audience responsibilities

Microsoft’s audience profile lists day-to-day responsibilities that map cleanly to the four domains:

1. Securing access with Entra ID and Key Vault → Domain 1.
2. Enforcing security and regulatory compliance → Domain 1 (Policy, Defender compliance, RBAC).
3. Securing storage, databases, and networking → Domain 2.
4. Securing compute → Domain 3 (servers, containers, app platforms).
5. Securing AI solutions → Domain 3 (Security for AI bullets).
6. Managing and monitoring security posture → Domain 4 (CSPM, Sentinel, Security Copilot).

You also work across teams—identity, M365, SOC analysts, DevOps, DBAs, network engineers—so exam scenarios often assume shared responsibility. The engineer’s job is to pick the control that fits the architecture without inventing permissions or opening the network more than necessary.

Scenario: using weights in real preparation

Imagine two candidates with six weeks:

• Candidate A spends four weeks only on Entra Conditional Access and one week skimming everything else. They may ace identity items and still fail because 25–30% storage/network items plus AI and Sentinel coverage overwhelm weak areas.
• Candidate B builds a weekly rotation: heavy Domain 2 labs (private endpoints, NSG/ASG, Firewall, SQL auditing, storage firewall + Defender for Storage), solid Domain 1 PIM/CA/Key Vault, dedicated AI security lab day, and Sentinel workspace + connector practice. Candidate B’s risk is balanced.

SC-500 rewards breadth with depth on the heavy domain, not single-product mastery.

Bottom line

Memorize the four official weights, invest the largest block of time in secure storage, databases, and networking (25–30%), treat Security for AI as non-negotiable under Secure compute, and use Microsoft’s audience profile as a checklist of job tasks—not marketing slogans. The next section turns these weights into a concrete study path and exam-day strategy.