Microsoft AZ-104: Azure Security and Compliance — Study Guide

By Laurynas Brazys · 6 August 2026 · #microsoft #az-104 #certification #exam-prep #study-guide

Part of the Microsoft Azure Administrator Associate AZ-104 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Azure Security and Compliance in operational practice is about continuously reducing attack surface, detecting and responding to threats, and enforcing least privilege and data protection with auditable controls. As an administrator, you stitch together posture management, workload protection, identity governance, and information protection so that every resource has a clear owner, a defined risk and compliance baseline, and automated guardrails. The services below interlock: Defender for Cloud drives secure configuration and workload protections; Key Vault and Managed HSM protect cryptographic material; DDoS Protection hardens internet perimeters; Microsoft Sentinel centralizes detection and response; AIP enforces data sensitivity at the document level; and identity governance with PIM and Access Reviews keeps privileged and app access time-bounded and reviewable.

Microsoft Defender for Cloud: Posture, Secure Score, Recommendations, Workload Protections, and JIT

Defender for Cloud provides two major value streams. First, cloud security posture management establishes baselines and continuously evaluates resources against Azure Policy initiatives. Secure Score quantifies how close your environment is to the recommended baseline and shows the potential score impact of each recommendation so you can prioritize remediations with the most risk reduction. Recommendations are actionable, mapped to standards in the Regulatory Compliance dashboard, and frequently support quick-fix or bulk remediation. Ensure auto-provisioning is enabled where needed so agents, extensions, and policies deploy consistently.

Second, workload protections deliver threat detection and hardened configurations. Enable plans per subscription or management group:

• Servers: Defender for Servers Plan 1 adds vulnerability assessment and security configuration; Plan 2 adds EDR via Microsoft Defender for Endpoint with threat and vulnerability management, file integrity monitoring, and adaptive application controls.
• SQL: Defender for SQL on Azure SQL resources provides behavioral analytics, vulnerability assessments, and data discovery/classification; Defender for SQL servers on machines covers SQL running on IaaS and hybrid.
• Storage: Monitors for data exfiltration and malware on blob uploads, anomalous access patterns, and public exposure risks.
• Containers: Defender for Kubernetes analyzes cluster posture, monitors runtime threats, and integrates with container registries to scan images pre-deployment.

Just-in-time VM access reduces exposure by keeping management ports closed by default and opening them only on approved, time-limited requests. You configure allowed ports, source IP ranges, maximum duration, and whether approvals are required. On activation, Defender for Cloud updates NSGs or Azure Firewall rules, then reverts them automatically, with full auditing of who requested access, from where, and for how long.

Azure Key Vault and Managed HSM: Secrets, Keys, Certificates; Access Control Models; Soft Delete and Purge Protection

Key Vault centralizes three object types. Secrets store arbitrary confidential values such as connection strings and passwords. Keys support cryptographic operations like encrypt, decrypt, sign, and wrap; Azure services can perform encryption with customer-managed keys via key references without retrieving raw key material. Certificates provide lifecycle management, automated renewal with integrated CAs, and policy-based issuance, backed by keys and secrets.

Understand control planes. Control-plane operations (creating or deleting a vault) use Azure RBAC at the resource scope. Data-plane operations (getting a secret, using a key) are authorized by the vault’s permission model. There are two mutually exclusive data-plane models on a given vault:

• Vault access policy model: Explicit allow lists for principals per object type and operation. Simple and self-contained, but coarse for large estates.
• Azure RBAC for Key Vault: Use built-in roles such as Key Vault Administrator, Key Vault Crypto Officer, Secrets Officer, and Certificates Officer, scoped via subscriptions, resource groups, or the vault. This unifies authorization with other Azure resources and supports PIM and access reviews.

Network security should restrict the vault to private endpoints and trusted networks, with firewall rules and threat protection where supported. For resilience, soft delete is on by default and prevents immediate destruction of vaults and objects. Deleted items move to a recoverable state for a retention period you configure; purge protection, when enabled, blocks hard deletion before retention expiry even by privileged users. This combination meets stringent retention and anti-tamper requirements. Plan for key rotation, version pinning in dependent services, and break-glass recovery procedures.

Azure Managed HSM delivers a single-tenant, FIPS 140-2 Level 3 validated HSM cluster with role-based access only. Cryptographic keys never leave the HSM boundary, and operations are performed in-hardware. Managed HSM uses Azure RBAC roles specific to HSMs (such as Managed HSM Administrator, Crypto Officer, and Crypto User), supports private endpoints and backup/restore via security domains, and enforces soft delete with purge protection during the configured retention period. Choose Managed HSM when you need higher assurance levels, separation of duties, or regulator-required HSM boundaries.

Azure DDoS Protection: Basic vs Standard, Adaptive Tuning, and Telemetry

Every Azure public endpoint benefits from platform-level DDoS Basic, which absorbs many global volumetric attacks but provides no customer-specific tuning, telemetry, or SLA. DDoS Standard attaches to one or more virtual networks via a DDoS Protection Plan and protects all public IPs in those VNets, including those on VMs, Azure Load Balancer, Application Gateway, and AKS services using Standard SKU public IPs.

Standard adds adaptive tuning that learns each protected public IP’s normal traffic profile and automatically adjusts mitigation thresholds to reduce false positives while responding quickly to anomalies across L3/L4 vectors. You gain detailed telemetry through Azure Monitor: real-time metrics indicating under-attack status and dropped packets; diagnostic logs including DDoSProtectionNotifications, DDoSMitigationFlowLogs, and DDoSMitigationReports streamed to Log Analytics, Storage, or Event Hubs; and post-attack reports to support incident documentation and insurance claims. Standard also includes cost protection credits for scale-out during attacks and access to Microsoft rapid response. Pair DDoS Standard with a web application firewall for L7 threats; they are complementary.

Microsoft Sentinel: Data Connectors, Analytics Rules, Incidents, and Playbooks

Sentinel is a cloud-native SIEM and SOAR built on Log Analytics. Start by enabling data connectors that onboard telemetry from Azure AD sign-ins, Defender for Cloud alerts, Microsoft 365, Azure Activity, Firewall and WAF logs, and third-party sources over AMA, Syslog, CEF, or REST APIs. Scope collection thoughtfully to manage ingestion costs while ensuring you capture high-signal security events.

Use analytics rules to convert raw data into actionable detections. Scheduled rules run KQL on a cadence with thresholds and entity mapping; Microsoft Security rules ingest alerts from Microsoft security products; near-real-time rules reduce detection latency for critical indicators; Fusion rules apply ML to correlate multi-stage attacks across products. Tuning includes suppression, rule grouping, and incident settings to minimize alert fatigue.

Incidents aggregate related alerts into a single case with severity, owner, status, entities (user, host, IP, resource), and an investigation graph for context. Analysts triage, add comments, tag, and link to tickets. Automation rules standardize incident handling, such as assigning owners by rule label and triggering playbooks.

Playbooks are Logic Apps that orchestrate response. Common actions include disabling a risky user in Entra ID, isolating an endpoint via Defender for Endpoint, blocking an IP in Azure Firewall or NSGs, quarantining a storage blob, or creating a ServiceNow ticket. Use managed identities and assign least-privilege roles to the playbook for the target resources. Measure time-to-contain and iteratively refine analytics and automation.

Data and Identity Governance: AIP Sensitivity Labels, PIM, and Access Reviews

Sensitivity labels in Microsoft Information Protection apply consistent protection to documents, emails, and containers. A label can enforce encryption with usage rights, content marking, and external sharing controls; for containers such as Teams and SharePoint sites, labels dictate external access, unmanaged device restrictions, and privacy. Publish labels through label policies targeted to users or groups with priority order, default labels, mandatory labeling, and recommendation prompts. Auto-labeling uses sensitive info types and trainable classifiers to recommend or apply labels in Office apps, and service-side policies can auto-label content at rest in SharePoint and OneDrive. Maintain label versioning, test in audit mode, and monitor activity to ensure adoption.

Privileged Identity Management reduces standing privileges by converting permanent role assignments into eligible ones. Users assigned as eligible must activate a role for a limited duration with configurable requirements: MFA, justification, ticket number, and possibly approval from designated approvers. Role settings define maximum activation time, grace periods, and notifications. Use PIM for both Entra ID roles (for example, Global Administrator) and Azure resource roles (Owner, Contributor, User Access Administrator) at the appropriate scope. Activation events, approvals, and expirations are fully audited, enabling clear accountability for privileged operations.

Access Reviews ensure that group memberships and application assignments remain appropriate over time. Scope reviews to all users or just guests, choose reviewers (group owners, selected users, or each user self-review), set recurrence, require reasons for approval, and configure auto-apply of results to remove denied or non-responding users. Combine Access Reviews with PIM so that continued membership or app access requires periodic re-attestation, further shrinking the window for privilege creep or stale entitlements.

Practical Problem Scenario

Starbucks must harden its Azure footprint hosting customer-facing APIs, internal line-of-business apps, and analytics workloads, while meeting strict data protection and least-privilege requirements across multiple subscriptions.

1. Establish posture baselines with Microsoft Defender for Cloud and improve Secure Score

• Assign built-in policy initiatives at the management group to standardize baselines across subscriptions.
• Enable auto-provisioning and turn on workload protection plans for Servers, SQL, Storage, and Kubernetes. Why: Defender for Cloud provides continuous assessment and prioritized recommendations, ensuring consistent configuration and actionable remediation across heterogeneous workloads.

2. Enable DDoS Protection Standard on the hub virtual networks

• Create a DDoS Protection Plan and associate it to hub VNets hosting shared Application Gateways and public entry points.
• Configure diagnostics to Log Analytics for DDoS telemetry and alerts. Why: Starbucks’ public APIs require adaptive L3/L4 defense and detailed attack telemetry beyond platform defaults, with cost protection and response support during incidents.

3. Lock down management ports with Just-in-time VM access

• Configure JIT policies for all VM management ports, restricting source IPs to Starbucks corporate egress ranges and limiting access windows to one hour with approval. Why: Minimizes exposure to internet scanning and credential attacks while preserving administrator productivity and creating an audit trail.

4. Centralize secrets and cryptographic control with Key Vault and Managed HSM

• Store app secrets and certificates in Key Vault secured by private endpoints and Azure RBAC data-plane roles; enable purge protection.
• Generate and store payment-related encryption keys in Managed HSM; configure key rotation and backup to a secured key vault. Why: Key Vault simplifies secret lifecycle and integrates with Azure services; Managed HSM satisfies higher assurance requirements and segregation for payment data.

5. Stand up Microsoft Sentinel for detection and response

• Connect Azure AD, Defender for Cloud, Azure Firewall, Application Gateway WAF, and critical server logs.
• Deploy analytics rules for risky sign-ins, anomalous storage access, and container runtime threats; create automation rules and playbooks to disable compromised users, block malicious IPs, and open tickets. Why: Sentinel correlates telemetry into incidents and automates containment, reducing mean time to detect and respond.

6. Enforce data sensitivity with AIP labels and auto-labeling

• Create labels for Public, Internal, Confidential, and Highly Confidential with encryption and sharing restrictions; publish policies to user groups with mandatory labeling and default recommendations.
• Enable auto-labeling for documents containing payment card or PII data in SharePoint and OneDrive. Why: Ensures sensitive data is protected wherever it travels and aligns user behavior with corporate policy.

7. Govern privilege with PIM and validate access via Access Reviews

• Convert privileged Entra ID and Azure resource role assignments to eligible with MFA, approval, and short activation windows; notify resource owners of activations.
• Schedule quarterly Access Reviews for Microsoft 365 and security groups and for enterprise app assignments, auto-removing non-responders. Why: Time-bound privilege and regular attestation reduce standing access risk and prevent entitlement sprawl, satisfying audit and compliance objectives.

← Azure Monitor · All domains

Practice these questions → · Timed practice on ExamRoll.io →

Browse Microsoft →