Microsoft AZ-305: Security Architecture and Zero Trust — Study Guide

By Laurynas Brazys · 11 August 2026 · #microsoft #az-305 #certification #exam-prep #study-guide

Part of the Microsoft Azure Solutions Architect Expert AZ-305 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Security architecture on Azure is anchored in Zero Trust: never trust, always verify, explicitly authorize, and assume breach. Architectures must enforce identity-driven access, micro-segmentation, strong data protection, and continuous threat detection and response. This section connects the pillars—identity and secrets, data protection, network controls, and cloud-native threat defense—into cohesive designs aligned with Azure platform capabilities.

Identity, Secrets, and Zero Trust Foundations

Zero Trust starts with strong identity verification and least privilege. Every workload and human identity should be evaluated at access time, with conditional controls and short-lived tokens. Enforce least privilege by scoping permissions to the smallest set of actions on the narrowest resource boundary, and prefer just-in-time (JIT) elevation with Privileged Identity Management (PIM) where applicable.

Azure Key Vault is central for secrets and keys. Two data-plane authorization models exist:

Access policies are the legacy per-vault ACL model. They grant granular secret/key/certificate permissions to principals but do not integrate with Azure RBAC deny assignments or PIM, and they complicate large-scale governance because they are scoped only to the vault.
Azure RBAC for Key Vault is the modern model. When enabled on the vault, data-plane permissions are controlled by Azure RBAC roles (for example, Key Vault Secrets User, Key Vault Crypto Officer), inherit across scopes (management group, subscription, resource group), support deny assignments, and integrate with PIM and Access Reviews. Choose RBAC for consistency and centralized governance; do not mix the models on the same vault.

Soft delete and purge protection prevent accidental or malicious loss. Soft delete preserves deleted objects for a retention period (configurable 7–90 days, default 90) allowing recovery. Purge protection, when enabled, prevents permanent purge of soft-deleted items until the retention expires, even by highly privileged users. For production vaults, enable both. Managed HSM provides dedicated, FIPS 140-2 Level 3 validated hardware security modules under Azure control. It supports only keys (no secrets/certificates), uses Azure RBAC with roles such as Managed HSM Administrator, Crypto Officer, and Crypto User, and has soft delete and purge protection always on. Use Managed HSM when you require hardware-backed key isolation, quorum-based administration, or regulatory assurance for cryptographic boundary controls.

Azure Managed Identities eliminate credentials for Azure-hosted workloads. System-assigned identities are tied to a single resource’s lifecycle; deleting the resource deletes the identity. They are ideal for singleton resources (a Function App or VM) that need independent authorization boundaries. User-assigned identities are standalone and can be attached to multiple resources; they persist when compute is replaced or scaled out, making them suitable for fleets, blue/green swaps, or when consistent identity is required across instances. Workloads obtain tokens without secrets by calling the instance metadata service (IMDS) at 169.254.169.254 or the platform’s managed identity endpoint, requesting an access token for a resource (for example, https://vault.azure.net for Key Vault). Use Azure RBAC to grant the identity least-privilege roles on target resources; the platform rotates credentials automatically.

Azure AD Workload Identity Federation removes the need to store cloud credentials in external CI/CD and Kubernetes. With GitHub Actions, create a federated credential on the Azure AD application using the GitHub OIDC issuer (token.actions.githubusercontent.com) and constrain by repository, branch, or environment. GitHub exchanges its OIDC token for an Azure AD token at runtime; assign Azure roles to that app and enforce least privilege per workflow. For Kubernetes (AKS), enable OIDC on the cluster and configure Azure AD workload identity. Map a ServiceAccount’s OIDC token to an Azure AD application or user-assigned managed identity via a federated credential, then bind Azure roles to that identity. Pods exchange their projected OIDC token for Azure tokens to call services like Key Vault or Storage—no secrets or node-level agents required and better isolation than legacy aad-pod-identity.

Threat Protection, SIEM/SOAR, and Cloud App Governance

Microsoft Defender for Cloud provides cloud posture management and workload protections. Secure Score quantifies risk by assessing misconfigurations and recommending hardened settings (for example, enabling MFA, enforcing disk encryption, or restricting public endpoints). Drive Secure Score improvements through policy assignments at management group scope to standardize baselines. Workload protections extend to servers, containers, databases, storage, Key Vault, and App Service to deliver threat detections, vulnerability assessments, and capabilities like just-in-time VM access, adaptive application controls, and file integrity monitoring. Regulatory compliance maps your environment to standards (Azure Security Benchmark, CIS, PCI-DSS, ISO 27001) and shows pass/fail against policy controls; use this to track and remediate gaps with governance stakeholders.

Microsoft Sentinel is the cloud-native SIEM and SOAR. Data connectors onboard telemetry from Azure Activity, Azure AD sign-ins and audit, Microsoft 365, Microsoft Defender suite, Azure resources, and non-Azure sources via Syslog/CEF or the AMA/Log Analytics Agents. Analytics rules detect threats using KQL: scheduled rules for periodic correlation, near-real-time rules for low-latency detection, and machine-learning/anomaly templates for behavioral insights. Tune rule thresholds, suppression, and entity mappings to reduce noise and enrich incidents. Automate responses with SOAR playbooks built in Logic Apps; trigger isolation of compromised hosts via Defender for Endpoint, disable suspect accounts in Azure AD, revoke sessions, purge malicious emails, or notify and open tickets. Use automation rules to route incidents, tag by severity, and invoke playbooks based on incident properties.

Microsoft Defender for Cloud Apps governs SaaS usage. Shadow IT discovery ingests firewall/proxy logs and endpoint telemetry to identify unsanctioned apps, risk-ranks them, and lets you sanction/unsanction. Integrate with Defender for Endpoint for continuous discovery. Session controls apply real-time Conditional Access App Control via a reverse proxy to enforce policies such as block download for unmanaged devices, require document labeling before download, apply watermarking, or restrict cut/copy/paste—without modifying the SaaS app.

Data Protection and Confidential Computing

Azure Information Protection operationalizes data classification and protection through sensitivity labels. Labels define classification, visual markings, encryption (Azure Rights Management), and usage rights (view, print, forward, offline access). Publish labels via label policies to selected users and require mandatory labeling where appropriate. Auto-labeling policies can apply labels in Office apps on endpoints based on content inspection (for example, PII patterns, keywords) and at rest/in transit in services through data governance tools, reducing user error and strengthening baseline protection. Use justification prompts for downgrades and audit label changes to support governance.

Azure Confidential Computing protects data in use by executing workloads inside hardware-based Trusted Execution Environments. Confidential VMs (for example, AMD SEV-SNP or Intel TDX) encrypt VM memory and provide integrity, shielding guest workloads from the cloud host and other tenants. Use them for lift-and-shift scenarios needing enclave-grade protections without app changes. Confidential containers on AKS run containerized workloads on confidential node pools; combine with encrypted container images and attestation to enforce only attested workloads run. Attestation is performed using Azure Attestation to verify platform and workload measurements (quotes) before releasing secrets. Integrate attestation checks into your control plane or deployment pipeline; only upon successful attestation should Key Vault or an external KMS release decryption keys to the workload, completing data-in-use protection.

Network Segmentation, Perimeter, and DDoS Defense in Depth

Network micro-segmentation constrains lateral movement and couples with identity verification to enforce Zero Trust. Network Security Groups are stateful packet filters applied to subnets or NICs; use service tags and explicit denies to restrict east-west and north-south flows, default-deny unnecessary ports, and log with NSG flow logs. Application Security Groups abstract dynamic workload groups so you can write NSG rules by application role rather than IPs, enabling intent-based segmentation that scales with autoscaling and ephemeral addresses.

Azure Firewall provides centralized, fully stateful L3–L7 control with application and network rules, FQDN filtering, DNAT/SNAT, threat intelligence–based filtering, and Premium features like TLS inspection and IDPS for deep inspection of outbound and inbound traffic. Use Firewall Policy for intent-based configuration and inheritance across regions. Route egress through Azure Firewall with user-defined routes, and pair with Private Endpoints to keep PaaS traffic off the public internet.

Web-facing applications should be fronted by a Web Application Firewall. Deploy WAF on Application Gateway for regional, VNet-integrated layer 7 load balancing, or on Azure Front Door for global anycast entry and CDN integration. Enable OWASP-managed rules and add custom rules for path/geo/IP filtering and bot defenses, and integrate with DDoS strategies at the edge.

DDoS Protection Standard adds adaptive real-time mitigation for public endpoints in VNets, telemetry, and cost protection for scale-out during an attack. Apply DDoS Protection Plans at the VNet level for all associated public IP resources, test with simulated traffic, and review metrics and alerts. Layer your defense: DDoS at the edge, WAF at L7, Azure Firewall for L3–L7 policy, NSGs/ASGs for micro-segmentation, and Conditional Access plus device compliance for identity-driven enforcement.

Practical Problem Scenario

Starbucks is modernizing a multi-region ordering platform on Azure with AKS, Azure SQL Database, and Event Hubs. The architecture must adopt Zero Trust: eliminate embedded secrets, segment networks, protect data in use, and implement unified threat detection and automated response across cloud and SaaS.

Enforce identity-based access for workloads

Implement user-assigned managed identities for AKS workloads needing Key Vault and Storage access. Assign least-privilege RBAC roles (Key Vault Secrets User, Storage Blob Data Reader) at resource group scope. Chosen because managed identities remove secrets, support scale-out pods sharing a stable identity, and integrate with PIM/Access Reviews via Azure RBAC.

Federate CI/CD without stored credentials

Configure Azure AD workload identity federation for GitHub Actions using the GitHub OIDC issuer and repository/environment constraints. Workflows obtain Azure tokens at runtime to deploy Bicep and Helm. Chosen to eliminate PATs/secrets, reduce blast radius to specific repos/branches, and enable conditional claims.

Protect keys and secrets with recovery guarantees

Use Azure Key Vault with RBAC permission model, soft delete, and purge protection enabled. Store connection strings and application secrets; store TDE protector keys for Azure SQL in a Managed HSM for FIPS Level 3 assurance. Chosen for centralized auditing, recoverability, and hardware-backed key isolation for critical cryptographic material.

Segment networks and centralize egress

Apply NSGs with default-deny and ASGs for tiers (web, api, data). Force all egress through Azure Firewall Premium with IDPS and TLS inspection; use Private Endpoints for Azure SQL and Key Vault. Chosen to implement micro-segmentation at subnet/NIC, deep packet inspection for exfiltration control, and private PaaS access.

Protect the public edge

Front the web tier with Azure Front Door with WAF policies using OWASP CRS and custom rules for geo/IP throttling and bot signatures. Enable DDoS Protection Standard on the hub VNet hosting Application Gateway for regional failover. Chosen to absorb volumetric attacks globally and block L7 exploits before they reach AKS.

Govern SaaS access and unmanaged devices

Integrate Microsoft Defender for Cloud Apps with Conditional Access App Control to enforce session controls on M365 and sanctioned third-party SaaS: block downloads on unmanaged devices, require sensitivity labels on download, and watermark. Chosen for real-time controls without app changes and consistent enforcement across SaaS.

Classify and protect sensitive data

Define Azure Information Protection sensitivity labels (Public, Confidential, Highly Confidential – Customer Data) with encryption and usage rights. Enable auto-labeling policies for PII patterns in Office and at rest in SharePoint/OneDrive. Chosen to standardize data handling, reduce user error, and maintain persistent protection.

Secure data in use for payment processing

Run payment microservices on AKS confidential node pools and batch risk models on confidential VMs (AMD SEV-SNP). Gate decryption keys by Azure Attestation; only attested nodes/pods receive secrets from Key Vault. Chosen to protect memory from host/tenant access and establish measured boot and workload integrity.

Establish posture management and compliance

Enable Microsoft Defender for Cloud at the management group with Azure Security Benchmark and PCI-DSS standards. Turn on relevant Defender plans (containers, servers, SQL, Key Vault) and JIT VM access. Chosen for centralized Secure Score, regulatory mappings, and workload-native protections.

Centralize detection and orchestrate response

Onboard telemetry to Microsoft Sentinel via data connectors (Azure AD, Azure Activity, M365, Defender, AKS logs, Firewall). Deploy analytics rules for credential theft, suspicious egress, container escapes, and anomalous admin activity. Automate with Logic Apps playbooks to disable compromised accounts, isolate AKS nodes, block egress in Azure Firewall, and open tickets. Chosen for cloud-native SIEM/SOAR, rapid rule deployment, and tight integration with Microsoft security signals.

This design applies Zero Trust end-to-end: identities are verified continuously, privileges are least and just-in-time, networks are micro-segmented with centralized inspection, data is classified and protected both at rest and in use, and continuous threat detection with automated response reduces mean time to contain.

← High Availability · All domains · Integration and Messaging Architecture →

Practice these questions → · Timed practice on ExamRoll.io →