Version : 1.2 · Date : 2026-10-21
Cours complet pour l'examen SC-500 : Microsoft Certified: Cloud and AI Security Engineer Associate. Un chapitre par bloc de compétences du guide d'étude, avec schémas draw.io, Mermaid, exemples (portail, CLI, PowerShell, IaC), labs, pièges d'examen et scénarios corrigés. Toutes les informations viennent de Microsoft Learn, lues le 21/10/2026. Les notions de l'ancienne AZ-500 absentes du programme sont ajoutées et repérées « Complément AZ-500 ». Les noms de services, fonctionnalités, rôles et menus sont en anglais, comme dans le portail et à l'examen.
L'examen est en bêta : le guide d'étude peut encore évoluer. Le relire avant l'examen : guide d'étude SC-500.
Les domaines de l'examen#
| Domaine (intitulé officiel, en anglais) | Poids | Chapitres |
|---|---|---|
| Manage identity, access, and governance | 20 à 25 % | 01, 02, 03 |
| Secure storage, databases, and networking | 25 à 30 % | 04, 05, 06 |
| Secure compute | 20 à 25 % | 07, 08, 09 |
| Manage and monitor security posture | 20 à 25 % | 10, 11, 12 |
Score de réussite : 700 sur 1000. La plupart des questions portent sur des fonctionnalités en disponibilité générale, mais des fonctionnalités en préversion très utilisées peuvent tomber.
Les chapitres#
Chaque chapitre suit le même plan : ce que l'examen demande (mot pour mot), les concepts, les schémas, la mise en œuvre, les tableaux comparatifs, les labs conseillés, les pièges d'examen, des scénarios corrigés, pour aller plus loin, une fiche à retenir et les références.
Couverture des objectifs de l'examen#
Les 87 compétences du guide d'étude, chacune reliée à la section qui la traite (vérification du 21/10/2026).
Manage identity, access, and governance (20 à 25 %)#
| Ch. | Compétence mesurée (guide officiel, en anglais) | Section |
|---|---|---|
| 01 | Implement and configure Privileged Identity Management (PIM) | 4 |
| 01 | Implement conditional access policies | 3 |
| 01 | Implement and configure authentication methods, including multifactor authentication (MFA) and passwordless | 2 |
| 01 | Implement and configure identity for applications, including enterprise applications and app registrations | 5 |
| 01 | Manage OAuth permission grants and consent settings | 6 |
| 01 | Implement and configure managed identities for Azure resources | 7 |
| 02 | Deploy Key Vault | 2 |
| 02 | Configure Key Vault settings | 3 |
| 02 | Configure access to Key Vault | 4 |
| 02 | Configure firewall settings on Key Vault | 5 |
| 02 | Manage keys, secrets, and certificates | 6 |
| 02 | Scan for secrets by using Defender Cloud Security Posture Management (Defender CSPM) | 7 |
| 02 | Implement Defender for Key Vault | 8 |
| 03 | Implement and configure security controls by using Azure Policy, including built-in and custom policy definitions | 2 |
| 03 | Evaluate regulatory compliance by using Microsoft Defender for Cloud | 3 |
| 03 | Implement and configure security controls in Defender for Cloud, including security standards and recommendations | 3 |
| 03 | Implement resource locks | 4 |
| 03 | Manage Azure built-in role assignments | 5 |
| 03 | Manage custom roles, including Azure roles and Microsoft Entra roles | 6 |
| 03 | Evaluate and remediate overprivileged access assignments by using Azure role-based access control (RBAC) | 7 |
| 03 | Configure security controls for backup protection by using Azure Backup security features | 8 |
| 03 | Implement and configure security controls by using infrastructure as code | 9 |
Secure storage, databases, and networking (25 à 30 %)#
| Ch. | Compétence mesurée (guide officiel, en anglais) | Section |
|---|---|---|
| 04 | Implement and configure security for storage accounts | 2, 3, 6 |
| 04 | Configure Azure Storage firewall rules | 5 |
| 04 | Implement Defender for Storage threat protection configurations | 7 |
| 04 | Manage access to storage, including access policies | 4 |
| 05 | Implement platform-level security configurations in Azure SQL | 1 à 5 |
| 05 | Configure database auditing for Azure SQL Database and Azure SQL Managed Instance | 6 |
| 05 | Configure Defender for Databases protection across Azure database services | 7 |
| 06 | Implement and manage network security groups (NSGs) and application security groups (ASGs) | 2 |
| 06 | Implement and configure network access policies by using Azure Virtual Network Manager | 3 |
| 06 | Configure security for an Azure Virtual WAN | 4 |
| 06 | Implement and configure security for virtual private network (VPN) connections | 5 |
| 06 | Implement and configure Microsoft Entra Private Access | 6 |
| 06 | Configure Azure private endpoints to secure access to Azure platform as a service (PaaS) resources | 7 |
| 06 | Configure Azure Private Link services to secure access to network resources | 8 |
| 06 | Implement and configure Azure Firewall | 9 |
| 06 | Evaluate effective security rules by using Azure Network Watcher diagnostics | 10 |
Secure compute (20 à 25 %)#
| Ch. | Compétence mesurée (guide officiel, en anglais) | Section |
|---|---|---|
| 07 | Identify overexposure of data in SharePoint | 2 |
| 07 | Identify risks related to Microsoft Copilot and AI apps by using Microsoft Purview Data Security Posture Management (DSPM) | 3 |
| 07 | Enable and configure real-time protection for Microsoft Copilot Studio agents | 4 |
| 07 | Implement conditional access for Microsoft Entra Agent ID | 5.3 |
| 07 | Analyze blast radius for security risks related to Entra Agent ID by using Defender XDR | 6 |
| 07 | Manage Entra Agent ID access | 5.5 |
| 07 | Configure and deploy AI Gateway in Azure API Management for Microsoft Foundry | 7 |
| 07 | Enable Defender for AI Service in Cloud Workload Protection in Defender for Cloud | 8 |
| 07 | Configure guardrails for agent security in Foundry | 9 |
| 07 | Monitor AI security by using the Data and AI security dashboard in Defender for Cloud | 10 |
| 07 | Manage agents in Microsoft 365 admin center | 11 |
| 08 | Implement and configure disk encryption | 2 |
| 08 | Plan and implement Azure Bastion | 3 |
| 08 | Enable and enforce use of just-in-time (JIT) VM access | 4 |
| 08 | Extend security controls to hybrid and multicloud servers by using Azure Arc | 5 |
| 08 | Onboard servers to Defender for Servers in Defender for Cloud, including hybrid and multicloud scenarios | 6 |
| 08 | Configure Defender for Servers settings, including vulnerability scanning, and endpoint detection and response (EDR) | 7 |
| 08 | Implement and manage agentless scanning for VMs in Defender for Servers | 8 |
| 08 | Configure security features on a VM, including secure boot, virtual Trusted Platform Module (vTPM), integrity monitoring, and security type | 9 |
| 08 | Enforce security configuration of Azure-managed servers by using Azure Machine Configuration | 10 |
| 09 | Detect misconfigurations and runtime risks in container workloads by using Defender for Containers | 2 |
| 09 | Implement and configure security controls for Azure Kubernetes Service (AKS) | 3 |
| 09 | Implement and configure security controls for Azure Container Registry | 4 |
| 09 | Implement and configure security controls for Azure Container Instances and Azure Container Apps | 5 |
| 09 | Implement and configure security controls for Azure Functions, including authentication and network access | 6 |
| 09 | Implement and configure security controls for Azure Logic Apps | 7 |
| 09 | Implement and configure security controls for Azure App Service | 8 |
| 09 | Implement and configure Azure Web Application Firewall | 9 |
| 09 | Implement security policies for back-end API protection by using API Management | 10 |
Manage and monitor security posture (20 à 25 %)#
| Ch. | Compétence mesurée (guide officiel, en anglais) | Section |
|---|---|---|
| 10 | Identify security risks by using Defender CSPM | 2 |
| 10 | Evaluate compliance against security frameworks by using Defender for Cloud | 3 |
| 10 | Enable and configure Defender for Cloud workload protection plans | 4 |
| 10 | Connect hybrid cloud and multicloud environments to Defender for Cloud, including Amazon Web Services (AWS) and Google Cloud Platform (GCP) | 5 |
| 10 | Configure Microsoft Defender Vulnerability Management settings for Azure VMs | 7 |
| 10 | Discover unprotected assets and vulnerabilities by using Microsoft Defender External Attack Surface Management (EASM) | 8 |
| 11 | Create and connect workspaces in Microsoft Sentinel | 2 |
| 11 | Assign roles in Microsoft Sentinel | 3 |
| 11 | Implement and use content hub solutions | 4 |
| 11 | Configure and use Microsoft data connectors for Azure resources | 5 |
| 11 | Implement and configure syslog and Common Event Format (CEF) event collections | 6 |
| 11 | Implement and configure collection of Windows Security events by using data collection rules, including Windows Event Forwarding (WEF) | 7 |
| 11 | Create custom log tables in the workspace to store ingested data | 8 |
| 11 | Implement automation rules and playbooks in Microsoft Sentinel | 9 |
| 11 | Implement data retention in Microsoft Sentinel data stores | 10 |
| 11 | Query Microsoft Purview Audit in Defender XDR | 11 |
| 12 | Configure workspaces for Security Copilot | 3 |
| 12 | Manage permissions and roles in Security Copilot | 4 |
| 12 | Enable and configure plugins | 5 |
| 12 | Enable and configure Microsoft agents and Security Store agents | 7 |
Organisation du dossier#
SC-500/
├── README.md ce plan de révision
├── 01-…md à 12-…md un fichier par chapitre
├── images/ les schémas exportés en PNG (affichés dans les chapitres)
├── DRAWIO/ les schémas sources, modifiables dans draw.io
└── outils/ les scripts qui génèrent les schémas (moteur de GenDoc)
Régénérer les schémas d'un chapitre : python outils/schemas_NN.py [noms…] depuis ce dossier (GenDoc doit être dans ..\..\GENERATEUR-PPT).
Méthode de révision conseillée#
- Lire un chapitre en entier, schémas compris.
- Faire ses labs conseillés dans un locataire et un abonnement de test (jamais en production), puis supprimer les ressources payantes.
- Répondre aux scénarios du chapitre sans regarder la réponse.
- La veille de l'examen : relire les fiches à retenir et les tableaux de pièges de chaque chapitre.
- Ordre conseillé : 01 → 03 (socle identité et gouvernance), puis 06, 04, 05, 02, puis 08, 09, 07, puis 10, 11, 12.