Secure compute

Compute is where Microsoft's security portfolio is at its most layered, and the exam exploits that by offering you four real controls and asking which one belongs at this layer. Keep asking: is this about the platform (Defender plans, Azure Policy), the machine (encryption, trusted launch, agents), the network path (Bastion, JIT, access restrictions) or the application (authentication, WAF, API Management)?

3.1 Security for AI — the short version

This sub-skill spans five products and eleven bullet points in the skills measured. Here is the map; the AI & agent security deep dive works through every item in detail, and you should read it before the exam rather than relying on this summary.

3.2 Servers and virtual machines

Disk encryption

flowchart TB
  Q["Choosing disk encryption for a virtual machine"] --> A{"Do you have to hold and rotate the key yourself?"}
  A -->|"No"| SSE["Server-side encryption, platform-managed key<br/>On by default on every managed disk"]
  A -->|"Yes"| B{"Where must the encryption be applied?"}
  B -->|"At the host — OS and data disks,<br/>the temporary disk and host caches"| HOST["Encryption at host<br/>plus a disk encryption set<br/>No agent, no performance cost"]
  B -->|"In the guest, because policy<br/>names BitLocker or dm-crypt"| ADE["Azure Disk Encryption<br/>A VM extension; keys and<br/>secrets live in Key Vault"]
  B -->|"So the Azure host itself<br/>cannot read the disk"| CONF["Confidential VM<br/>Key bound to the hardware<br/>trusted execution environment"]

Azure Bastion

Bastion gives RDP and SSH over TLS on port 443 from the portal or a native client, so VMs need no public IP, no agent and no open management ports. Dedicated SKUs need a subnet named exactly AzureBastionSubnet, sized /26 or larger.

SKUs can be upgraded but never downgraded — a downgrade means deleting and recreating the host. "We must keep an audit trail of what administrators did in the session" is Premium, every time.

Just-in-time VM access

• Part of Defender for Servers Plan 2. It keeps management ports closed with a deny rule and opens them, for a named port, source IP and time window, only on approved request.
• Requesting access needs write permission on the VM plus Microsoft.Security/locations/jitNetworkAccessPolicies/initiate/action.
• It edits NSG and Azure Firewall rules for you, then reverts them. It does not remove the public IP — which is why Bastion and JIT are complements, not alternatives.

Azure Arc and Defender for Servers

Azure Arc-enabled servers project a machine outside Azure — on-premises, at the edge, in AWS or GCP — into Azure Resource Manager as a first-class resource. Once projected, it can carry Azure Policy assignments, Machine Configuration, extensions, tags and Defender plans exactly like an Azure VM. When a scenario says "extend these controls to our data-centre servers", Arc is the enabling step.

Trusted launch and VM security types

Integrity monitoring requires vTPM, and vTPM requires trusted launch — a chain worth remembering, because a question will describe the requirement and expect you to name all three.

Azure Machine Configuration

Formerly Azure Policy guest configuration. It audits — and, with the right assignment, remediates — settings inside the operating system: password policy, installed applications, certificates, registry keys, running services, and the Microsoft cloud security benchmark compute baselines. It needs the Machine Configuration extension plus a system-assigned managed identity on each machine, and works identically on Azure VMs and Arc-enabled servers. Audit-only policies are free; Apply (remediating) configurations are charged per machine.

3.3 Containers, AKS and the registry

flowchart TB
  BUILD["Build — image pushed to Azure Container Registry"] --> SCAN["Agentless vulnerability assessment of registry images,<br/>by Microsoft Defender Vulnerability Management"]
  SCAN --> POL["Admission — the Azure Policy add-on for Kubernetes audits or denies:<br/>no privileged containers, approved registries only, no host path mounts"]
  POL --> RUN["Run — the workload executes on a node"]
  RUN --> SENSOR["Defender sensor on each node — runtime threat detection and binary drift"]
  RUN --> DISC["Agentless discovery — cluster and API server configuration,<br/>and the images actually running"]

Microsoft Defender for Containers

• Agentless discovery for Kubernetes — reads the cluster and API configuration through the API server, with no components installed, and feeds the security graph and attack path analysis.
• Agentless vulnerability assessment — scans images in Azure Container Registry and the images actually running in clusters, using Microsoft Defender Vulnerability Management.
• Defender sensor — a DaemonSet on each node providing runtime threat detection: crypto-mining, reverse shells, container escape attempts, and binary drift (a binary running that was never in the image).
• Azure Policy add-on for Kubernetes — enforces data-plane rules at admission via Gatekeeper: no privileged containers, no host networking, approved registries only, required resource limits. Effects are audit or deny.

Hardening AKS

Azure Container Registry

• Disable the admin user. It is a shared username and password with push rights and no identity — the container-registry equivalent of a storage account key.
• Use Entra roles — AcrPull for the AKS kubelet identity, AcrPush for pipelines — and disable anonymous pull.
• Tokens and scope maps give repository-scoped, expiring credentials when a partner needs one repository and nothing else.
• Premium tier unlocks private endpoints, customer-managed keys, content trust (image signing), quarantine (an image stays unpullable until it passes a scan), geo-replication and dedicated agent pools.
• Defender for Containers scans pushed images and continually reassesses them as new vulnerabilities are published.

3.4 The application platform

flowchart TB
  C["Client request"] --> AR["Access restrictions — allow and deny rules<br/>by IP address, service tag or virtual network"]
  AR --> PE["Private endpoint — an inbound private IP for the app<br/>set public network access to Disabled alongside it"]
  PE --> APP["App Service or Function app<br/>sign-in handled by built-in authentication"]
  APP --> VI["Virtual network integration — the only outbound<br/>control of the three, letting the app reach your network"]
  VI --> BE["Private backends — Azure SQL, Key Vault and<br/>storage behind their own private endpoints"]

App Service and Azure Functions

Azure Logic Apps

• A Consumption logic app with a Request trigger exposes a callback URL containing a SAS signature. Anyone with the URL can run the workflow. Controls: restrict trigger access by IP range, restrict run history contents access by IP range, regenerate the access key to invalidate issued URLs, or switch the trigger to Microsoft Entra OAuth and validate the token.
• Use a managed identity on connections rather than stored credentials in an API connection.
• Mark sensitive parameters as secure inputs and outputs so values are redacted in run history — a common place for secrets to sit in plain sight.
• Standard logic apps run on the App Service platform, so they get private endpoints, virtual network integration and access restrictions. Consumption logic apps do not.

Azure Web Application Firewall

Tuning is done with exclusions (ignore a named header, cookie or argument for a rule) and custom rules, which are evaluated before the managed rule set and are how you implement allow-lists, geo-blocking and rate limits. Disabling a whole rule because one request tripped it is the wrong answer; an exclusion scoped to that parameter is the right one.

API Management as the back-end protection layer

APIM's security is expressed as policies in the inbound, backend, outbound and on-error pipelines, applied at global, product, API or operation scope.

<inbound>
  <!-- Reject anything without a valid Microsoft Entra token for this API. -->
  <validate-jwt header-name="Authorization"
                failed-validation-httpcode="401"
                failed-validation-error-message="Unauthorized">
    <openid-config url="https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration" />
    <audiences>
      <audience>api://contoso-orders</audience>
    </audiences>
    <required-claims>
      <claim name="roles" match="any">
        <value>Orders.Read</value>
      </claim>
    </required-claims>
  </validate-jwt>

  <!-- Then throttle per caller, so a valid token cannot be used to flood the backend. -->
  <rate-limit-by-key calls="120" renewal-period="60"
                     counter-key="@(context.Subscription?.Id ?? context.Request.IpAddress)" />
  <ip-filter action="allow">
    <address-range from="203.0.113.0" to="203.0.113.255" />
  </ip-filter>
</inbound>

Skill 3 checklist

Next: Skill 4, where all of this becomes telemetry.