Tim Warner | Pearson video course, Microsoft Press imprint | Companion repository
Secure Azure, hybrid, multicloud, and AI workloads end to end, and walk into Exam SC-500 knowing why each control exists.
How do you prove that a managed identity can read a resource group but not change it? What stops a Copilot agent from reading a SharePoint site it should never see? When Microsoft Sentinel fires an incident at 2:00 AM, what runs before a human wakes up? This course answers those questions with working demos, and this repository is where you practice them.
Watching the videos? Open the lesson folder that matches the lesson you are on. Each folder lists the exact objectives, the study guide sections they cover, and what to line up before you start. Its lab-guide.md has every portal step and command from the lesson's demos, in the order the video runs them, so you can do each demo yourself.
Studying without the videos? Start with the exam objective map. Rate yourself on every skill, then spend your time on anything below a 4.
Want the code? Every script and Bicep template from the demos in all 15 lessons is in lab/. Do the one-time setup, then open a lesson's demos/ page for its scripts. The changelog tracks every change.
The exam objective map goes one level deeper and ties every skill in Microsoft's study guide to the lesson that teaches it.
| Item | Detail |
|---|---|
| Exam | SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads |
| Certification | Microsoft Certified: Cloud and AI Security Engineer Associate |
| Replaces | AZ-500, which retired on August 31, 2026 |
| Passing score | 700 |
| Official study guide | Exam SC-500 study guide (Microsoft's page shows "Last updated on 2026-05-13") |
| Free practice assessment | Not available yet (checked November 8, 2026). Check the certification page for updates. |
| Domain | Weight | Lessons |
|---|---|---|
| Manage identity, access, and governance | 20-25% | 1, 2, 3, 12 |
| Secure storage, databases, and networking | 25-30% | 4, 5, 6, 7 |
| Secure compute | 20-25% | 8, 9, 10, 11 |
| Manage and monitor security posture | 20-25% | 8, 12, 13, 14, 15 |
Lesson 8 shows up twice because Defender Vulnerability Management for Azure VMs sits in the posture domain. Lesson 12 shows up twice because regulatory compliance in Defender for Cloud sits in the governance domain.
Most demos happen in the Azure portal and the Microsoft admin centers, because that is where you build the muscle memory the exam rewards. When a demo uses a Bicep template or a script, you get the same file the lesson runs on screen, and its help says what it reads and what it changes. Your tenant, subscription, domain, and a short name suffix go in once with lab/Set-LabConfig.ps1, and every resource name comes from the lesson's config.json.
Each lesson's lab guide walks through its demos step by step. Steps that start with Confirm are checks: find that value on your own screen before you move on, the same way a performance-based exam item grades your configuration.
Lessons 1 and 4 through 15 have a Remove- script that deletes what the lab created. Lessons 2 and 3 have a Clean up section in their README instead, because Lesson 2 leaves tenant objects that Lesson 10 reuses and Lesson 3's backup vault has to be emptied before it can be deleted. Several lessons use paid Defender plans and hourly resources, so each lesson README lists what to watch before you start.
- An Azure subscription where you hold Owner at the subscription scope. A dedicated sandbox with a budget alert is the right call.
- A Microsoft Entra tenant you administer. Privileged Identity Management needs Microsoft Entra ID P2 or Microsoft Entra ID Governance, and Conditional Access needs P1 or P2.
- A Microsoft 365 tenant for Lesson 10 (SharePoint, Microsoft Purview, Copilot Studio, and the Microsoft 365 admin center).
- Microsoft Defender for Cloud on your subscription. Foundational CSPM is free; the workload protection plans and Defender CSPM are paid.
- Optional: Azure CLI and Azure PowerShell for the steps that use them.
- Working knowledge of Azure resources, networking, and identity at roughly the AZ-104 level.
Every study week, touch all three:
- Theory: the video course, Microsoft Learn, and the official study guide.
- Hands-on experience: your own sandbox and the lab files in this repository.
- Practice questions: timed questions with a full review of every miss. Microsoft's free practice assessment for SC-500 was not available when this page was checked, so watch the certification page.
The study plan template lays out 30-, 60-, and 90-day schedules that each come to about 40 hours.
lessons/: one folder per lesson, each with a README, alab-guide.mdwith every demo step, and ademos/page that lists its lab fileslab/: every script and Bicep template from the demos in all 15 lessons, plus the one-time setupdocs/exam-objectives.md: every study guide skill mapped to a lesson, with a self-rating columndocs/study-plan-template.md: 30-, 60-, and 90-day schedulesdocs/resources.md: curated Microsoft Learn links by exam domaindemos/: demo material that spans more than one lessonCHANGELOG.md: what changed and whenCONTRIBUTING.md: how to report a problem or send a fixNOTICE.mdandLICENSE: license, publisher, and trademark notices
Tim Warner is a Microsoft MVP, a Microsoft Certified Trainer since 1997, and a Principal Staff Author at Pluralsight with more than 200 courses and over a million learners. He teaches live courses for Pearson and O'Reilly, and he builds and ships MCP servers. His teaching model comes from Richard Feynman: start from first principles, prove the idea with a working demo, and keep the examples close to real enterprise work.
You can find his video courses on Pluralsight, short tutorials on YouTube, more course repositories on GitHub, and everything else at TechTrainerTim.com. Connect with him on LinkedIn.
- Microsoft Press and Pearson for publishing this title
- Laura Lewin for editorial steering
- The Microsoft Entra, Defender, Sentinel, Purview, and Foundry teams for shipping the products this exam tests
- Every certification candidate who asked the question that made this material better
The code and documentation in this repository are released under the MIT License. The course videos and Pearson materials are licensed separately by Pearson. See NOTICE.md for publisher and trademark notices.
Go earn that badge.