SC-500 · Domain 1 of 4

SC-500 Domain 1: Manage identity, access, and governance

This group sets the identity and governance foundation for the SC-500 exam. It covers securing access with Microsoft Entra ID, protecting secrets and keys with Azure Key Vault, and enforcing security and compliance through governance controls.

Exam weight
20–25%
Official functional groups
3
Estimated questions estimate
9–14
Suggested study time estimate
20–30 hrs

About 11 min read Reviewed October 2026

Overview

Managing identity, access, and governance is the foundation of securing an Azure environment. This group covers three areas. Securing access with Microsoft Entra ID covers Privileged Identity Management, Conditional Access, authentication methods including MFA and passwordless, application identity through enterprise applications and app registrations, OAuth permission grants and consent, and managed identities. Securing secrets and keys with Azure Key Vault covers deploying and configuring Key Vault, access and firewall settings, managing keys, secrets and certificates, and scanning for secrets with Defender CSPM. Governance covers Azure Policy, regulatory compliance evaluation in Defender for Cloud, resource locks, built-in and custom roles, remediating overprivileged access with Azure RBAC, backup protection, and security controls through infrastructure as code.

SC-500 is the successor to the retired AZ-500, carrying its identity and governance content forward. This group establishes who can access what and under which rules, which every later group depends on.

How it's tested

Expect scenario questions that describe an access, secret-management or governance requirement and ask which Entra ID feature, Key Vault setting or governance control to use. The exam rewards knowing the exact feature for each need and the least-privilege approach. Favor the least-privilege, least-secret option.

  • Right identity control

    An access requirement is described, and you must choose between PIM, Conditional Access, MFA, managed identities or app registration settings.

  • Secret management

    A need to store or access secrets is described, and you must choose the Key Vault configuration or a managed identity over a stored secret.

  • Governance enforcement

    A compliance or least-privilege requirement is described, and you must choose Azure Policy, RBAC remediation or another governance control.

Reasoning it through

An Azure function needs to read a secret from Key Vault without storing any credential in its code or configuration. Embedding a secret or a service principal password is tempting, but it creates a credential to protect and rotate. A managed identity lets the function authenticate to Key Vault with no stored secret, which is the least-secret approach the exam expects.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

1.1 Secure access to resources by using Microsoft Entra IDPIM, Conditional Access, authentication methods, application identity and managed identities.
What it means
This covers implementing Privileged Identity Management for just-in-time privileged access, Conditional Access policies, authentication methods including MFA and passwordless, identity for applications through enterprise applications and app registrations, OAuth permission grants and consent settings, and managed identities for Azure resources.
What to understand
Privileged Identity Management provides time-bound, approval-based elevation for privileged roles. Conditional Access evaluates signals such as user, device and location to allow, block or challenge access. Managed identities let Azure resources authenticate without stored credentials, which is the preferred least-secret pattern. App registrations and consent control how applications obtain permissions.
How it shows up
An access requirement is described, and you must choose the right Entra ID feature, often PIM for privileged elevation or a managed identity for credential-free access.
Common confusion
Confusing PIM with Conditional Access. PIM governs time-bound privileged role elevation; Conditional Access governs the conditions under which any access is granted.
1.2 Secure secrets and keys by using Azure Key VaultDeploy and configure Key Vault, access and firewall settings, manage keys and secrets, and scan with Defender CSPM.
What it means
This covers deploying Key Vault, configuring its settings, configuring access through vault access policies or Azure RBAC, configuring firewall settings to restrict network access, managing keys, secrets and certificates, scanning for exposed secrets with Defender Cloud Security Posture Management, and implementing Defender for Key Vault.
What to understand
Key Vault centralizes secrets, keys and certificates so they are not scattered in code. Access can use the older vault access policy model or Azure RBAC, with RBAC the current recommendation. Firewall settings and private endpoints restrict which networks can reach the vault. Defender CSPM can detect secrets exposed in code, and Defender for Key Vault alerts on suspicious access.
How it shows up
A secret-protection need is described, and you must choose the access model, firewall setting or Defender capability.
Common confusion
Confusing vault access policies with Azure RBAC for Key Vault. They are two different authorization models, and mixing them can cause unexpected access results.
1.3 Implement governance to enforce security and regulatory complianceAzure Policy, compliance evaluation, resource locks, roles, overprivileged access remediation and infrastructure as code.
What it means
This covers implementing security controls with Azure Policy including built-in and custom definitions, evaluating regulatory compliance in Defender for Cloud, configuring security standards and recommendations, implementing resource locks, managing built-in and custom Azure and Entra roles, evaluating and remediating overprivileged access with Azure RBAC, configuring backup protection, and implementing security controls through infrastructure as code.
What to understand
Azure Policy enforces and audits configuration at scale, while RBAC controls who can do what. Resource locks prevent accidental deletion or change. Least privilege means finding and removing overprivileged assignments, and custom roles let you grant only the permissions needed. Infrastructure as code brings consistency, so a flawed template deploys the flaw everywhere.
How it shows up
A compliance or least-privilege need is described, and you must choose Azure Policy, a resource lock, a custom role or RBAC remediation.
Common confusion
Confusing Azure Policy with RBAC. Policy governs resource configuration and compliance; RBAC governs who can perform actions.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Privileged Identity Management (PIM)

    Provides just-in-time, time-bound, approval-based elevation for privileged roles.

    Remember
    It reduces standing privileged access.
    Tested as
    Privileged access questions.
    Trap
    Confusing it with Conditional Access.

  • Conditional Access

    Grants, blocks or challenges access based on signals such as user, device and location.

    Remember
    It enforces conditions like MFA for risky sign-ins.
    Tested as
    Access control questions.
    Trap
    Confusing it with PIM.

  • Managed identity

    Lets an Azure resource authenticate without a stored credential.

    Remember
    The preferred least-secret approach for Azure resources.
    Tested as
    Credential-free access questions.
    Trap
    Embedding a service principal secret instead.

  • System vs. user-assigned managed identity

    System-assigned is tied to one resource's lifecycle; user-assigned is standalone and reusable.

    Remember
    Use user-assigned when multiple resources share an identity.
    Tested as
    Managed identity questions.
    Trap
    Using system-assigned where an identity must outlive one resource.

  • App registration and consent

    Defines an application's identity and the permissions it requests, with admin or user consent.

    Remember
    Admin consent is needed for high-privilege or organization-wide permissions.
    Tested as
    Application access questions.
    Trap
    Allowing broad user consent for sensitive permissions.

  • Key Vault access models

    Vault access policies or Azure RBAC authorize access to Key Vault.

    Remember
    Azure RBAC is the current recommended model.
    Tested as
    Key Vault questions.
    Trap
    Mixing the two models unexpectedly.

  • Key Vault firewall and private endpoints

    Restrict which networks can reach a vault.

    Remember
    A private endpoint keeps vault traffic on the private network.
    Tested as
    Key Vault network questions.
    Trap
    Leaving a vault open to all networks.

  • Defender CSPM secret scanning

    Detects secrets exposed in code and configuration.

    Remember
    It finds credentials that should move to Key Vault.
    Tested as
    Secret exposure questions.
    Trap
    Overlooking secrets committed to code.

  • Azure Policy

    Enforces and audits resource configuration at scale.

    Remember
    It governs configuration and compliance, not who can act.
    Tested as
    Governance questions.
    Trap
    Confusing it with RBAC.

  • Overprivileged access remediation

    Finding and removing excessive role assignments with Azure RBAC.

    Remember
    Least privilege means granting only the permissions needed.
    Tested as
    RBAC questions.
    Trap
    Leaving broad roles like Owner or Contributor assigned widely.

  • Resource locks

    Prevent accidental deletion or modification of resources.

    Remember
    CanNotDelete and ReadOnly are the two lock levels.
    Tested as
    Governance questions.
    Trap
    Confusing a lock with an RBAC permission.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

PIM vs. Conditional Access vs. MFA

ConceptMeaningKey differenceCommon trap
PIM Time-bound, approval-based privileged role elevation Governs when privileged roles are active Confusing it with Conditional Access
Conditional Access Grants or blocks access based on signals Governs the conditions of any access Expecting it to manage role elevation
MFA A second authentication factor A control often required by Conditional Access Treating it as a standalone policy engine

Managed identity vs. service principal with secret

ConceptMeaningKey differenceCommon trap
Managed identity Azure-managed identity with no stored credential No secret to store or rotate Not using it where available
Service principal with secret App identity authenticated with a stored secret or certificate Requires protecting and rotating the credential Using it where a managed identity would work

Azure Policy vs. Azure RBAC vs. resource locks

ConceptMeaningKey differenceCommon trap
Azure Policy Enforces and audits resource configuration Controls what configuration is allowed Confusing it with who can act
Azure RBAC Controls who can perform actions Governs permissions Expecting it to enforce configuration
Resource locks Prevent deletion or modification Protect against accidental change Treating a lock as a permission

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Store the secret

    What candidates pick
    Embed a service principal secret in the app to access Key Vault.
    Why it looks right
    It is a familiar way to authenticate.
    Why it's wrong
    It creates a credential to protect and rotate. A managed identity authenticates with no stored secret.

    Clue to watch for The resource is an Azure service that supports managed identities.

  2. Conditional Access for elevation

    What candidates pick
    Use Conditional Access to give time-bound privileged role access.
    Why it looks right
    Both govern access.
    Why it's wrong
    Time-bound privileged elevation is Privileged Identity Management. Conditional Access sets conditions for access, not role activation.

    Clue to watch for The need is just-in-time privileged role elevation.

  3. Policy for permissions

    What candidates pick
    Use Azure Policy to control who can perform an action.
    Why it looks right
    Policy governs resources.
    Why it's wrong
    Azure Policy enforces configuration and compliance. Who can act is controlled by RBAC.

    Clue to watch for The requirement is about permissions, not configuration state.

  4. Owner everywhere

    What candidates pick
    Assign the Owner or Contributor role broadly for convenience.
    Why it looks right
    It avoids permission problems.
    Why it's wrong
    It violates least privilege. Overprivileged assignments should be remediated, often with custom roles.

    Clue to watch for The scenario asks to reduce excessive access.

  5. Vault open to all

    What candidates pick
    Leave Key Vault reachable from all networks for simplicity.
    Why it looks right
    It avoids connectivity issues.
    Why it's wrong
    Firewall rules or a private endpoint should restrict network access to the vault.

    Clue to watch for The requirement mentions restricting network access to secrets.

  6. Mixed Key Vault models

    What candidates pick
    Combine vault access policies and Azure RBAC without understanding the interaction.
    Why it looks right
    Both appear to grant access.
    Why it's wrong
    They are separate authorization models, and mixing them can produce unexpected results. Choose one, preferring RBAC.

    Clue to watch for Access behaves unexpectedly after changing the model.

Answer framework

For any Domain 1 identity or governance scenario, use these steps before choosing an answer.

  1. Decide whether the need is access control, secret or key protection, or governance and compliance, since each uses a different set of controls.
  2. For access, prefer managed identities to eliminate stored secrets, use PIM for just-in-time privileged elevation, and Conditional Access for the conditions of access.
  3. For secrets, centralize them in Key Vault, choose Azure RBAC as the access model, and restrict network access with firewall rules or a private endpoint.
  4. For governance, use Azure Policy to enforce configuration, RBAC to control actions, and remediate overprivileged assignments toward least privilege.
  5. Prefer the least-privilege, least-secret option, and use infrastructure as code carefully since a flawed template deploys the flaw everywhere.

Practice question

An Azure App Service web app must read connection strings from Azure Key Vault without any credential stored in its configuration. Which approach should the security engineer recommend?

Want more like this? The SC-500 practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with identity in 1.1, since it is the primary cloud perimeter and the most tested area. Drill the distinctions candidates confuse: PIM versus Conditional Access, and managed identities versus stored secrets. Make the least-secret principle automatic, so you reach for a managed identity whenever a resource needs to authenticate.

Next, study Key Vault in 1.2. Learn the two access models, that Azure RBAC is current, and how firewall rules and private endpoints restrict network access. Add Defender CSPM secret scanning and Defender for Key Vault.

Then cover governance in 1.3, keeping Azure Policy (configuration) and RBAC (permissions) distinct, and practice remediating overprivileged assignments toward least privilege. A free Entra ID P2 trial and an Azure subscription let you practice PIM, Conditional Access and Key Vault hands-on, which makes these concepts stick. Afterwards, move to group 2, securing storage, databases and networking. Review each missed question by naming the control you confused.

FAQ

How much of SC-500 is this functional group?

Manage identity, access, and governance is 20 to 25% of the exam under the current SC-500 skills measured.

Is SC-500 the same as AZ-500?

SC-500 replaced AZ-500, which retired on 31 August 2026. It carries over most of AZ-500's identity, networking, storage and Defender content and adds a new AI security sub-domain.

What is the difference between PIM and Conditional Access?

Privileged Identity Management provides time-bound, approval-based elevation for privileged roles. Conditional Access decides whether to allow, block or challenge access based on signals such as user, device and location.

Why prefer a managed identity?

It lets an Azure resource authenticate without any stored credential, so there is no secret to protect or rotate. It is the least-secret approach the exam favors.

Which Key Vault access model should I use?

Azure RBAC is the current recommended model. The older vault access policy model still exists, but mixing the two can cause unexpected access results.

What is the difference between Azure Policy and RBAC?

Azure Policy enforces and audits resource configuration and compliance. Azure RBAC controls who can perform actions on resources.

How does this group connect to the rest of the exam?

It establishes who can access what and under which rules, which the storage, networking, compute and posture-monitoring groups all rely on.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered Entra ID access, Key Vault secret protection and Azure governance. Test whether you can choose the least-privilege, least-secret control under exam conditions.

Take the SC-500 practice test Check your SC-500 readiness

Keep going