SC-500 · Domain 3 of 4

SC-500 Domain 3: Secure compute

This group covers protecting everything that runs workloads, and it holds the single biggest change from AZ-500: a full AI security sub-domain. It also covers servers and virtual machines, and application platform services from containers to App Service.

Exam weight
20–25%
Official functional groups
3
Estimated questions estimate
9–14
Suggested study time estimate
20–30 hrs

About 12 min read Reviewed October 2026

Overview

Securing compute covers the resources that run workloads and, newly, AI. It has three areas. Security for AI, the headline addition in SC-500, covers identifying data overexposure in SharePoint, assessing Copilot and AI app risk with Microsoft Purview Data Security Posture Management, protecting Copilot Studio agents, Conditional Access and access management for Microsoft Entra Agent ID, analyzing agent blast radius with Defender XDR, deploying an AI Gateway in Azure API Management for Microsoft Foundry, enabling Defender for AI Service, configuring Foundry guardrails, and monitoring with the Data and AI security dashboard. Security for servers and VMs covers disk encryption, Azure Bastion, just-in-time VM access, Azure Arc for hybrid and multicloud, Defender for Servers, agentless scanning, and VM features such as secure boot and vTPM. Security for application platforms covers Defender for Containers, AKS, Container Registry, Container Instances and Apps, Functions, Logic Apps, App Service, Web Application Firewall and API Management.

This group is the primary differentiator from the retired AZ-500, which had no first-class AI security content.

How it's tested

Expect scenario questions that describe an AI workload, a virtual machine, or a container or app platform, and ask which security control, Defender plan or AI-specific feature to use. The AI sub-domain is new, so knowing its specific tools is essential.

  • AI security tool

    An AI risk such as Copilot data exposure or agent overreach is described, and you must choose Purview DSPM, Entra Agent ID, Defender for AI or a Foundry guardrail.

  • VM access control

    A remote access or VM hardening need is described, and you must choose Bastion, just-in-time access, disk encryption or a VM security feature.

  • Right Defender plan

    A workload type is described, and you must choose the matching Defender plan, such as Defender for Servers or Defender for Containers.

Reasoning it through

An organization is rolling out Microsoft 365 Copilot and worries that it could surface files users should not see. Blocking Copilot is tempting, but the risk is data overexposure, not Copilot itself. Microsoft Purview Data Security Posture Management for AI identifies oversharing and risky data that Copilot could surface, so the answer is to assess and remediate exposure with Purview DSPM rather than disable the tool.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

3.1 Implement security for AIPurview DSPM for AI, Copilot and agent protection, Entra Agent ID, Defender for AI, Foundry guardrails and AI Gateway.
What it means
This new sub-domain covers identifying data overexposure in SharePoint, assessing Copilot and AI app risk with Microsoft Purview Data Security Posture Management (DSPM), enabling real-time protection for Copilot Studio agents, implementing Conditional Access and access management for Microsoft Entra Agent ID, analyzing agent blast radius with Defender XDR, deploying an AI Gateway in Azure API Management for Microsoft Foundry, enabling Defender for AI Service, configuring Foundry guardrails, and monitoring with the Data and AI security dashboard in Defender for Cloud.
What to understand
AI introduces new identities and new data paths. Purview DSPM for AI surfaces data that Copilot could overexpose. Microsoft Entra Agent ID gives AI agents identities that can be governed with Conditional Access, and Defender XDR can analyze an agent's blast radius. Foundry guardrails and the AI Gateway in API Management control and monitor model access. These tools have no AZ-500 equivalent.
How it shows up
An AI risk is described, and you must choose the Purview, Entra, Defender or Foundry control that addresses it.
Common confusion
Treating AI risk as a reason to block AI tools. The exam expects you to govern and monitor AI with the specific tools rather than disable it.
3.2 Implement security for servers and virtual machines (VMs)Disk encryption, Bastion, JIT access, Azure Arc, Defender for Servers and VM security features.
What it means
This covers implementing disk encryption, planning and implementing Azure Bastion, enforcing just-in-time VM access, extending controls to hybrid and multicloud servers with Azure Arc, onboarding servers to Defender for Servers, configuring Defender for Servers including vulnerability scanning and endpoint detection and response, agentless scanning, and VM security features such as secure boot, virtual Trusted Platform Module (vTPM) and integrity monitoring, plus enforcing configuration with Azure Machine Configuration.
What to understand
Azure Bastion provides secure RDP and SSH through the portal without exposing public IPs. Just-in-time VM access opens management ports only when needed and for a limited, approved window. Azure Arc brings non-Azure servers under Azure security management. Defender for Servers adds vulnerability scanning and EDR. Secure boot and vTPM protect boot integrity.
How it shows up
A VM access or hardening need is described, and you must choose Bastion, just-in-time access, disk encryption or the right Defender for Servers feature.
Common confusion
Confusing Azure Bastion with just-in-time access. Bastion provides secure connectivity without public IPs; JIT limits when management ports are open.
3.3 Implement security for application platform servicesDefender for Containers, AKS, Container Registry, Functions, Logic Apps, App Service, WAF and API Management.
What it means
This covers detecting container misconfigurations and runtime risks with Defender for Containers, security controls for Azure Kubernetes Service, Container Registry, Container Instances and Container Apps, security for Azure Functions including authentication and network access, Logic Apps, App Service, Azure Web Application Firewall, and back-end API protection with API Management.
What to understand
Defender for Containers protects Kubernetes and container registries with scanning and runtime detection. App Service and Functions use managed identities and network restrictions for security. A Web Application Firewall protects web apps and APIs at layer 7, and API Management adds policies such as authentication and rate limiting for back-end APIs.
How it shows up
A container or application platform need is described, and you must choose the Defender plan or platform security control.
Common confusion
Confusing Defender for Containers with Defender for Servers. Containers and Kubernetes are covered by Defender for Containers.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Purview DSPM for AI

    Identifies data overexposure and risky data that Copilot and AI apps could surface.

    Remember
    It addresses AI data risk without disabling AI.
    Tested as
    AI security questions.
    Trap
    Choosing to block Copilot instead of assessing exposure.

  • Microsoft Entra Agent ID

    Gives AI agents identities that can be governed with Conditional Access and access management.

    Remember
    AI agents are identities to govern, not just features.
    Tested as
    AI governance questions.
    Trap
    Treating agents as unmanaged tools.

  • Agent blast radius

    The scope of what a compromised or overreaching AI agent could affect, analyzed with Defender XDR.

    Remember
    Blast radius analysis limits agent risk.
    Tested as
    AI risk questions.
    Trap
    Overlooking what an agent can reach.

  • Foundry guardrails and AI Gateway

    Controls and a gateway in API Management that govern and monitor access to Foundry models.

    Remember
    They enforce policy on model access.
    Tested as
    AI platform questions.
    Trap
    Exposing models without guardrails or a gateway.

  • Defender for AI Service

    A Defender for Cloud workload protection plan for AI services.

    Remember
    It detects threats against AI workloads.
    Tested as
    AI threat protection questions.
    Trap
    Expecting classic Defender plans to cover AI workloads.

  • Azure Bastion

    Secure RDP and SSH through the portal with no public IP on the VM.

    Remember
    It removes the need to expose management ports publicly.
    Tested as
    VM access questions.
    Trap
    Confusing it with just-in-time access.

  • Just-in-time (JIT) VM access

    Opens management ports only when needed, for a limited window, to approved users.

    Remember
    It reduces the exposure window of management ports.
    Tested as
    VM access questions.
    Trap
    Confusing it with Bastion.

  • Azure Arc

    Extends Azure management and security to non-Azure and multicloud servers.

    Remember
    It brings hybrid servers under Defender for Cloud.
    Tested as
    Hybrid security questions.
    Trap
    Assuming Defender for Servers covers non-Azure servers without Arc.

  • Defender for Servers

    Workload protection for VMs with vulnerability scanning and endpoint detection and response.

    Remember
    It covers servers, not containers.
    Tested as
    Workload protection questions.
    Trap
    Using it for container workloads.

  • Defender for Containers

    Protects Kubernetes and container registries with scanning and runtime detection.

    Remember
    It is the container-focused Defender plan.
    Tested as
    Container security questions.
    Trap
    Confusing it with Defender for Servers.

  • Secure boot and vTPM

    VM features that protect boot integrity and provide a virtual Trusted Platform Module.

    Remember
    They support trusted launch of VMs.
    Tested as
    VM hardening questions.
    Trap
    Overlooking boot-integrity features.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Azure Bastion vs. just-in-time VM access

ConceptMeaningKey differenceCommon trap
Azure Bastion Secure RDP and SSH through the portal No public IP needed on the VM Confusing it with JIT access
Just-in-time access Opens management ports only when needed Limits the time ports are open Expecting it to provide the connection itself

Defender for Servers vs. Defender for Containers vs. Defender for AI Service

ConceptMeaningKey differenceCommon trap
Defender for Servers Protects VMs with scanning and EDR Server and VM workloads Using it for containers
Defender for Containers Protects Kubernetes and registries Container workloads Confusing it with Defender for Servers
Defender for AI Service Protects AI workloads AI-specific threat detection Expecting classic plans to cover AI

Purview DSPM for AI vs. Entra Agent ID vs. Foundry guardrails

ConceptMeaningKey differenceCommon trap
Purview DSPM for AI Finds data overexposure AI could surface Data-risk focus Blocking AI instead of assessing exposure
Entra Agent ID Governs AI agent identities with access controls Identity-governance focus Leaving agents ungoverned
Foundry guardrails Policy controls on model behavior and access Model-behavior focus Deploying models without guardrails

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Block the AI

    What candidates pick
    Disable Microsoft 365 Copilot to prevent it surfacing sensitive files.
    Why it looks right
    It removes the risk directly.
    Why it's wrong
    The risk is data overexposure, which Purview DSPM for AI identifies and helps remediate. The exam expects governing AI, not blocking it.

    Clue to watch for The concern is Copilot surfacing overshared data.

  2. Bastion is JIT

    What candidates pick
    Use just-in-time access to provide a secure connection to a VM with no public IP.
    Why it looks right
    Both secure VM access.
    Why it's wrong
    Azure Bastion provides the secure connection without a public IP; JIT limits when management ports are open.

    Clue to watch for The need is connectivity without a public IP versus limiting port exposure time.

  3. Servers plan for containers

    What candidates pick
    Enable Defender for Servers to protect an AKS cluster.
    Why it looks right
    It is a Defender workload plan.
    Why it's wrong
    Kubernetes and container registries are covered by Defender for Containers.

    Clue to watch for The workload is containers or Kubernetes.

  4. Ungoverned agents

    What candidates pick
    Deploy AI agents without identity governance.
    Why it looks right
    Agents feel like features, not identities.
    Why it's wrong
    Microsoft Entra Agent ID gives agents identities that should be governed with Conditional Access and access management.

    Clue to watch for The scenario involves AI agents acting with access.

  5. No guardrails

    What candidates pick
    Expose Foundry models through an app without an AI Gateway or guardrails.
    Why it looks right
    It is faster to ship.
    Why it's wrong
    The AI Gateway in API Management and Foundry guardrails enforce and monitor controlled access to models.

    Clue to watch for Models are exposed without access control or monitoring.

  6. Arc not needed

    What candidates pick
    Expect Defender for Servers to protect on-premises servers without Azure Arc.
    Why it looks right
    Defender for Servers protects servers.
    Why it's wrong
    Non-Azure servers must be onboarded through Azure Arc to come under Defender for Cloud.

    Clue to watch for The servers are on-premises or in another cloud.

Answer framework

For any Domain 3 compute scenario, use these steps before choosing an answer.

  1. Identify whether the workload is an AI service, a server or VM, or an application platform such as containers or App Service.
  2. For AI, choose the specific tool: Purview DSPM for data exposure, Entra Agent ID for agent governance, Defender for AI for threats, and Foundry guardrails or the AI Gateway for model access.
  3. For VMs, use Bastion for secure connectivity without public IPs and just-in-time access to limit management port exposure, plus disk encryption and trusted launch features.
  4. Match the Defender plan to the workload: Defender for Servers for VMs, Defender for Containers for Kubernetes, and Defender for AI Service for AI.
  5. Govern and monitor AI rather than blocking it, and onboard non-Azure servers through Azure Arc to extend protection.

Practice question

An organization is deploying AI agents built with Microsoft Copilot Studio and wants to govern each agent's access with Conditional Access and understand what a compromised agent could reach. Which combination of capabilities should the security engineer use?

Want more like this? The SC-500 practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Prioritize the AI security sub-domain in 3.1, because it is the biggest difference from the retired AZ-500 and the least covered by older study material. Learn each AI tool and the risk it addresses: Purview DSPM for data overexposure, Entra Agent ID for agent identity governance, Defender XDR for blast radius, Defender for AI Service for threats, and Foundry guardrails and the AI Gateway for model access. Fix the mindset that AI risk is governed, not blocked.

Next, study VM security in 3.2, keeping Bastion and just-in-time access distinct and learning when Azure Arc is required for hybrid servers. Then cover application platforms in 3.3, with the key distinction between Defender for Servers and Defender for Containers.

An Azure subscription with a VM, a container workload and, if available, a Copilot or Foundry trial lets you see these controls in context. Afterwards, move to group 4, managing and monitoring security posture, which brings these protections together in Defender for Cloud and Sentinel.

FAQ

How much of SC-500 is this functional group?

Secure compute is 20 to 25% of the exam, and it contains the AI security sub-domain that distinguishes SC-500 from the retired AZ-500.

What AI security content is new in SC-500?

Purview DSPM for AI, Copilot and Copilot Studio agent protection, Microsoft Entra Agent ID, Defender XDR agent blast radius analysis, Defender for AI Service, the AI Gateway in API Management and Foundry guardrails. None of this existed in AZ-500.

What is Microsoft Entra Agent ID?

An identity for AI agents that lets you govern their access with Conditional Access and access management, treating agents as identities rather than unmanaged features.

What is the difference between Azure Bastion and just-in-time VM access?

Bastion provides secure RDP and SSH through the portal with no public IP on the VM. Just-in-time access opens management ports only when needed and for a limited window.

When do I use Defender for Containers versus Defender for Servers?

Defender for Containers protects Kubernetes and container registries. Defender for Servers protects virtual machines with vulnerability scanning and endpoint detection and response.

How do I protect on-premises servers?

Onboard them through Azure Arc so they can be managed by Defender for Cloud and receive Defender for Servers protection.

How does this group connect to the rest of the exam?

It protects the workloads that run within the identity model of group 1 and the data and networks of group 2, and its protections are monitored for posture in group 4.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered AI security, server and VM protection, and application platform security. Test whether you can choose the right AI tool and Defender plan under exam conditions.

Take the SC-500 practice test Check your SC-500 readiness

Keep going