SC-100 · Domain 4 of 4

SC-100 Domain 4: Design security solutions for applications and data

The SC-100 domain on protecting what users and applications touch: Microsoft 365 and Microsoft 365 Copilot, application security across the lifecycle, workload identities, API Management and Azure WAF, and data security for Azure data services, Storage and AI workloads.

Exam weight
20–25%
Official functional groups
3
Estimated questions estimate
~11
Suggested study time estimate
12–16 hrs

About 13 min read Reviewed October 2026

Overview

Domain 4 covers the assets attackers usually want most: collaboration content, business applications and data. The first functional group evaluates Microsoft 365 security using Secure Score metrics, Defender for Office 365, Defender for Cloud Apps, Intune device management, Microsoft Purview data protection, and the data security and compliance controls that apply to Microsoft 365 Copilot. The second group designs application security, from portfolio posture and threat modeling through secure development standards, workload identities, API Management and Azure Web Application Firewall.

The third group secures organizational data. It covers discovery and classification, prioritizing data threats, encryption at rest and in transit with Azure Key Vault and infrastructure encryption, security for data used in AI workloads, and protection of Azure SQL, Azure Synapse Analytics, Azure Cosmos DB and Azure Storage with Defender for Storage and Defender for Databases. Microsoft weights the domain at 20–25%.

How it's tested

Questions in this domain typically describe a business application, a set of data stores, or a Microsoft 365 rollout such as Copilot, then ask which control set reduces risk with the least disruption. Expect options that are all valid Microsoft features, where only one addresses the stated threat or data type.

  • Prepare data for Copilot

    An organization plans Microsoft 365 Copilot, and you choose labeling, DLP, permission cleanup or Data Security Posture Management steps to limit oversharing.

  • Remove the stored secret

    An application authenticates with keys or connection strings, and you replace them with managed identities or workload identity federation.

  • Pick the data protection

    A data store and threat are given, and you choose encryption, Defender for Storage or Databases, private access or classification.

Reasoning it through

A legal firm wants to deploy Microsoft 365 Copilot but worries it will reveal confidential case files to staff outside each matter team. Copilot respects existing permissions, so the issue is overshared content, not Copilot itself. The architect should recommend sensitivity labels with encryption, DLP policies for Copilot, and permission reviews from Data Security Posture Management for AI before rollout, which addresses the oversharing at its source.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

4.1 Evaluate solutions for securing Microsoft 365Secure Score metrics, Defender for Office 365, Defender for Cloud Apps, Intune, Purview and Microsoft 365 Copilot controls.
What it means
This group covers evaluating posture for productivity and collaboration workloads using metrics such as Microsoft Secure Score, evaluating solutions with Defender for Office 365 and Defender for Cloud Apps, evaluating Intune device management, evaluating Microsoft Purview protection of Microsoft 365 data, and evaluating data security and compliance controls in Microsoft 365 Copilot.
What to understand
Defender for Office 365 protects email and collaboration from phishing, malicious links and attachments. Defender for Cloud Apps is the CASB that discovers shadow IT, governs OAuth apps and applies session controls. Intune ensures devices are compliant before Conditional Access grants access. For Copilot, Purview sensitivity labels, DLP, audit, retention and Data Security Posture Management for AI determine what content is grounded and how prompts and responses are governed.
How it shows up
Expect a Microsoft 365 risk such as phishing, shadow SaaS or Copilot oversharing, and a question on which product evaluation fits.
Common confusion
Thinking Copilot bypasses permissions. It only accesses content the signed-in user can already reach.
4.2 Design solutions for securing applicationsPortfolio posture, threat modeling, lifecycle strategy, secure development, workload identities, API Management and Azure WAF.
What it means
This group covers evaluating the security posture of existing application portfolios, threat modeling business-critical applications, designing a full lifecycle application security strategy, setting standards for secure development, mapping technologies to application security requirements, designing workload identities for Azure access, designing API management and security, and protecting applications with Azure Web Application Firewall.
What to understand
Threat modeling, for example with STRIDE, identifies how an application could be attacked before controls are chosen. Lifecycle strategy places security in design, code, build, deploy and run stages, often using GitHub Advanced Security or Defender for Cloud DevOps security. Managed identities and workload identity federation remove stored secrets. API Management centralizes authentication, throttling and validation. Azure WAF on Application Gateway or Front Door blocks common web attacks using managed rule sets.
How it shows up
Questions describe an application weakness and ask where in the lifecycle or which service should address it.
Common confusion
Assuming a WAF fixes insecure code. It filters known attack patterns but does not replace secure development and testing.
4.3 Design solutions for securing an organization's dataDiscovery and classification, data threat priorities, encryption, AI data security, Azure data services, Storage and Defender plans.
What it means
This group covers evaluating data discovery and classification, setting priorities for data threat mitigation, evaluating encryption at rest and in transit including Azure Key Vault and infrastructure encryption, designing security for data used in AI workloads, securing Azure SQL, Azure Synapse Analytics and Azure Cosmos DB, securing Azure Storage, and designing with Defender for Storage and Defender for Databases.
What to understand
Purview Data Map and classification find where sensitive data lives across estates. Encryption at rest is on by default with platform keys, while customer-managed keys in Key Vault or Managed HSM add control and revocation. Infrastructure encryption adds a second layer. AI workload data, such as training sets and retrieval indexes, needs classification, access control and private connectivity. Defender for Storage scans for malware and anomalous access; Defender for Databases detects SQL injection and suspicious queries.
How it shows up
Expect a data store, a sensitivity level and a threat, with a question on the encryption, access or detection design that fits.
Common confusion
Believing customer-managed keys are required for all encryption at rest. Microsoft-managed keys already encrypt data by default.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Microsoft 365 Copilot data controls

    Purview labels, DLP, audit, retention and permission governance applied to Copilot interactions.

    Remember
    Copilot honors existing permissions and label encryption usage rights.
    Tested as
    A named objective in the October 2026 outline.
    Trap
    Treating Copilot as a separate data store with its own permissions.

  • Data Security Posture Management for AI

    Purview capability that shows AI usage, oversharing risks and recommended policies.

    Remember
    Helps prepare data before and during Copilot rollout.
    Tested as
    Supports AI-related data security evaluation.
    Trap
    Assuming it blocks prompts by itself without policies.

  • Defender for Cloud Apps

    Cloud access security broker for SaaS discovery, app governance and session control.

    Remember
    Works with Conditional Access App Control for in-session policies.
    Tested as
    Shadow IT and OAuth app risk questions.
    Trap
    Confusing it with Defender for Cloud.

  • Defender for Office 365

    Protection for email and collaboration against phishing and malware.

    Remember
    Safe Links and Safe Attachments are core features.
    Tested as
    Evaluated within Microsoft 365 security.
    Trap
    Expecting it to protect non-Microsoft SaaS apps.

  • Threat modeling

    Structured identification of threats to an application design, often using STRIDE.

    Remember
    Done early, before controls are chosen.
    Tested as
    Business-critical application questions.
    Trap
    Running it only after deployment.

  • Managed identities

    Microsoft Entra identities for Azure resources with no stored credentials.

    Remember
    System-assigned follows the resource lifecycle; user-assigned can be shared.
    Tested as
    The usual answer for removing secrets from apps.
    Trap
    Storing a managed identity token in configuration.

  • Workload identity federation

    Lets external workloads such as GitHub Actions or Kubernetes exchange tokens with Entra ID.

    Remember
    Removes long-lived secrets for pipelines and external services.
    Tested as
    Workload identity designs.
    Trap
    Creating client secrets for CI/CD pipelines.

  • Azure API Management

    Gateway that secures, throttles and publishes APIs.

    Remember
    Validates tokens and applies policies centrally.
    Tested as
    API management and security objective.
    Trap
    Exposing back-end APIs directly to clients.

  • Azure Web Application Firewall

    Layer 7 protection on Application Gateway or Azure Front Door.

    Remember
    Managed rule sets block common web attacks such as SQL injection.
    Tested as
    Web application protection designs.
    Trap
    Mixing it up with the Well-Architected Framework.

  • Customer-managed keys

    Encryption keys stored in Key Vault or Managed HSM and controlled by the customer.

    Remember
    Allow rotation and revocation under customer control.
    Tested as
    Encryption evaluation questions.
    Trap
    Recommending them without a stated control requirement.

  • Infrastructure encryption

    A second encryption layer at the infrastructure level for services such as Storage.

    Remember
    Provides double encryption at rest.
    Tested as
    Named in the encryption objective.
    Trap
    Thinking it replaces service-level encryption.

  • Defender for Storage

    Threat detection and malware scanning for Azure Storage.

    Remember
    Detects anomalous access and malicious uploads.
    Tested as
    Storage security design questions.
    Trap
    Expecting it to classify sensitive data.

  • Defender for Databases

    Threat protection for Azure SQL, open-source databases and Cosmos DB.

    Remember
    Detects SQL injection, brute force and anomalous queries.
    Tested as
    Data service protection questions.
    Trap
    Assuming it encrypts data.

  • AI workload data security

    Protection of training data, grounding sources and outputs in AI solutions.

    Remember
    Classify, restrict access and keep traffic private.
    Tested as
    New AI data objective in this domain.
    Trap
    Securing the model endpoint but leaving the source data open.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Microsoft 365 protection products

ConceptMeaningKey differenceCommon trap
Defender for Office 365 Email and collaboration threat protection. Stops phishing and malicious content. Expecting data loss prevention from it.
Defender for Cloud Apps CASB for SaaS discovery and control. Governs apps and sessions beyond Microsoft 365. Treating it as an email filter.
Microsoft Purview Classification, labeling, DLP and compliance for data. Protects the content itself wherever it moves. Using it to block phishing.
Microsoft Intune Device and app management with compliance policies. Supplies device compliance to Conditional Access. Expecting it to label documents.

Application credential options

ConceptMeaningKey differenceCommon trap
Client secret Password-like credential for an app registration. Must be stored and rotated. Leaving secrets in code or pipelines.
Managed identity Azure-managed identity for Azure resources. No credential to store or rotate. Using it for workloads outside Azure.
Workload identity federation Token exchange trust with external identity providers. Suits GitHub Actions, Kubernetes and other clouds. Assuming it needs a stored certificate.

Encryption key models

ConceptMeaningKey differenceCommon trap
Microsoft-managed keys Default platform encryption at rest. No customer key management required. Believing data is unencrypted without CMK.
Customer-managed keys Keys in Key Vault or Managed HSM controlled by the customer. Supports revocation and custom rotation. Forgetting the service needs access to the vault.
Infrastructure encryption Additional encryption layer below the service. Double encryption for high-assurance needs. Assuming it can be added to existing accounts later.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Blocking Copilot to stop oversharing

    What candidates pick
    Disable Microsoft 365 Copilot until further notice
    Why it looks right
    It removes the visible new risk.
    Why it's wrong
    The overshared files remain reachable through search and direct access; labels, DLP and permission cleanup fix the cause.

    Clue to watch for Scenarios about Copilot surfacing sensitive files.

  2. WAF instead of secure code

    What candidates pick
    Place Azure WAF in front of the app
    Why it looks right
    WAF blocks common attacks immediately.
    Why it's wrong
    A WAF filters known patterns; flaws found in threat modeling still need design and code changes.

    Clue to watch for Requirements about the development lifecycle or design flaws.

  3. Secrets in Key Vault as the end goal

    What candidates pick
    Move the connection string into Key Vault
    Why it looks right
    Key Vault is the secure secrets store.
    Why it's wrong
    If a managed identity can authenticate directly, removing the secret entirely is stronger than storing it safely.

    Clue to watch for Phrases like eliminate credentials or no secrets to manage.

  4. CMK for every store

    What candidates pick
    Enable customer-managed keys on all data services
    Why it looks right
    More control sounds more secure.
    Why it's wrong
    Data is already encrypted with platform keys; CMK adds operational burden and fits only when key control is required.

    Clue to watch for Look for explicit key revocation or regulatory key control needs.

  5. Defender for Cloud Apps vs Defender for Cloud

    What candidates pick
    Defender for Cloud for SaaS shadow IT
    Why it looks right
    The names are nearly identical.
    Why it's wrong
    Shadow IT discovery and SaaS session control belong to Defender for Cloud Apps, not the Azure posture service.

    Clue to watch for Mentions of unsanctioned SaaS or OAuth apps.

  6. Classification as protection

    What candidates pick
    Run Purview discovery and stop there
    Why it looks right
    Knowing where data lives feels like progress.
    Why it's wrong
    Discovery alone does not restrict access; labels, DLP and access controls must follow.

    Clue to watch for Requirements to prevent sharing or exfiltration.

Answer framework

Use this order when a Domain 4 scenario asks how to protect an application, data store or Microsoft 365 workload.

  1. Identify the asset: Microsoft 365 content, a custom application, an API, an Azure data store or AI training and grounding data.
  2. Name the threat precisely, such as oversharing, phishing, injection, credential theft, malware upload or unauthorized key use.
  3. For applications, prefer fixing design and identity first: threat modeling, secure development standards and managed or federated identities.
  4. For data, discover and classify, then apply labels, DLP, private access and the encryption key model the requirements justify.
  5. Add detection with the matching Defender plan, such as Defender for Storage or Defender for Databases, and confirm the design does not create unnecessary operational burden for the owning team.

Practice question

A development team's GitHub Actions workflows deploy to Azure using a client secret stored as a repository secret. Auditors require that no long-lived credentials exist for deployment pipelines. Which design should the architect recommend?

Want more like this? The SC-100 practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Split this domain into its three groups and give each about a third of your time. For Microsoft 365, write a short matrix of Defender for Office 365, Defender for Cloud Apps, Intune and Purview against the threats each addresses. Then study Microsoft's guidance on preparing data for Microsoft 365 Copilot, focusing on labels, DLP, oversharing reports and audit of prompts and responses.

For applications, practise a STRIDE threat model on a simple web app and API, then decide which control belongs at design, build, deploy and run stages. Learn the difference between managed identities and workload identity federation well enough to choose quickly, and review how API Management and Azure WAF fit in front of an application.

For data, compare encryption key models and list which Defender plan protects each data service. Add AI data by reviewing how grounding sources and training sets should be classified and isolated. Budget about 12 to 16 hours and finish with integrated case studies, because Domain 4 scenarios often depend on identity and posture choices made earlier.

FAQ

How much of SC-100 is Domain 4, Design security solutions for applications and data?

Microsoft weights this domain at 20–25%. It has three functional groups covering Microsoft 365, applications and data, with AI-related objectives in two of them.

What does SC-100 expect me to know about Microsoft 365 Copilot?

You should evaluate the data security and compliance controls that govern Copilot, such as sensitivity labels, DLP, audit, retention and oversharing assessments in Microsoft Purview.

Is coding knowledge required for the application security group?

No coding is tested. You need to design processes and controls such as threat modeling, pipeline security, workload identities, API Management and WAF.

When should I recommend customer-managed keys?

When requirements call for customer control over key rotation, revocation or location. Otherwise, default Microsoft-managed encryption already protects data at rest.

What is the difference between Defender for Storage and Purview for storage data?

Defender for Storage detects threats and malware. Purview discovers and classifies sensitive content and applies governance. Designs often use both.

How does Domain 4 cover AI?

Through Copilot data controls in the Microsoft 365 group and through designing security for data used in AI workloads in the data group.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

See whether you can protect Microsoft 365, applications and data stores with the right controls, including the AI and Copilot objectives.

Take the SC-100 practice test Check your SC-100 readiness

Keep going