Enforce security governance and regulatory compliance

  • Learning Path
  • 6 Modules

At a glance

Enforce security governance and regulatory compliance across Azure environments. Configure Azure Policy and resource locks to block noncompliant deployments. Then manage security standards and remediate recommendations in Defender for Cloud, evaluate regulatory compliance posture, govern RBAC role assignments at scale, protect backup data against ransomware and deletion, and embed security controls into Bicep pipelines before resources reach production.

Prerequisites

  • Working knowledge of Azure administration at the AZ-104 level, including resource management, role assignments, and virtual network concepts
  • Familiarity with Microsoft Defender for Cloud at a foundational level
  • Understanding of Azure role-based access control (RBAC) including role assignments and scope hierarchy
  • Basic experience navigating the Azure portal and Microsoft Entra admin center

Get started with Azure

Choose the Azure account that's right for you. Pay as you go or try Azure free for up to 30 days. Sign up.

Modules in this learning path

Enforce governance with Azure Policy and resource locks

Enforce security standards before resources reach production using Azure Policy. Assign built-in policy definitions and initiatives at management group scope, author custom definitions with automated remediation tasks, and protect critical resources from deletion using Azure resource locks.

Configure security controls and remediate recommendations in Defender for Cloud

Configure Defender for Cloud security standards at management group scope and systematically deploy security controls to remediate recommendations. Manage custom security standards, assign recommendation ownership using governance rules, and remediate at scale using Fix, Azure Policy remediation tasks, and structured exemptions.

Evaluate regulatory compliance in Defender for Cloud

In this module, you use Microsoft Defender for Cloud to assess your organization's compliance posture against security frameworks. You explore the regulatory compliance dashboard, investigate control gaps, assign regulatory standards, and generate audit-ready reports that communicate compliance status to stakeholders.

Manage and right-size RBAC role assignments for least privilege

Implement least-privilege access governance across Azure and Microsoft Entra ID. Assign built-in roles at appropriate scope, create custom roles for Azure resources and Microsoft Entra directory operations. Then identify and remediate overprivileged access using Microsoft Entra access reviews and Defender for Cloud Security Posture Management (CSPM) identity insights.

Protect backup data with Azure Backup security features

Protect Azure Backup data against ransomware, accidental deletion, and rogue administrators. Configure enhanced soft delete, vault immutability, Multi-User Authorization with Resource Guard, and RBAC controls to achieve an Excellent security posture rating across Recovery Services vaults.

Implement security controls in infrastructure as code

Embed security controls into infrastructure as code pipelines to prevent noncompliant Azure resources from reaching production. Integrate IaC security scanning using Microsoft Defender for DevOps and the Microsoft DevOps (MSDO) extension, and configure Azure Policy in a policy-as-code workflow to enforce security compliance at deployment time.

Start