SC-500 Domains Explained With Weightings

The short version

SC-500 has four domains. Storage, databases, and networking carries the most weight at 25-30%, and the other three each carry 20-25%. This page follows the skills in Microsoft’s study guide (page last updated July 31, 2026, read October 18, 2026). The explanations of traps and practice are ours, not Microsoft’s, so use the study guide as the authority on scope.

Domain	Weighting
Manage identity, access, and governance	20-25%
Secure storage, databases, and networking	25-30%
Secure compute	20-25%
Manage and monitor security posture	20-25%

Manage identity, access, and governance (20-25%)

What it covers. Three groups of skills. First, securing access with Microsoft Entra ID: Privileged Identity Management, Conditional Access, authentication methods including multifactor and passwordless, enterprise applications and app registrations, OAuth consent and permission grants, and managed identities. Second, Azure Key Vault: deployment, settings, access, firewall, managing keys, secrets, and certificates, secrets scanning with Defender CSPM, and Defender for Key Vault. Third, governance: Azure Policy, regulatory compliance in Defender for Cloud, resource locks, built-in and custom roles, overprivileged access, Azure Backup security features, and infrastructure as code.

Typical traps.

Mixing up a role being eligible and being active in PIM.
Confusing application permissions (no signed-in user) with delegated permissions (acting for a user).
Treating a policy that audits as one that blocks. Effects such as audit and deny behave very differently.
Forgetting that a lock can stop legitimate changes too.

What to practice. Create a Conditional Access policy in report-only mode and read the results. Build a custom role. Create a key vault, change its permission model, and watch what breaks.

Secure storage, databases, and networking (25-30%)

What it covers. Storage account security, storage firewall rules, access control and policies, and Defender for Storage. Azure SQL platform security, auditing, and Defender for Databases. Networking: network security groups and application security groups, Azure Virtual Network Manager, Virtual WAN, VPN connections, Microsoft Entra Private Access, private endpoints, Private Link services, Azure Firewall, and Network Watcher diagnostics for effective security rules.

Typical traps.

Private endpoint versus Private Link service: one is how a consumer reaches a service privately, the other is how a provider exposes its own service.
Rule order. Virtual Network Manager security admin rules are evaluated before network security group rules, so the two layers do not behave the same way.
Assuming a firewall setting on a service also changes the other ways to reach it.
Mixing up which Azure Firewall rule type fits a requirement, such as filtering by domain name.

What to practice. Deploy a storage account with a firewall and a private endpoint, then test access from inside and outside the network. Use Network Watcher to see effective security rules for a network interface. Read the order in which Azure Firewall processes rules.

Secure compute (20-25%)

What it covers. Three groups. AI security: finding overexposed data in SharePoint, Purview Data Security Posture Management for AI risks, real-time protection for Copilot Studio agents, Conditional Access and access management for Microsoft Entra Agent ID, blast radius analysis in Defender XDR, AI Gateway in API Management for Foundry, Defender for AI services, Foundry guardrails, and the Data and AI security dashboard. Servers and virtual machines: disk encryption, Bastion, just-in-time access, Azure Arc, Defender for Servers (vulnerability scanning, endpoint detection, agentless scanning), VM security features such as secure boot and vTPM, and Azure Machine Configuration. Application platforms: Defender for Containers, AKS, Container Registry, Container Instances and Container Apps, Functions, Logic Apps, App Service, Web Application Firewall, and API Management policies.

Typical traps.

Choosing the wrong disk encryption method. Know what each option encrypts and where the work happens.
Confusing agentless scanning with the agent-based approach.
On the AI side, mixing up where a control lives: the identity layer, the gateway, the data layer, or the monitoring dashboard.
Treating every application service the same. Authentication and network access are configured differently for Functions, Logic Apps, and App Service.

What to practice. Enable a Defender plan on a test subscription and read the recommendations. Put an API behind API Management and apply a policy. For AI topics, read the documentation for each feature and write one line on what problem it solves and who configures it.

Manage and monitor security posture (20-25%)

What it covers. Defender for Cloud: Defender CSPM, compliance against frameworks, workload protection plans, connecting AWS and GCP, vulnerability management, and Defender External Attack Surface Management. Microsoft Sentinel: workspaces and roles, content hub, data connectors, syslog and Common Event Format collection, Windows security events with data collection rules, custom log tables, automation rules and playbooks, retention, and querying Purview Audit in Defender XDR. Microsoft Security Copilot: workspaces, permissions and roles, plugins, and agents.

Typical traps.

Mixing up an automation rule and a playbook.
Not knowing what a machine outside Azure needs before it can send data through the Azure Monitor Agent.
Mistaking a recommendation (a to-do) for a regulatory compliance result.
Assuming a plan is on because a related one is.

What to practice. Connect a data source to a Sentinel workspace, write one automation rule, and open a recommendation in Defender for Cloud. Read how Security Copilot permissions work.

Using this page

Rank each domain from 1 to 4 on your confidence, then give the weakest, heaviest domain the most time. The study plan shows how to schedule that.

More guides for SC-500

Next step

Try the sample questions to see how these topics appear in scenario form. For more practice by domain, see our SC-500 practice tests.

Try the SC-500 practice exams