All Learning Pathways
COURSE 03 · 10 WEEKS · 80 GUIDED HOURS

Azure Cloud Security Engineer

Identity, network, workload, posture management, monitoring and infrastructure-as-code security

Duration: 10 weeks
Guided Learning: 80 guided hours
Level: Beginner to Intermediate
Suggested Capstone: 40% of Assessment
Explore Course (10 Weeks) Compare All 4 Courses
Programme Architecture

Course Overview & Target Audience

Grounded entirely in our official academic course specifications.

What You Will Learn

This course introduces practical security engineering for Microsoft Azure environments. Learners examine identity and access controls, network boundaries, workloads, storage and secrets, cloud security posture management, security monitoring, infrastructure-as-code, and cloud incident response. The course emphasizes secure configuration, evidence-based assessment and documented remediation.

Summary: Build practical Azure security skills across identity, access control, network security, secrets, posture management, monitoring and infrastructure-as-code. Finish with a documented cloud security assessment and remediation plan.

Who Should Attend & Prerequisites

Target Audience:

Undergraduate students with foundational IT knowledge, freshers, cloud or IT administrators, SOC analysts, and professionals transitioning into cloud security.

Prerequisites:

Basic networking and operating-system knowledge is recommended. Prior Azure experience is not essential. Some exercises may require an Azure subscription, suitable permissions or a prepared sample dataset.

Practical Competencies

Documented Learning Outcomes

Verifiable capabilities developed through guided exercises, technical investigations, and structured reporting.

Explain Azure foundational concepts, subscriptions, resource groups and shared responsibility.
Assess Microsoft Entra ID identity configurations and least-privilege access.
Explain and evaluate Azure RBAC, Privileged Identity Management and Conditional Access concepts.
Review common network exposure and segmentation controls, including NSGs and private connectivity.
Identify security considerations for storage, compute and Key Vault.
Interpret Microsoft Defender for Cloud findings and prioritize posture improvements.
Use Azure Monitor, Log Analytics and introductory KQL to investigate events.
Review infrastructure-as-code for common security misconfigurations and propose improvements.
Create a documented cloud security assessment and incident-response recommendation.
Week-by-Week Syllabus

Complete Course Breakdown

Each week is planned for approximately 8 guided hours, combining concept instruction, demonstration, guided practice, and review.

Week 1 Cloud Computing and Azure Fundamentals
  • Cloud service models: IaaS, PaaS and SaaS
  • Azure regions, availability concepts, subscriptions and resource groups
  • Azure Resource Manager and the resource hierarchy
  • Shared responsibility and cloud security design principles
  • Azure Portal, Azure CLI and basic resource inventory
  • Cost awareness, access boundaries and safe lab practices
Hands-on Practice: Explore a prepared Azure environment or walkthrough dataset, map its resource hierarchy and identify the security ownership boundary for selected services.
Expected Deliverable: Azure resource map and shared-responsibility worksheet.
Week 2 Microsoft Entra ID and Identity Security
  • Tenants, users, groups, service principals and app registrations
  • Authentication versus authorization
  • Multifactor authentication and identity protection concepts
  • Application permissions, delegated permissions and consent
  • Service identities and workload identity fundamentals
  • Common identity misconfigurations and investigation evidence
Hands-on Practice: Review a sample tenant configuration or simulated identity dataset and identify unnecessary permissions, risky account settings and remediation options.
Expected Deliverable: Identity security review with prioritized findings.
Week 3 Azure RBAC, PIM and Conditional Access
  • Azure role-based access control: scopes, role definitions and assignments
  • Built-in versus custom roles and least privilege
  • Subscription, resource group and resource scope
  • Privileged Identity Management: eligible access, activation and review concepts
  • Conditional Access policies, signals and access decisions
  • Auditing privileged activity and validating intended access
Hands-on Practice: Assess example role assignments and PIM/Conditional Access scenarios; propose least-privilege changes and identify likely operational impact.
Expected Deliverable: Access-control matrix and remediation plan.
Week 4 Azure Network Security
  • Virtual networks, subnets, routes and network segmentation
  • Network Security Groups and rule evaluation
  • Azure Firewall, application gateways and WAF concepts
  • Private Link/private endpoints and public exposure review
  • VPN and network connectivity fundamentals
  • Network flow, DNS and diagnostic evidence
Hands-on Practice: Review a sample architecture and rule set, trace permitted paths and identify excessive exposure or missing segmentation.
Expected Deliverable: Network security diagram with prioritized configuration recommendations.
Week 5 Compute, Storage and Secrets Security
  • Security boundaries for virtual machines, containers and platform services
  • Storage account access, network restrictions and data protection
  • Encryption at rest and in transit concepts
  • Azure Key Vault: secrets, keys, certificates and access models
  • Secret handling in applications and pipelines
  • Backup, recovery, logging and data-exposure risks
Hands-on Practice: Review sample storage, VM and Key Vault configurations and identify exposure, weak access patterns or secret-handling risks.
Expected Deliverable: Workload and secrets security checklist with findings and mitigations.
Week 6 Defender for Cloud and Cloud Security Posture Management
  • Cloud Security Posture Management (CSPM) concepts
  • Secure score, recommendations, attack paths and regulatory controls
  • Vulnerability assessment findings and asset context
  • Prioritization by exposure, exploitability and business impact
  • Triage workflow, suppression considerations and exception documentation
  • Verifying remediation and recording residual risk
Hands-on Practice: Triage a prepared set of Defender for Cloud findings, group related issues, prioritize remediation and document justified exceptions.
Expected Deliverable: CSPM triage register with owners, priority, actions and verification evidence.
Week 7 Azure Security Monitoring with Microsoft Sentinel
  • Azure Monitor, diagnostic settings, Log Analytics and data collection
  • Microsoft Sentinel architecture and data connectors
  • Kusto Query Language (KQL) fundamentals
  • Authentication, network and resource activity investigations
  • Analytics rules, incidents, workbooks and automation concepts
  • Logging gaps, retention and query limitations
Hands-on Practice: Use prepared Log Analytics tables or a lab workspace to investigate a suspicious sequence of identity or resource events using basic KQL.
Expected Deliverable: KQL query notebook and a short cloud investigation report.
Week 8 Azure DevSecOps and Infrastructure-as-Code Security
  • Infrastructure as Code concepts using Terraform/OpenTofu
  • Reviewing plans, variables, state and deployment permissions
  • Common cloud misconfigurations in code
  • Policy-as-code and scanning concepts using relevant tools
  • Secrets management and CI/CD permissions
  • Reviewing changes, evidence, exceptions and remediation before deployment
Hands-on Practice: Scan and review a sample Terraform/OpenTofu configuration, identify insecure defaults and prepare a corrected version with documented reasoning.
Expected Deliverable: IaC security review with findings, fixes and validation notes.
Week 9 Cloud Threat Detection and Incident Response
  • Common cloud attack paths and identity-driven risk
  • Cloud incident triage, scoping and evidence preservation
  • Correlating identity, control-plane, workload and network signals
  • Containment trade-offs and business continuity considerations
  • Remediation, recovery and access review
  • Lessons learned, control improvements and incident communications
Hands-on Practice: Investigate a simulated suspicious cloud activity case, correlate available logs, state knowns and unknowns, and recommend containment and recovery actions.
Expected Deliverable: Cloud incident timeline, incident notes and response recommendations.
Week 10 Azure Cloud Security Capstone
  • Assessing identity, network, storage, secrets and workload configuration
  • Reviewing posture findings and prioritizing remediation
  • Investigating supplied activity logs and documenting evidence
  • Proposing secure architecture and operational controls
  • Validating fixes and recording residual risk
  • Presenting technical findings to a stakeholder
Hands-on Practice: Secure and assess a sample cloud-hosted enterprise application using a supplied configuration, architecture and log dataset or controlled Azure lab.
Expected Deliverable: Cloud security assessment, architecture diagram, findings register, log investigation summary and remediation roadmap.
Tooling & Infrastructure

Tools, Software & Lab Environments

Transparent breakdown of course tools, target scenarios, and environment boundaries.

Course Tools & Software

Documented software and utilities utilized across weekly exercises:

Microsoft Azure PortalMicrosoft Entra IDAzure RBAC, PIM and Conditional AccessNSGs, Azure Firewall, Private Link and application gateway/WAF conceptsAzure Key VaultMicrosoft Defender for CloudMicrosoft SentinelAzure Monitor and Log AnalyticsKQLAzure CLI and PowerShellTerraform/OpenTofuCheckov or Trivy where applicable

Target Environments

Microsoft Azure Portal, learner cloud subscriptions, prepared sample telemetry datasets, and Terraform/OpenTofu Infrastructure-as-Code test templates.

All offensive testing and evidence parsing are strictly confined to authorized training systems.

Environment Boundaries

The academy utilizes open-source and free community tools. We do not provide commercial software licenses (such as Burp Suite Professional) or live enterprise systems.

Cloud security exercises run in learner-provisioned subscriptions or prepared telemetry datasets.

Evaluation Framework

Suggested Assessment Structure

Assessment components documented in the official course syllabus.

10%
Knowledge checks and quizzes

Part of the suggested assessment structure in the official syllabus.

30%
Guided practical labs

Part of the suggested assessment structure in the official syllabus.

20%
Security reviews and investigation assignments

Part of the suggested assessment structure in the official syllabus.

40%
Final cloud security capstone

Part of the suggested assessment structure in the official syllabus.

Proposed Passing Threshold (Awaiting Final Client Confirmation)

The course specifications suggest a 70% overall minimum score, including satisfactory completion and submission of the final capstone project. Note: This passing threshold is a proposal and requires final client confirmation before formal cohort enrolment begins.

Course Questions

Frequently Asked Questions

Grounded in documented course specifications and operational policies.

Does the academy provide dedicated enterprise Azure subscriptions for learners?
No. Learners utilize their own free or low-cost Azure trial subscriptions, or work with prepared sample telemetry datasets provided for analysis. Exercises are designed to minimize cloud resource consumption.
Which Microsoft security tools are covered in this course?
The course covers Microsoft Entra ID (MFA, Conditional Access, PIM), Azure RBAC, Network Security Groups, Azure Firewall concepts, Azure Key Vault, Microsoft Defender for Cloud, and Microsoft Sentinel with Kusto Query Language (KQL).
Is prior cloud engineering experience required?
Foundational knowledge of networking and operating systems is recommended. Prior Azure experience is helpful but not essential, as Week 1 covers Azure architecture, resource groups, and the shared responsibility model from the ground up.
How is learner progress assessed?
Assessment is distributed across knowledge checks (10%), guided practical labs (30%), security reviews (20%), and a final cloud security assessment capstone (40%). The proposed minimum score of 70% is awaiting formal client confirmation.
Have questions about enrolment schedules or payment arrangements? Specific cohort dates and digital payment methods are currently unconfirmed.
Next Steps

Ready to Explore Further Pathways?

Compare our practice-led training courses across SOC Analysis, Ethical Hacking, Azure Cloud Security, and Digital Forensics, or review our hands-on laboratory environments.

View All 4 Courses Explore Practical Labs
Explore Other Tracks

Related Cybersecurity Pathways