Secure AI Solutions in the Cloud Using Defender for Cloud & Entra (SC-5009)

Learn how AI workloads are authenticated, how trust boundaries are established, and how Microsoft Defender for Cloud and Microsoft Foundry minimize risks by ensuring security posture and workload protection. Extend these protections by using Microsoft Entra to design and implement identity and access controls that support and reinforce previous security decisions.

1. Learn how Microsoft Defender for Cloud supports AI security and governance in Azure

Microsoft Defender for Cloud plays a central role in securing AI workloads in Azure. Learn how Microsoft Defender for Cloud supports AI security in Azure. Explore the layers of an AI workload, the specific risks associated with AI systems, and the safeguards that protect model inputs and outputs. See how Microsoft Purview, Microsoft Entra ID, and Microsoft Foundry work together to support a unified security and governance strategy.

2. Protect AI workloads with Microsoft Defender for Cloud

Microsoft Defender for Cloud helps secure AI workloads by combining detection, security posture management, and runtime protection on a single platform. You’ll learn how to enable the AI Workloads plan, review insights in the Data and AI Security dashboard, assess your security posture using Cloud Security Posture Management (CSPM), detect runtime threats with Cloud Workload Protection (CWP), and investigate incidents in Microsoft Defender XDR. These features work together to identify configuration gaps, detect suspicious behavior, and ensure end-to-end visibility across your AI environments.

3. Configuring and Managing Guardrails in Microsoft Foundry

Microsoft Foundry security boundaries help secure AI workloads by applying configurable security controls that evaluate both prompts and responses. You’ll learn how to understand built-in security models, test and refine security boundaries, create blocklists, configure content filters, and verify that the safeguards are working as intended. These features help organizations prevent unsafe or policy-violating interactions, protect sensitive data, and maintain trust in AI-powered applications.

4. Backing Up Microsoft Foundry Environments

Securing Microsoft Foundry environments requires multi-layered protective measures that control access, protect credentials, isolate network communication, and ensure visibility across all connected resources. The approach involves defining access boundaries using Microsoft Entra ID and project roles, as well as integrating Key Vault for managing sensitive data. Additionally, managed virtual networks, Private Link, and diagnostic logging are used to ensure data protection, transparency, and compliance. These practices create secure, traceable AI environments that support collaboration without compromising security.

5. Understanding Identity Architecture for AI Workloads

The identity architecture defines who is authorized to deploy, access, and manage AI workloads in Azure. Microsoft Entra ID governs access across administrative and data layers, authentication workflows establish trust boundaries for AI endpoints, and role scope decisions determine the scope of impact. Identity types, role assignments, and scope boundaries shape the outcomes of AI security long before enforcement controls are applied.

6. Implement access management for Azure resources

Learn how to use built-in Azure roles, managed identities, and RBAC policies to control access to Azure resources. Identity is the key to secure solutions.

7. Planning, Implementing, and Managing Conditional Access

Conditional Access provides highly granular control over which users and identities are permitted to perform specific activities and access certain resources, as well as how the security of data and systems is ensured—including AI agent identities managed through Microsoft Entra Agent ID.

8. Managing Microsoft Entra Identity Protection

Protecting the identity of users by monitoring its usage and login patterns ensures a secure cloud solution. Learn how to design and implement Microsoft Entra Identity Protection.