Chapter 4 of 4 · Microsoft SC-100
Design security solutions for applications and data
Microsoft 365 and Copilot, application security, workload identities, WAF and data protection.
- 5topics
- 29 minfast track
- 2diagrams and exhibits
- 20–25%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Securing Microsoft 365 Workloads and CopilotSC-100 Microsoft 365: Secure Score, Defender for Office 365 and Cloud Apps, Intune, Purview, and data controls for Microsoft 365…6 min
- 2Application Security Lifecycle and Threat ModelingSC-100 applications: evaluating an application portfolio, STRIDE threat modeling, secure development lifecycle and mapping…5 min
- 3Workload Identities, API Management and WAFSC-100 app protection: managed identities, workload identity federation, Conditional Access for workloads, API Management…Diagram6 min
- 4Data Discovery, Classification and EncryptionSC-100 data protection: discovery and classification with Purview, prioritizing data threats, and encryption at rest and in…Diagram6 min
- 5Securing Data in Azure Workloads and AISC-100 data services: securing Azure SQL, Synapse, Cosmos DB and Storage, Defender for Storage and Databases, and protecting data…6 min
About this chapter
What this chapter covers
Applications and data are what attackers ultimately want. This domain is worth 20 to 25 percent of the exam. It covers securing Microsoft 365 (Secure Score, Defender for Office 365 and Cloud Apps, Intune, Purview and Copilot), securing applications across their life cycle (threat modeling, secure development, workload identities, API management and WAF), and securing an organization's data (discovery, classification, encryption, and protection of data in Azure storage, databases and AI workloads).
The key skill is applying the right control at the right layer: protect the identity of the app, the code and pipeline that builds it, the edge in front of it and the data behind it.
How the topics fit together
- Securing Microsoft 365 workloads and Copilot covers Secure Score, Defender products, Intune, Purview and Copilot data controls.
- Application security lifecycle and threat modeling covers portfolio evaluation, STRIDE and secure development.
- Workload identities, API Management and WAF covers app identities, API security and web protection.
- Data discovery, classification and encryption covers finding sensitive data and protecting it at rest and in transit.
- Securing data in Azure workloads and AI covers SQL, Synapse, Cosmos DB, Storage and data used in AI.
In data questions, first ask "is the data known and labeled?" Classification comes before protection, because controls follow the label.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with examples and tables.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.