Design security solutions for applications and data · Topic 5 of 5
Securing Data in Azure Workloads and AI
SC-100 data services: securing Azure SQL, Synapse, Cosmos DB and Storage, Defender for Storage and Databases, and protecting data used in AI workloads.
- 6 min
- SQL: private endpoints, Entra only auth, TDE, Always Encrypted, row level security, masking, auditing, Defender for SQL, ledger.
- Synapse: managed virtual network, managed private endpoints, data exfiltration protection, Synapse RBAC, RLS, column level security.
- Cosmos DB: Entra data plane RBAC with keys disabled, private endpoints, customer managed keys, Defender for Cosmos DB.
What it is
Azure data services each have their own security features, but the pattern is consistent: control who can reach it (network and identity), control what they can see (authorization and data masking), protect the data itself (encryption), audit access and detect threats. This topic applies that pattern to Azure SQL, Azure Synapse Analytics, Azure Cosmos DB and Azure Storage, then to data used in AI workloads, where permissions and labels decide what a model can reveal.
How it works
Azure SQL (Database and Managed Instance)
| Layer | Controls |
|---|---|
| Network | Private endpoints, firewall rules, disable public network access, avoid the broad "allow Azure services" setting, virtual network rules |
| Authentication | Microsoft Entra authentication (including Entra only mode), managed identities for apps, no shared SQL logins |
| Authorization | Least privilege roles, row level security, dynamic data masking, column permissions |
| Encryption | TDE (default), customer managed key option, Always Encrypted for sensitive columns, TLS in transit |
| Auditing | SQL auditing to Log Analytics, storage or Event Hubs |
| Threat protection | Microsoft Defender for SQL (part of Defender for Databases): vulnerability assessment and advanced threat protection alerts such as SQL injection and unusual access |
| Integrity | Ledger tables give cryptographic tamper evidence |
| Classification | Data discovery and classification of sensitive columns |
Azure Synapse Analytics
| Control | Notes |
|---|---|
| Managed virtual network and managed private endpoints | Isolate the workspace and its connections to data sources |
| Data exfiltration protection | Restrict outbound connections from the managed network to approved Microsoft Entra tenants and targets |
| Authentication | Microsoft Entra ID, with Entra only authentication, and managed identities |
| Authorization | Synapse RBAC for workspace objects, plus data level controls: row level security, column level security and dynamic data masking in dedicated SQL pools |
| Encryption | Service managed or customer managed keys, with double encryption for the workspace |
| Auditing and threat detection | SQL auditing and Defender for SQL on SQL pools |
| Network | Firewall rules, private endpoints, disable public access |
Azure Cosmos DB
| Control | Notes |
|---|---|
| Network | Private endpoints, virtual network and firewall rules, disable public access |
| Authentication and authorization | Microsoft Entra ID with data plane role based access control for the NoSQL API, with account keys disabled (disable local authentication) |
| Encryption | Encrypted at rest by default, optional customer managed keys, and client side Always Encrypted for selected properties |
| Backup | Continuous backup with point in time restore |
| Threat protection | Defender for Azure Cosmos DB detects SQL injection attempts, unusual access and exfiltration patterns |
Azure Storage
| Control | Notes |
|---|---|
| Network | Private endpoints, firewall, disable public network access, disable anonymous (public) blob access |
| Authentication | Microsoft Entra ID with RBAC data roles. Disable shared key access where possible. If SAS is needed, use user delegation SAS signed with Entra credentials, with short lifetimes and stored access policies |
| Encryption | Service side encryption, optional customer managed keys, infrastructure encryption, encryption scopes, minimum TLS and secure transfer required |
| Data protection | Soft delete, versioning, point in time restore, and immutable storage (WORM) against ransomware or deletion |
| Auditing | Storage logs to Log Analytics, Azure Monitor |
| Threat protection | Defender for Storage |
Defender for Storage and Defender for Databases
| Plan | Detects and provides |
|---|---|
| Defender for Storage | Threat detection from unusual access, suspicious uploads and exfiltration patterns. Malware scanning of blobs on upload (an add on, with optional automated response). Sensitive data threat detection, which highlights suspicious activity against blobs that hold sensitive data. It can be enabled per account or for the subscription |
| Defender for Databases | Covers Azure SQL Database and Managed Instance, SQL Server on machines (including Arc), open source relational databases (PostgreSQL, MySQL, MariaDB) and Cosmos DB, with vulnerability assessment (for SQL) and threat protection alerts |
Both send alerts to Defender for Cloud, Defender XDR and Sentinel.
Data used in AI workloads
AI applications use data in three ways: training or fine tuning a model, grounding a model with retrieval (RAG, using stores such as Azure AI Search), and prompts and outputs that contain data. The risk is that the AI reveals or learns data it should not.
| Risk | Control |
|---|---|
| Sensitive data in training or grounding data | Discover and classify with Purview and Defender CSPM before use, minimize, mask or remove sensitive fields, and keep data in approved regions |
| Users retrieving documents they should not see | Security trimming: enforce document level permissions in the search index, filter results by the caller's identity or group, and prefer on behalf of access so retrieval respects the user's rights |
| Overbroad data access by the application | Managed identity with least privilege roles on the stores, separate indexes for separate sensitivity levels |
| Leakage through prompts and responses | Sensitivity labels and DLP, content filtering, logging with care for privacy, and prompt shields |
| Data in transit and at rest | Private endpoints for AI services and data stores, customer managed keys where required |
| Poisoned data | Control who can write to training and grounding sources, validate and version datasets |
| Visibility | Purview DSPM for AI, audit logs, Defender for Cloud AI threat protection |
| Model theft or misuse | Disable key access, RBAC, rate limits, monitoring |
A good rule for AI: the AI should see only what the requesting user could see, so permissions and labels are the first control, not an afterthought.
A worked scenario
A bank builds a support assistant that answers using internal documents in a search index, with a customer data warehouse in Synapse. The architect requires private endpoints and Entra only authentication for Synapse and Azure SQL, row level security and dynamic data masking for support staff, managed private endpoints with data exfiltration protection, and customer managed keys. The search index uses security trimming, documents are classified and labeled first, and Defender for Databases, Defender for Storage and AI threat protection are on.
What to remember for the exam
- SQL: private endpoints, Entra only auth, TDE, Always Encrypted, row level security, masking, auditing, Defender for SQL, ledger.
- Synapse: managed virtual network, managed private endpoints, data exfiltration protection, Synapse RBAC, RLS, column level security.
- Cosmos DB: Entra data plane RBAC with keys disabled, private endpoints, customer managed keys, Defender for Cosmos DB.
- Storage: private endpoints, disable shared key and anonymous access, user delegation SAS, immutability, soft delete, Defender for Storage malware scanning.
- AI data: classify first, security trim retrieval, least privilege identities, labels and DLP, DSPM for AI.
"Stop data leaving a Synapse workspace to unapproved destinations" is data exfiltration protection with managed private endpoints.
How the exam asks about this
- "Scan uploaded blobs for malware." Defender for Storage malware scanning.
- "Prevent support staff from seeing full card numbers in a table." Dynamic data masking.
- "Ensure an AI assistant only retrieves documents the user is allowed to read." Security trimming in the search index.
- "Stop applications using account keys for Cosmos DB." Disable local authentication and use Entra RBAC.
Common mistakes
Allow Azure services as a shortcut. It opens the service to all Azure tenants' resources. Use private endpoints.
Shared access signatures with long lifetimes. Use user delegation SAS and short expiry.
Feeding AI unclassified data. The model can then expose it.
Defender plan not enabled for the data service. Posture without detection leaves blind spots.
Check yourself
Which Synapse feature limits outbound connections to approved targets?
Data exfiltration protection.
Which type of SAS is signed with Microsoft Entra credentials?
A user delegation SAS.
Which plan protects Azure SQL, open source relational databases and Cosmos DB?
Microsoft Defender for Databases.
Topic 5 of 5 in Design security solutions for applications and data
Test yourself on Design security solutions for applications and data
The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.