Design security solutions for infrastructure · Topic 5 of 6
Securing Containers and Azure AI Services
SC-100 containers and AI: image and registry security, AKS hardening, Defender for Containers, and Azure AI services with private access and Entra auth.
- 5 min
- Image to runtime: scan, sign, private ACR, hardened AKS, Defender for Containers.
- ACR: private endpoint, Entra auth, admin user off, AcrPull for the cluster identity.
- AKS: Entra RBAC, private cluster, Workload ID, network policies, Pod Security Standards, Key Vault CSI driver, KMS etcd encryption.
What it is
Containers package an application and its dependencies into an image. Orchestration (usually Kubernetes, in Azure AKS) runs many containers across many nodes. Security has to cover the image (what is in it), the registry (where it is stored), the cluster (how it is configured and who can use it) and the runtime (what the containers do). Azure AI services add another set of requirements: who can call the models, where the data goes and how misuse is detected.
How it works
Securing images and registries
| Requirement | Practice |
|---|---|
| Minimal, trusted base images | Use small images from trusted sources, pin versions, keep them updated |
| Scan for vulnerabilities | In the pipeline and in Azure Container Registry (ACR) with Defender for Containers, which scans on push, on pull and continuously, and shows results as recommendations |
| No secrets in images | Use Key Vault and managed identities at run time |
| Private registry | ACR with private endpoints, public access disabled, Entra ID authentication, and the admin user disabled |
| Least privilege pulls | Give the cluster a managed identity with the AcrPull role only |
| Integrity | Sign images and verify signatures before deployment, and deploy by digest |
| Allowed registries | Azure Policy to allow only approved registries |
Securing AKS and Kubernetes
| Area | Practice |
|---|---|
| Cluster access | Integrate with Microsoft Entra ID and use Azure RBAC for Kubernetes authorization. Disable local accounts. Use private clusters or authorized IP ranges for the API server |
| Identity for pods | Microsoft Entra Workload ID so pods get tokens for Azure resources with no secrets |
| Network | Network policies (Azure, Calico or Cilium) to control pod to pod traffic, private networking, an ingress controller with a WAF |
| Pod security | Enforce the Pod Security Standards with Pod Security Admission or Azure Policy for Kubernetes (Gatekeeper): no privileged containers, no host namespaces, read only filesystems, non root users |
| Secrets | Azure Key Vault Secrets Store CSI driver to mount secrets. Optionally encrypt secrets in etcd with a key from Key Vault (KMS encryption) |
| Nodes | Keep node images and Kubernetes versions updated, use automatic upgrades, minimal node OS, Trusted Launch where supported |
| Isolation | Separate namespaces and node pools for different trust levels, resource quotas |
| Auditing | Control plane logs to Log Analytics, Defender for Containers alerts |
Defender for Containers
| Capability | Meaning |
|---|---|
| Vulnerability assessment | Scans images in registries and running containers |
| Runtime threat detection | Detects suspicious activity in clusters and on nodes |
| Posture and hardening recommendations | Kubernetes configuration checks against best practices |
| Admission control | With Azure Policy, can block deployment of images or configurations that break rules |
| Multicloud | Covers AKS, Amazon EKS and Google GKE, and Arc enabled Kubernetes |
For the orchestration layer, specify: who may deploy (RBAC and pipeline identity), what may run (policy and signed images), how workloads talk (network policy), and how you detect abuse.
Azure AI services security
Azure AI services (including Azure OpenAI and Foundry model endpoints, Azure AI Search, Speech, Vision and Document Intelligence) are accessed through endpoints, so apply the usual PaaS requirements plus AI specific controls.
| Requirement | Practice |
|---|---|
| Network isolation | Private endpoints, disable public network access, restrict with firewall and virtual network rules |
| Authentication | Microsoft Entra ID with managed identities and Azure RBAC roles (for example a user role to call models) instead of API keys. Disable local authentication (keys) when possible |
| Data protection | Data encrypted at rest and in transit, customer managed keys where needed, data residency by region, and a clear policy on whether data is used for training (customer data is not used to train the underlying models in Azure OpenAI) |
| Content safety | Content filters and prompt shields from Azure AI Content Safety against harmful content and injection |
| Application permissions | Least privilege for tools and data an AI app can reach. For retrieval, apply document level security so users only retrieve what they may see |
| Governance | Azure Policy to require private access and disable keys, plus resource locks |
| Monitoring | Diagnostic logs, abuse monitoring, Defender for Cloud AI threat protection, alerts in Sentinel |
| Posture | Defender CSPM includes AI workload posture and attack paths |
A worked scenario
A team deploys a retrieval based assistant on AKS using Azure OpenAI and AI Search. The architect requires images built from a hardened base, scanned in the pipeline and in a private ACR, deployed by digest. The AKS cluster is private with Entra RBAC, Workload ID for pods, network policies, Pod Security Standards and the Key Vault CSI driver. Azure OpenAI and AI Search use private endpoints, managed identity and disabled keys, with content filters enabled and Defender for Containers and the AI threat protection plan on.
What to remember for the exam
- Image to runtime: scan, sign, private ACR, hardened AKS, Defender for Containers.
- ACR: private endpoint, Entra auth, admin user off, AcrPull for the cluster identity.
- AKS: Entra RBAC, private cluster, Workload ID, network policies, Pod Security Standards, Key Vault CSI driver, KMS etcd encryption.
- Defender for Containers covers AKS, EKS, GKE and Arc enabled Kubernetes.
- Azure AI services: private endpoints, Entra ID with managed identities, disabled keys, content safety, Defender threat protection.
"Pods need to read a Key Vault secret with no credentials in the cluster" is Workload ID with the Key Vault CSI driver.
How the exam asks about this
- "Prevent privileged containers from being deployed." Pod Security Standards enforced with Azure Policy for Kubernetes.
- "Let AKS pull from ACR with least privilege." Managed identity with AcrPull.
- "Scan images in the registry continuously." Defender for Containers.
- "Make Azure AI service reachable only from the virtual network and without API keys." Private endpoint, disabled public access, Entra authentication.
Common mistakes
Scanning only at build. New vulnerabilities appear after the image is stored.
Using the ACR admin account. It is a shared credential.
Public API server on AKS with no restrictions. Use a private cluster or authorized ranges.
Leaving AI service keys enabled. They are shared secrets that cannot be scoped.
Check yourself
Which role lets an AKS managed identity pull from ACR?
AcrPull.
Which control enforces Pod Security Standards using Azure Policy?
Azure Policy for Kubernetes.
Which setting removes shared API keys from an Azure AI service?
Disabling local authentication so only Microsoft Entra ID is accepted.
Topic 5 of 6 in Design security solutions for infrastructure
Test yourself on Design security solutions for infrastructure
The full Microsoft SC-100 question bank has 770 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.