Secure Compute · Topic 3 of 3
Security for Application Platform Services
SC-500 app platform security: Defender for Containers, AKS and ACR controls, Container Apps, Functions, Logic Apps, App Service, WAF and API Management.
- 4 min
- Defender for Containers covers posture, image vulnerabilities and runtime threats.
- AKS: Entra integration, private cluster, network policies, workload identity. ACR: disable admin user, RBAC, private endpoints.
- App Service and Functions: built-in authentication, access restrictions, private endpoints, HTTPS and TLS, managed identities.
What it is
Application platform services run your code without you managing servers: containers on AKS, Azure Container Registry, Container Instances and Container Apps, Azure Functions, Logic Apps and App Service. SC-500 covers hardening each one, protecting web apps with a web application firewall (WAF), and protecting back-end APIs with API Management.
How it works
Containers
| Service | Key controls |
|---|---|
| Defender for Containers | Finds misconfigurations and image vulnerabilities, and detects runtime threats in clusters |
| AKS | Microsoft Entra integration with Kubernetes RBAC or Azure RBAC, private cluster or authorized IP ranges for the API server, network policies, workload identity, Azure Policy for Kubernetes |
| Azure Container Registry | Disable the admin user, use Entra identities and RBAC (AcrPull, AcrPush), private endpoints, and vulnerability scanning through Defender |
| Container Instances and Container Apps | Managed identities and deployment into a virtual network for both; for Container Apps, ingress IP restrictions and secrets that reference Key Vault |
Functions, Logic Apps and App Service
| Control | Applies to |
|---|---|
| Built-in authentication (Easy Auth) with Microsoft Entra ID | App Service and Functions |
| Access restrictions (IP and virtual network rules) | App Service, Functions |
| Private endpoints and virtual network integration | App Service, Functions, Logic Apps Standard |
| HTTPS only and minimum TLS version | App Service, Functions |
| Managed identities to reach other services | All three |
| Key Vault references for secrets in settings | App Service, Functions |
| Function and host keys | Functions with function-level authorization; treat keys as secrets |
| Secure inputs and outputs | Logic Apps, to hide sensitive data in run history |
| Restricting trigger access | Logic Apps, by caller IP or with OAuth |
Web application firewall
Azure Web Application Firewall runs on Azure Front Door or Application Gateway.
| Setting | Meaning |
|---|---|
| Detection mode | Logs matches but lets requests through |
| Prevention mode | Blocks requests that match rules |
| Managed rule sets | Protection against common attacks such as SQL injection and cross-site scripting |
| Custom rules | Rules for IP addresses, geography, rate limits or request patterns |
| Exclusions | Skip specific request parts to reduce false positives |
| Bot protection | Managed bot rules |
Start in Detection mode to tune false positives, then switch to Prevention.
API Management policies
Use API Management in front of back-end APIs and apply policies such as validate-jwt (check tokens), rate-limit and quota, ip-filter, and managed identity authentication to the back end. Back ends then accept traffic only from API Management, for example through a virtual network or access restrictions.
A worked example: a public web app behind Application Gateway sees SQL injection attempts in logs, but they still reach the app. The WAF policy is in Detection mode; switching it to Prevention mode blocks them.
"The WAF logs attacks but does not block them" means the policy is in Detection mode. Switch to Prevention.
How the exam asks about this
- "Detect runtime threats in AKS clusters." Defender for Containers.
- "Require Microsoft Entra sign-in for an App Service app without code changes." Built-in authentication.
- "Reject API calls without a valid token before they reach the back end." An API Management validate-jwt policy.
What to remember for the exam
- Defender for Containers covers posture, image vulnerabilities and runtime threats.
- AKS: Entra integration, private cluster, network policies, workload identity. ACR: disable admin user, RBAC, private endpoints.
- App Service and Functions: built-in authentication, access restrictions, private endpoints, HTTPS and TLS, managed identities.
- Logic Apps: managed identities, trigger restrictions, secure inputs and outputs.
- WAF on Front Door or Application Gateway: Detection versus Prevention mode, managed and custom rules.
- API Management policies protect back-end APIs.
The ACR admin user is a shared credential with full push and pull rights. Disable it and use Entra identities.
Common mistakes
Leaving WAF in Detection mode in production. Attacks are only logged.
Exposing Functions with only a function key. Add Entra authentication or API Management for sensitive APIs.
Logging secrets in Logic Apps run history. Turn on secure inputs and outputs.
Check yourself
What is the difference between WAF Detection and Prevention modes?
Detection logs matching requests and lets them through; Prevention blocks them.
Why disable the ACR admin user?
It is a shared credential with full rights; Entra identities with RBAC are safer and auditable.
Which API Management policy checks tokens before calls reach the back end?
validate-jwt.
Topic 3 of 3 in Secure Compute
Test yourself on Secure Compute
The full Microsoft SC-500 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.