Secure Compute · Topic 2 of 3
Security for Servers and Virtual Machines
SC-500 server security: disk encryption, Bastion, just-in-time access, Azure Arc, Defender for Servers, Trusted Launch and Machine Configuration.
- 4 min
- Managed disks are encrypted at rest by default; encryption at host covers temp disks and caches; Azure Disk Encryption retires in 2028.
- Bastion removes public IPs and open management ports; JIT opens ports only on request.
- Azure Arc brings hybrid and multicloud servers under Azure Policy and Defender.
What it is
Virtual machines and servers remain common targets. SC-500 covers encrypting their disks, removing exposed management ports with Azure Bastion and just-in-time (JIT) VM access, extending controls to hybrid and multicloud servers with Azure Arc, protecting them with Defender for Servers, hardening VM security features, and enforcing configuration with Azure Machine Configuration.
How it works
Disk encryption
| Option | What it does |
|---|---|
| Server-side encryption (SSE) | Managed disks are always encrypted at rest, with platform-managed or customer-managed keys (disk encryption set); temp disks and caches are not covered |
| Encryption at host | Also encrypts temp disks (platform-managed keys only) and disk caches, and data flows encrypted to storage |
| Confidential disk encryption | For confidential VMs, binds disk encryption keys to the VM's TPM |
| Azure Disk Encryption | Encrypts OS and data disks inside the guest with BitLocker or DM-Crypt, keys in Key Vault; retires on 15 September 2028, so use encryption at host for new VMs and migrate ADE VMs |
Removing exposed management ports
- Azure Bastion lets admins connect with RDP or SSH through the Azure portal or native client, so VMs need no public IP and no open management ports. Except for the Developer offering, it needs a dedicated subnet named AzureBastionSubnet (/26 or larger); custom ports and shareable links need Standard or higher, and session recording needs Premium.
- JIT VM access (Defender for Servers Plan 2, Azure and AWS) keeps management ports closed with deny rules in NSGs or Azure Firewall and opens them only for a user with RBAC permission on the VM, from a set source IP, for a limited time. Defender for Cloud lists VMs that should use JIT in a recommendation.
Hybrid and multicloud servers
- Azure Arc connects on-premises and other-cloud servers to Azure so you can apply Azure Policy, Machine Configuration and Defender for Cloud to them.
- Onboard those servers to Defender for Servers, through Arc or the multicloud connectors for AWS and GCP.
Defender for Servers
| Capability | Notes |
|---|---|
| Plans | Plan 1: Defender for Endpoint EDR and agent-based vulnerability scanning. Plan 2 adds agentless scanning, JIT, file integrity monitoring, Defender Vulnerability Management premium features and 500 MB free data ingestion. Plan 2 can't be enabled per resource |
| Endpoint detection and response (EDR) | Integration with Microsoft Defender for Endpoint |
| Vulnerability assessment | Microsoft Defender Vulnerability Management finds software vulnerabilities; enabled by default on machines with the Defender for Endpoint extension |
| Agentless scanning | Scans disk snapshots for vulnerabilities, secrets and malware without installing an agent; on by default with Plan 2 (malware scanning needs Plan 2) |
VM security features
| Feature | Purpose |
|---|---|
| Trusted Launch | A VM security type with secure boot, virtual TPM (vTPM) and integrity monitoring |
| Confidential VMs | Protect data in use with hardware-based isolation |
| Security type | Chosen at VM creation: Standard, Trusted Launch or Confidential |
Azure Machine Configuration
Azure Machine Configuration (formerly guest configuration) audits and enforces settings inside the operating system, such as password policies or installed software, through Azure Policy. It works for Azure VMs and Arc-enabled servers.
A worked example: an auditor finds RDP open to the internet on several VMs. The team removes public IPs, deploys Azure Bastion for admin access, enables JIT through Defender for Servers Plan 2, and assigns a Machine Configuration policy that audits the Windows password settings on every server, including Arc-enabled ones on premises.
"No public IP, but admins still need RDP" points to Azure Bastion. "Open the management port only when needed" points to JIT VM access.
How the exam asks about this
- "Apply Defender for Cloud to on-premises servers." Connect them with Azure Arc and enable Defender for Servers.
- "Encrypt temp disks and caches too." Encryption at host.
- "Find vulnerabilities without installing an agent." Agentless scanning in Defender for Servers.
What to remember for the exam
- Managed disks are encrypted at rest by default; encryption at host covers temp disks and caches; Azure Disk Encryption retires in 2028.
- Bastion removes public IPs and open management ports; JIT opens ports only on request.
- Azure Arc brings hybrid and multicloud servers under Azure Policy and Defender.
- Defender for Servers: Plan 1 and Plan 2, EDR, vulnerability management, agentless scanning.
- Trusted Launch: secure boot, vTPM, integrity monitoring. Machine Configuration enforces OS settings.
Closing a port in an NSG while a public IP stays on the VM still leaves other exposed services. Remove public IPs where Bastion covers admin access.
Common mistakes
Leaving RDP open "just for admins". Use Bastion or JIT.
Assuming Defender protects on-premises servers automatically. Connect them with Arc first.
Confusing Machine Configuration with Azure Policy alone. Machine Configuration checks settings inside the OS.
Check yourself
What does just-in-time VM access do?
It keeps management ports closed and opens them only for approved users, source IPs and a limited time.
How do on-premises servers get Defender for Cloud protection?
Connect them to Azure with Azure Arc and enable Defender for Servers.
Which VM security type provides secure boot and a virtual TPM?
Trusted Launch.
Topic 2 of 3 in Secure Compute
Test yourself on Secure Compute
The full Microsoft SC-500 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.