Configure authentication, network isolation, encryption, and access controls for Azure SQL Database and SQL Managed Instance. Implement Microsoft Entra ID–only authentication with managed identity access for AI workloads, deploy private endpoints, and apply transparent data encryption, dynamic data masking, and row-level security to protect sensitive financial data.
After completing this module, you'll be able to:
- Configure Microsoft Entra ID authentication and disable SQL authentication on Azure SQL
- Implement network isolation for Azure SQL using private endpoints and firewall rules
- Enable transparent data encryption and configure customer-managed keys for regulated workloads
- Apply dynamic data masking and row-level security to restrict access to sensitive data
Configure audit logging for Azure SQL Database and SQL Managed Instance to create tamper-resistant compliance records. Set audit action groups, route logs to Azure Monitor, Event Hubs, and immutable blob storage, and configure SQL Managed Instance–specific auditing to meet financial regulatory audit requirements.
After completing this module, you'll be able to:
- Describe Azure SQL auditing capabilities and select appropriate audit action groups
- Configure audit log destinations for Azure SQL Database
- Configure auditing for SQL Managed Instance
- Design a compliant audit strategy using multiple log destinations
Enable Microsoft Defender for Databases to detect SQL injection, anomalous query patterns, and vulnerability exposures across Azure SQL services. Enable protection at subscription scope using Azure Policy, configure vulnerability assessment baselines, and route security alerts to the security operations team.
After completing this module, you'll be able to:
- Describe Microsoft Defender for Databases plans and threat detection capabilities
- Enable Defender for Azure SQL Databases at subscription scope
- Enable Defender for open-source relational databases
- Configure vulnerability assessment to establish security baselines for Azure SQL
- Configure alert routing to deliver Defender detections to the security operations team

Syllabus

Configure platform-level security for Azure SQL
- Introduction
- Configure authentication and managed identity access
- Implement network isolation
- Encrypt and protect data in transit and at rest
- Apply data masking and row-level security
- Knowledge check
- Summary
Configure auditing for Azure SQL Database and SQL Managed Instance
- Introduction
- Describe Azure SQL auditing capabilities
- Configure audit destinations for Azure SQL Database
- Configure auditing for SQL Managed Instance
- Design a compliant audit strategy
- Knowledge check
- Summary
Implement Microsoft Defender for Databases
- Introduction
- Explore Microsoft Defender for Databases capabilities
- Enable Defender for Azure SQL Databases at subscription scope
- Enable Defender for open-source relational databases
- Configure vulnerability assessment
- Configure alert routing and validate coverage
- Knowledge check
- Summary