Hands-on Lab — SC-900 Microsoft Security, Compliance, and Identity Fundamentals

Overview

Prerequisites

Steps

1. 1.Provider, Resource Group, and the azuread provider

   SC-900 requires interaction with Microsoft Entra ID — separate from Azure RBAC, separate Terraform provider. We pin both azurerm and azuread. The latter manages Entra users, groups, app registrations, and service principals; the former manages Azure subscriptions and resources.

   Copy

   terraform {
     required_version = ">= 1.5"
   
     required_providers {
       azurerm = { source = "hashicorp/azurerm", version = "~> 4.0" }
       azuread = { source = "hashicorp/azuread", version = "~> 3.0" }
     }
   }
   
   provider "azurerm" {
     features {
       key_vault {
         purge_soft_delete_on_destroy = true
       }
     }
   }
   
   provider "azuread" {}
   
   data "azurerm_client_config" "current" {}
   data "azuread_client_config" "current" {}
   
   locals {
     tags = {
       Project   = "certlabpro-sc-900"
       ManagedBy = "terraform"
     }
   }
   
   resource "azurerm_resource_group" "main" {
     name     = "certlabpro-sc-900-rg"
     location = "eastus"
     tags     = local.tags
   }

2. 2.Create a Microsoft Entra security group

   Provisions:

   • Microsoft Entra ID

   Microsoft Entra ID (formerly Azure AD) is the identity-and-access service every Microsoft cloud product hooks into. SC-900's first domain — Describe the concepts of security, compliance, and identity — leans on Entra ID as the identity foundation.

   A security group is the canonical container for granting RBAC roles to many users at once. The exam tests this group-based RBAC pattern as the right answer to scaling permissions across hundreds of users: assign roles to groups, not to individuals.

   The security_enabled = true and mail_enabled = false combo creates a security-only group (no shared mailbox). Adding the current user as owner means you can manage membership via the Entra portal after terraform apply.

   Copy

   resource "azuread_group" "security_admins" {
     display_name     = "certlabpro-sc-900-security-admins"
     description      = "Lab security admins group for the SC-900 walkthrough."
     security_enabled = true
     mail_enabled     = false
   
     owners = [
       data.azuread_client_config.current.object_id,
     ]
   }

3. 3.Provision a Key Vault and grant the Entra group RBAC access

   Provisions:

   • Azure Key Vault
   • Microsoft Entra ID

   SC-900 tests the separation of concerns pattern: secrets live in Key Vault; access is granted to Entra groups (not users); group membership is managed at the identity layer. We provision a Key Vault with RBAC authorization, then assign Key Vault Secrets Officer to the security group from Step 2.

   Anyone added to the security-admins group inherits the secrets-management permission automatically. Compare to the older access policy model where each user was named individually on the vault — the SC-900 Identify the basic identity services and identity types of Microsoft Entra ID domain calls this out as the RBAC-modern-better-than-policy contrast.

   Copy

   resource "azurerm_key_vault" "main" {
     name                       = "kv-sc900-${substr(replace(uuid(), "-", ""), 0, 6)}"
     resource_group_name        = azurerm_resource_group.main.name
     location                   = azurerm_resource_group.main.location
     tenant_id                  = data.azurerm_client_config.current.tenant_id
     sku_name                   = "standard"
     enable_rbac_authorization  = true
     soft_delete_retention_days = 7
   
     tags = local.tags
   
     lifecycle {
       ignore_changes = [name] # name uses uuid() — keep the original on subsequent applies
     }
   }
   
   resource "azurerm_role_assignment" "kv_admin_self" {
     scope                = azurerm_key_vault.main.id
     role_definition_name = "Key Vault Administrator"
     principal_id         = data.azurerm_client_config.current.object_id
   }
   
   resource "azurerm_role_assignment" "kv_secrets_group" {
     scope                = azurerm_key_vault.main.id
     role_definition_name = "Key Vault Secrets Officer"
     principal_id         = azuread_group.security_admins.object_id
   }

4. 4.Enable Defender for Cloud Foundational CSPM + Log Analytics

   Provisions:

   • Microsoft Defender for Cloud
   • Azure Monitor

   Defender for Cloud's Foundational CSPM tier is always free and includes the Microsoft Cloud Security Benchmark assessment — automated checks against the CIS / NIST controls Microsoft has ported into Azure. SC-900's Describe the capabilities of Microsoft security solutions domain points at this as the day-one posture-visibility primitive.

   We enable it at subscription scope and provision a Log Analytics workspace where any security alerts / recommendations land for KQL querying. With the four primitives in place (Entra group, Key Vault with RBAC, Defender CSPM, Log Analytics), the SC-900 foundational stack is complete — group-based identity → secrets management → posture monitoring → audit fabric.

   Copy

   resource "azurerm_log_analytics_workspace" "main" {
     name                = "log-sc900"
     resource_group_name = azurerm_resource_group.main.name
     location            = azurerm_resource_group.main.location
     sku                 = "PerGB2018"
     retention_in_days   = 30
   
     tags = local.tags
   }
   
   resource "azurerm_security_center_subscription_pricing" "cspm" {
     tier          = "Free"
     resource_type = "CloudPosture"
   }

Cleanup