This is the closing module of the course, and it pulls together the security and governance layer that sits on top of everything you've built so far: compute, storage, networking, databases, containers, and the pipelines that deploy them.
It starts with Microsoft Defender for Cloud, Azure's cloud security posture and workload protection service — how it scores your environment, surfaces recommendations, and detects threats. From there it covers network security: network security groups and Azure Firewall, the tools that control what traffic actually reaches your resources. It moves on to Azure Key Vault, where secrets, keys, and certificates belong instead of application code, and Azure Policy, which enforces organizational standards and reports on compliance at scale. It closes with a full certification-level course that ties identity, compliance, and security concepts together for anyone preparing for the SC-900 exam.
Watch the lessons in order — this module wraps up the core course, so from here you're ready to move on to the hands-on Projects.
A guided tour of Defender for Cloud's Overview page, Secure Score, recommendations, and regulatory compliance dashboard — how Azure continuously assesses and reports on your security posture.
How NSGs act as a firewall for your virtual networks: creating rules, controlling inbound and outbound traffic, and attaching them at the subnet or NIC level.
Why hardcoded credentials are a liability and how Key Vault centralizes and protects application secrets, encryption keys, and certificates instead — including access policies and RBAC.
How to create, assign, and manage Azure policies to enforce organizational standards, evaluate compliance at scale, and automatically remediate resources that drift out of line.
freeCodeCamp's full SC-900 course: Zero Trust principles, Microsoft Entra ID, encryption, Microsoft 365 Defender, and compliance and risk management — a comprehensive tour that ties this module's concepts together and doubles as certification prep.