Domain 3 of 4 · Chapter 3 of 3

Implement security for application platform services

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing SC-500 premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Five control families, configured separately
  • A private path is added, never substituted
  • Segmenting pod traffic inside an AKS cluster
  • Cluster user access: authentication, then authorization
  • A credential the workload never stores
  • Authenticating callers before application code runs
  • Securing a Logic Apps Request trigger
  • Bounding the validity of a callback URL
  • Declaring Logic App secrets in a deployment template
  • HTTPS-only and the inbound TLS floor
  • How an Azure WAF policy evaluates a request
  • Validating tokens in the API Management inbound policy
  • Policy scope and the base element
  • Rate limits and quotas
  • How API Management authenticates to its backend
  • Authorizing access to Azure Container Registry
  • Establishing image provenance and vulnerability status
  • Defender for Containers: which component sees what
  • Stopping a noncompliant workload at admission
  • Exam-pattern recognition

Network reach controls across four application platform services

Network reach controlAzure Kubernetes ServiceApp Service and Azure FunctionsAzure Container RegistryAzure API Management
Private inbound pathPrivate cluster: the API server gets an internal addressPrivate endpoint on the app, for supported plansPrivate endpoint on a Premium registryPrivate endpoint, or virtual-network injection (deployment) where the tier supports it
Source allowlist on the public endpointAPI server authorized IP rangesAccess restriction rules, evaluated in priority orderRegistry firewall rules for selected networksThe ip-filter inbound policy
Outbound path to private resourcesNodes already run in your subnetRegional virtual-network integration, outbound onlyNot applicable: a registry is pulled from, it does not call outVirtual-network integration for the instance
Does the private path disable public access?Not a separate toggle: private-cluster mode itself removes the public API-server path, at creation or later with API Server VNet integrationNo: public network access is a separate settingNo: public network access is a separate settingNo: public network access is a separate setting

Decision tree

Is the requirement about a request that already arrived? Must the caller prove an identity? Is it about who can reach the endpoint? App Service Authentication, or validate-azure-ad-token Azure WAF policy in prevention mode Private endpoint, then disable public access What may run, or what already runs? No private path: authorized IP ranges Gated deployment rule, or an Azure Policy deny effect Defender sensor Always: managed identity or Entra Workload ID for outward calls Yes No Yes No Yes No otherwise what may run already runs
Cheat sheet

Cheat sheet

  • Defender for Containers combines posture assessment and runtime protection
  • Azure Policy for Kubernetes evaluates workload admission requests
  • A Kubernetes deny effect prevents noncompliant pod admission
  • The Defender sensor provides workload-level runtime signals
  • Runtime vulnerability assessment evaluates images used by running containers
  • Vulnerability policy can gate Kubernetes image deployment
  • A private AKS cluster removes the public API-server path
  • AKS Workload ID federates Kubernetes service accounts to Entra
  • AKS network policy provides pod-aware segmentation
  • Entra-integrated AKS supports centralized authentication and Azure RBAC authorization
  • AKS secrets require protection beyond base64 encoding
  • Authorized IP ranges restrict a public AKS API endpoint
  • ACR role-assignment mode determines repository authorization
  • AcrPush grants image push and supported signature-referrer operations
  • ACR Private Link requires private DNS and a separate public-access decision
  • Defender for Containers assesses supported ACR images for vulnerabilities
  • Managed container runtime exposure is configured separately from registry access
  • Managed identities remove stored Azure credentials from managed container workloads
  • Bind Notation signatures to digests and verify against explicit trust
  • Use Microsoft Entra principals for ACR access
  • Assign the pull-only ACR role that matches the registry mode
  • Function keys are shared secrets rather than user authorization
  • Functions use separate controls for private inbound and outbound traffic
  • Logic App Request triggers can reject SAS after OAuth is configured
  • A Logic App managed identity secures supported outbound actions
  • App Service Authentication can reject anonymous requests before application code
  • App Service access restrictions evaluate ordered inbound rules
  • App Service should resolve sensitive settings through Key Vault references
  • App Service endpoints must enforce HTTPS and a modern TLS floor
  • SAS-enabled Logic App triggers can also restrict caller IP ranges
  • Secure Logic App secrets at both deployment parameter layers
  • Rotate or expire Logic App callback credentials to bound their validity
  • WAF managed rule sets detect common web attacks
  • WAF detection mode logs matches without blocking requests
  • API Management can reject invalid tokens before backend invocation
  • API Management child policies must deliberately inherit parent security controls
  • API Management rate limits and quotas constrain different usage patterns
  • Authenticate API Management at the backend trust boundary
  • Private API Management connectivity does not disable public access
  • WAF custom rules and managed-rule exclusions solve different exceptions

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. Authentication and authorization in Azure App Service and Azure Functions
  2. https://learn.microsoft.com/en-us/azure/aks/concepts-security
  3. Authenticate with an Azure container registry
  4. Deploy container instances into an Azure virtual network
  5. https://learn.microsoft.com/en-us/azure/container-apps/ingress-overview
  6. https://learn.microsoft.com/en-us/azure/azure-functions/security-concepts
  7. Secure access and data in Azure Logic Apps
  8. Azure App Service access restrictions
  9. What is Azure Web Application Firewall on Azure Application Gateway?
  10. https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-policies
  11. https://learn.microsoft.com/en-us/azure/container-registry/container-registry-private-link
  12. https://learn.microsoft.com/en-us/azure/app-service/networking/private-endpoint
  13. https://learn.microsoft.com/en-us/azure/api-management/private-endpoint
  14. https://learn.microsoft.com/en-us/azure/api-management/virtual-network-concepts
  15. Create a private Azure Kubernetes Service cluster
  16. Secure access to the API server using authorized IP address ranges in AKS
  17. https://learn.microsoft.com/en-us/azure/container-apps/ip-restrictions
  18. https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration
  19. Secure traffic between pods using network policies in AKS
  20. Access and identity options for Azure Kubernetes Service
  21. https://learn.microsoft.com/en-us/azure/aks/manage-azure-rbac
  22. Use Microsoft Entra Workload ID with Azure Kubernetes Service
  23. Workload identity federation
  24. https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation-considerations
  25. https://learn.microsoft.com/en-us/azure/container-instances/container-instances-managed-identity
  26. https://learn.microsoft.com/en-us/azure/container-apps/managed-identity
  27. https://learn.microsoft.com/en-us/azure/logic-apps/create-managed-service-identity
  28. https://learn.microsoft.com/en-us/azure/app-service/configure-custom-container
  29. https://learn.microsoft.com/en-us/azure/aks/use-kms-etcd-encryption
  30. https://learn.microsoft.com/en-us/azure/aks/csi-secrets-store-driver
  31. https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references
  32. https://learn.microsoft.com/en-us/azure/container-apps/manage-secrets
  33. https://learn.microsoft.com/en-us/azure/app-service/configure-authentication-provider-aad
  34. https://learn.microsoft.com/en-us/azure/azure-functions/functions-bindings-http-webhook-trigger
  35. https://learn.microsoft.com/en-us/azure/azure-functions/function-keys-how-to
  36. Workflow Triggers - List Callback URL (Azure Logic Apps REST API)
  37. Overview: Automate deployment for Azure Logic Apps by using ARM templates
  38. Secure a custom DNS name with a TLS/SSL binding in Azure App Service
  39. https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-custom-waf-rules
  40. https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules
  41. https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration
  42. validate-azure-ad-token policy (Azure API Management)
  43. https://learn.microsoft.com/en-us/azure/api-management/validate-jwt-policy
  44. Set or edit Azure API Management policies
  45. rate-limit policy (Azure API Management)
  46. https://learn.microsoft.com/en-us/azure/api-management/quota-policy
  47. https://learn.microsoft.com/en-us/azure/api-management/rate-limit-by-key-policy
  48. authentication-managed-identity policy (Azure API Management)
  49. https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-mutual-certificates
  50. https://learn.microsoft.com/en-us/azure/api-management/authentication-certificate-policy
  51. https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-mutual-certificates-for-clients
  52. https://learn.microsoft.com/en-us/azure/container-registry/container-registry-rbac-built-in-roles-overview
  53. Microsoft Entra ABAC repository permissions in Azure Container Registry
  54. Agentless container registry vulnerability assessment
  55. https://learn.microsoft.com/en-us/azure/defender-for-cloud/container-image-mapping
  56. Sign container images with Notation and Azure Key Vault
  57. Overview of Microsoft Defender for Containers
  58. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-architecture
  59. https://learn.microsoft.com/en-us/azure/defender-for-cloud/kubernetes-workload-protections
  60. Understand Azure Policy for Kubernetes clusters
  61. Enable gated deployment for container images