Manage identity, access, and governance20–25%Secure access to resources by using Microsoft Entra ID (PIM, Conditional Access, MFA/passwordless, app registrations and enterprise apps, OAuth consent, managed identities). Secure secrets and keys with Azure Key Vault (deployment, access, firewall, keys/secrets/certificates, Defender for Key Vault, secret scanning with Defender CSPM). Implement governance for security and regulatory compliance (Azure Policy, Defender for Cloud regulatory compliance and security standards, resource locks, Azure and Entra RBAC role assignments and custom roles, overprivileged-access remediation, Azure Backup protection, infrastructure as code).
≈ 14 h Secure storage, databases, and networking25–30%Implement security for storage accounts (storage firewall rules, Defender for Storage, access policies). Implement security for databases (Azure SQL platform-level security, auditing for Azure SQL Database and Managed Instance, Defender for Databases). Implement security for Azure network services (NSGs and ASGs, Azure Virtual Network Manager, Virtual WAN, VPN, Microsoft Entra Private Access, private endpoints and Private Link, Azure Firewall, Network Watcher effective security rules).
≈ 17 h Secure compute20–25%Implement security for AI (SharePoint data overexposure, Purview DSPM for AI risks in Microsoft Copilot and AI apps, Copilot Studio real-time protection, Conditional Access and blast-radius analysis for Microsoft Entra Agent ID, AI Gateway in Azure API Management for Microsoft Foundry, Defender for AI Service, Foundry agent guardrails, Data and AI security dashboard). Implement security for servers and VMs (disk encryption, Azure Bastion, JIT VM access, Azure Arc, Defender for Servers with vulnerability scanning/EDR/agentless scanning, secure boot/vTPM/integrity monitoring, Azure Machine Configuration). Implement security for application platform services (Defender for Containers, AKS, Azure Container Registry/Instances/Apps, Azure Functions, Logic Apps, App Service, Azure Web Application Firewall, API Management back-end protection).
≈ 14 h Manage and monitor security posture20–25%Manage security posture with Microsoft Defender for Cloud (Defender CSPM, security-framework compliance, workload protection plans, multicloud connectors for AWS and GCP, Defender Vulnerability Management, Defender External Attack Surface Management). Implement activity and event collection in Microsoft Sentinel (workspaces and roles, content hub, data connectors, syslog/CEF, Windows Security events via data collection rules and WEF, custom log tables, automation rules and playbooks, data retention, Purview Audit queries in Defender XDR). Implement Microsoft Security Copilot (workspaces, permissions and roles, plugins, Microsoft and Security Store agents).
≈ 14 h 
Alex