Who this is for
Basic Azure and networking familiarity assumed. If networking concepts are new, do Network Theory & Protocols first.
How this path works
Each cluster below links to its real lesson page. Go in order the first time through — later clusters assume the ones before them. Once you've done a full pass, use it as reference.
The path — in order
Stack Floor
01
Firewall and VPN fundamentals before the Azure-specific versions.
Domain 0 · Stack Floor
Networking
02
NSGs and segmentation as security controls.
Domain 3 · Networking
03
Azure Firewall, WAF, and DDoS Protection.
Domain 3 · Networking
Identity & Security
04
Identity is the real perimeter now.
Domain 4 · Identity & Security
05
Conditional Access, MFA, and least-privilege.
Domain 4 · Identity & Security
06
Where secrets actually belong.
Domain 4 · Identity & Security
07
Reading and acting on Defender signals.
Domain 4 · Identity & Security
08
Audit logs and standards like ISO/SOC.
Domain 4 · Identity & Security
Certification this path maps to
AZ-500: Azure Security Engineer Associate
Worth knowing: AZ-500 is scheduled to retire on 31 August 2026, with Microsoft's replacement (SC-500: Cloud and AI Security Engineer Associate) still in beta as of mid-2026. Check Microsoft Learn's current status before enrolling.
Where this leads
Cloud Security Architect is the senior path from here — same domain, aimed at designing security posture rather than implementing it day to day. SOC Analyst is the adjacent operational-monitoring track.