Azure Security Engineer Readiness (AZ-500)
Signature Course No. 507 — A Signature AI Socratic Coaching Course.
No experience needed — your coach starts where you are.
A New Kind of Learning
Socratic coaching, delivered by an agentic AI coach.
Not a course you watch. An AI coach you work with.
The Lighthouse Coach begins by discovering how you think about the subject, teaches what is missing, and gives you realistic practice before asking you to prove that you can use it. You may test out of concepts you already understand, while capstones turn the learning into a practical plan, decision, conversation, or other real-world result.
The curriculum is deliberately authored; the AI delivers it through coaching. It is not an AI randomly generating lessons.
A coach that teaches by asking — not by lecturing
The Lighthouse Coach is an AI Socratic coach built on Cognosco Learning's Azure Security Engineer Readiness (AZ-500) course, in the Risk, Safety & Compliance category. It does not play videos at you. It holds a conversation: it asks you a question, listens to your answer, names the misconception it hears, affirms what you got right, and asks the next question — the way a great coach works in the room.
Every control is an answer to a named risk, at a named scope, with a named owner, and evidence it worked. That one sentence runs through all eighteen concepts of this course. A control you cannot state in that form is a hope — and the AZ-500 examination rewards engineers who can state it, choose it, and spot the answer option that quietly breaks one of its four parts: the wrong scope, the missing condition, the unowned alert, the unproven fix. Most Azure estates are not breached through exotic failures; they are breached through ordinary ones, made by competent people under time pressure — a storage account left public, a standing privileged account that was only ever meant to be temporary, a network where everything can reach everything.
It starts with the map. Before any control, you learn to read an estate as a hierarchy of scopes — tenant, management groups, subscriptions, resource groups, resources — where security decisions inherit, and to draw the shared-responsibility boundary honestly: Microsoft secures the facilities, the hosts, and the platform it operates; you secure what you put in the cloud. Every later concept operates on that map.
It works in two movements. First, Module 1 — Identity and the Platform: Who Gets In, What They Can Reach — work through Concepts 1–9, finishing with The Petravolt Build Plan; then, Module 2 — Operations, Data and Applications: Running It Secure, Proving It Ready — work through Concepts 10–18, finishing with The Petravolt Operations and Readiness Plan.
Both capstones produce real artifacts — an identity-and-platform build plan for Petravolt Energy, the course's running case: the estate audited on its map, identities and conditional access designed, standing privilege converted into governed loans, keys and secrets placed in custody, reachability drawn and workloads hardened, the control plane guarded; and, six weeks on, an operations, data-protection, and readiness plan for the same estate: one owned findings queue, detection designed chain by chain, data classified and secured service by service, encryption written as honest sentences, and a rehearsal fortnight that proves readiness under timed conditions. Each capstone also runs on your own ground — an estate you are actually responsible for.
The honesty standard is part of the course. This course offers readiness, not a result: no book can guarantee you will pass an examination, and this one does not try. Nothing in it reproduces examination content — every scenario is invented for teaching, because practicing on remembered items rehearses recognition where the examination demands judgment. And because Azure changes constantly, version-specific facts are fenced: the teaching keeps to the durable decisions, and the perishable detail is named in the course book's Appendix for re-checking against Microsoft's current documentation before your examination date.
The course is self-paced and always on — roughly 30 minutes per concept, about 9 hours in full, taken in as many sittings as you like. You can type your answers, or talk out loud: the Voice Coach speaks its questions and listens to your spoken replies. Learners who already know the material can test out concept by concept.
Azure Security Engineer Readiness (AZ-500) is part of The Lighthouse Signature Series — the online counterpart to the one-day, in-person learning Cognosco Learning delivers.
Course Facts
One full concept, coached end to end — free: verify your email and we’ll send you a link to start.
Already enrolled? Enter the course →
Diagnose → Learn & Practice → Prove → Capstone
Every learner moves through the same discipline a Cognosco instructor would insist on in the room.
Diagnose
The Coach starts where the course starts: with your own estate's map. Sketch its hierarchy from memory — tenant, management groups, subscriptions, and what each is for — and say where the sketch goes vague, and what decision you made recently on the basis of that vague part; name one security setting your team applied in the last year, the scope it lives at, and what else inherits it; and pick one workload you know well and draw its shared-responsibility boundary — which parts are genuinely Microsoft's, which are yours, and where that boundary is written down, if it is written down anywhere. Every concept opens with three questions that locate where you actually stand, and your answers shape how deeply the Coach works the concept with you. Everyone begins with Module 1 — no skipping the foundations you only think you have.
Learn & Practice
Work each concept in conversation with the Coach — spoken or written — then practice it against realistic situations until it holds up.
Prove
Every concept ends in proof: answer the check cold and demonstrate the skill. Know it already? Test out and take credit immediately.
Capstone
Finish with two capstones — The Petravolt Build Plan for Module 1 and The Petravolt Operations and Readiness Plan for Module 2 — that pull the whole course together, and earn the certificate.
What You'll Learn
Named risk, named scope, named owner, evidence it worked. Every control in this course is stated in that form, and every check asks you to spot the answer that quietly breaks one of its four parts. The examination samples judgment — reading an unfamiliar estate, finding the governing decision, and choosing the control that fits — and that is what you practice, concept by concept, on situations you have never seen.
Module 1 builds the estate from the identity outward. The estate mapped before it is secured; an identity for every actor — users, groups, workloads, devices — with managed identities chosen over stored secrets; sign-in gated by authentication strength and conditional access; permission granted by role, at the narrowest scope, for the shortest time; privilege run as a loan under approval and review; reachability drawn as a decision; hosts and containers hardened; keys and secrets held in vault custody; and the control plane itself guarded by policy and locks.
Module 2 runs the estate once it is built. Posture read continuously in Defender for Cloud, with findings owned and ranked; detection designed as a system in Microsoft Sentinel, over logs built as an instrument rather than an archive; data classified before it is protected, then secured service by service across storage, databases, and applications; encryption applied as a system of states and custodies; and the whole body of judgment converted into examination readiness — pacing, evidence-handling, and the discipline of changing an answer only on evidence.
And it holds its boundary throughout. This is an Azure book, and an examination-shaped one. It does not teach cloud security in general — the vendor-neutral seats on this shelf own that ground — and it does not teach another platform's security model, however similar the vocabulary sounds. Where a concept exists on other platforms, this course teaches the Azure form of it: Microsoft Entra ID, Azure role-based access control, Azure Policy, Microsoft Defender for Cloud, Microsoft Sentinel, and Azure Key Vault.
What you will learn
- Map an Azure estate — management groups, subscriptions, resources, and shared responsibility — and place every security decision at its correct scope
- Design identities for users, groups, workloads, and service principals, choosing managed identities over stored secrets wherever the platform allows
- Gate access with strong authentication and conditional access policies that respond to user, device, location, and risk signals
- Grant and review permission through Azure role-based access control at least privilege, and run privileged roles as time-bound, approved, just-in-time access
- Design network reachability deliberately: segmentation, network security groups, firewalling, private endpoints, and denial of public exposure by default
- Protect platform hosts and workloads: hardened virtual machines, container and Kubernetes security, patching, and endpoint protection under Defender plans
- Put keys, secrets, and certificates under Key Vault custody with rotation, access boundaries, and recovery protection
- Run continuous posture management with Microsoft Defender for Cloud, Azure Policy, and secure-score discipline, and operate detection and response with Microsoft Sentinel and Azure Monitor
- Secure data and applications service by service: classification, storage, databases, web applications, encryption at rest and in transit — and demonstrate all of it under timed, examination-shaped conditions
Everything in the course
- All 18 concepts of Azure Security Engineer Readiness (AZ-500), in 2 modules
- A starting-point check first — the Coach finds where you actually stand before teaching
- Learn, Practice, Prove for every concept — no passive video watching
- A test-out on every concept: prove you know it and move on
- The Voice Coach: talk with the Coach out loud — it speaks, listens, and replies
- A personal Learner Record of your work across the course
- Two capstone exercises: The Petravolt Build Plan and The Petravolt Operations and Readiness Plan
- A printable session summary whenever you pause
- The Lighthouse Coach completion certificate (Signature Series)
- Your progress is saved as you go — stop anytime, resume where you left off
Built for the engineers who secure Azure estates
Azure administrators and engineers moving into security work — who can already build on the platform and now need to secure what they build at examination standard; and security engineers and analysts whose estate is Azure, preparing for AZ-500 and wanting judgment practice, not question banks.
Infrastructure and platform leads — accountable for an Azure landing zone, an identity estate, or a regulated workload, who need to know what good looks like well enough to review others' work.
Experienced practitioners testing out — if you already run these controls daily, the test-out route in every concept lets you prove it on a fresh scenario and move on. This course assumes you can already find your way around Azure — subscriptions, resource groups, virtual networks, virtual machines, storage accounts, and the Entra ID directory — at the level of an administrator who has built real things; it does not re-teach Azure foundations, networking foundations, or general security theory.
Prefer to learn live and in person? The same material anchors Cognosco's one-day programs — browse the in-person catalog.
Start with Map Before You Secure
$195 — introductory price. One payment. No subscription, no password to manage.
Here is exactly what happens when you enroll:
- Pay securely with Stripe — you are taken straight into the course
- Create your learner profile and begin the Module 1 starting-point check
- Save the access key you are given — it restores your enrollment on any device
- Learn at your pace; your progress is stored in your browser on your device
For the full voice experience, use Chrome and allow the microphone when asked. Typing your answers works everywhere, all the time. Questions before you enroll? Email hello@cognoscolearning.com.
Before you enroll
What is a Socratic coaching session?
A conversation, not a video. Your coach asks a question; you answer — out loud by voice, or by typing — and the coach responds to what you said: naming the misconception it hears, affirming what you got right, and asking the next question. You advance only when you have mastered each concept, so a finished course means the learning held.
How long does it take — and how long do I have?
About 30 minutes per concept. Learn in sittings of any length; your progress is saved as you go. You have a full year from purchase to finish, and you can revisit and retake within that year.
What does the certificate verify?
That you completed every concept and both capstones of this course. Anyone can confirm a Cognosco certificate online — enter its certificate ID on our verification page.
What if it isn't for me — what are the refunds?
If you have not started, cancel for a full refund within seven days of purchase. Once you have started, there is no cash refund — stop before finishing and we credit the full amount you paid toward any other course in the library (credit valid one year from your original purchase). Once you complete the course, no refund or credit applies.
More Signature Courses are coming
Azure Security Engineer Readiness (AZ-500) is Signature Course No. 507. Leave your email and we'll send you news of future Signature Courses and Lighthouse updates as they are announced — nothing else.