Azure Blue Team Learning Path

Your first day on the job as a Junior Cloud Analyst, you've been handed an Azure account and access to two resource groups without a whole lot of onboarding. Find your bearings, do the work, and figure out your permissions.

Learn the Azure CLI by investigating a missing update for a progress site. The deployment note did not reach the team, so nobody knows where the release evidence is stored or whether the update is ready to publish.

Azure rejects every website upload from the deployment service principal, even though the identity can find the storage account. Use the Azure CLI to find the missing permission and restore the upload. Give the identity access to the website files only for least privilege.

You have credentials for a client's Azure environment, but no resource inventory. Where do you start? In this beginner-friendly lab, you'll use the Azure CLI to discover resources, investigate permissions, and test access to stored data...

Learn how to investigate an unapproved website change with the Azure CLI. Compare the site files, examine role-assignment events in the Azure Activity Log, and review access to the storage account to identify who could change the site...

Get hands-on with Azure Application Insights as you investigate requests to an API. You’ll generate successful and blocked requests, then use KQL to see which requests the API allowed and which it denied. We’ll walk through connecting application logs to HTTP request records, building alerts for repeated denials...

Your manager wants you to run a quick security assessment to make sure that your data stored in Azure is not publicly exposed, and that your resource configurations are following security best practices. In this lab, you’ll hunt down and remediate Azure Blob exposure using the popular open source Prowler.

Your Azure Static Web App is open to everyone. Lock it down with Microsoft Entra authentication, grant access through a custom role, and prove that only authorized users can get in.

Long-term client secrets are not a good solution whenever we can avoid them. In this lab, you'll harden a Node.js Azure Functions API by replacing its client secret with a system-assigned managed identity, make sure the application still works, and then disable storage account key access...

Manual cloud changes are difficult to review, repeat, and restore. In this lab, you will learn how to manage Azure infrastructure with Azure Bicep, an infrastructure-as-code (IaC) programming language. You will preview and deploy serverless Cosmos DB for storing incident history.

Deploy a serverless Cosmos DB database with Terraform to learn how to deploy resources on Azure using Infrastructure as Code. This lab explains how Terraform works, how to initialize it, and how it tracks the state of your environments...

Learn how Azure virtual networks, subnets, private endpoints, and private DNS work together to protect access to important cloud resources. Starting with an application backed by Cosmos DB, you’ll build a private connection to the database, disable its public network access, and verify that the application can still save and retrieve data...

Review a proposed CloudOps Terraform change before it reaches Azure. Find and repair security misconfigurations with Checkov, then write custom policies that encode your organization's requirements as repeatable checks.