Home labs & practical projects
Review an inherited Azure security baseline
A project to do with your own tools, with guidance on what to create and capture.
For existing holders and historical learning. Check the current credential before starting exam preparation.
What you could create
An existing AZ-500 holder is asked to review an older Azure environment with broad administrative access and incomplete security monitoring.
| Evidence | What to capture |
|---|---|
| Legacy baseline review | Show the inputs, scope and decisions behind this record. Each finding has evidence, an owner and a validation method. |
| Prioritised remediation and validation register | Include the evidence supporting your conclusion. The review avoids treating an archived exam as current product guidance. |
What you'll need
Document, spreadsheet or diagram tool
Invent a historical baseline containing one privileged group, a public storage exception and an unreviewed alert. Use current product documentation when assessing remediation.
Project record
Keep the working files for legacy baseline review and record assumptions as you go.
Current reference material
Use the linked provider resources to verify the features, access terms and version relevant to your project.
Access & cost
No paid platform is needed for the written version. Use a document, spreadsheet or diagram tool you already have.
The organisation and records are fictional. Write down assumptions; do not substitute confidential employer information.
Suggested milestones
- 1
Plan and investigate
Separate identity, network, data and monitoring findings.
- 2
Develop your approach
Prioritise corrections by business exposure and operational dependency.
- 3
Verify and explain
Write validation steps for each change and note where the old baseline needs current guidance.
Useful resources
Use these resources to deepen your understanding and check key details.
A useful starting point
Invent a historical baseline containing one privileged group, a public storage exception and an unreviewed alert. Use current product documentation when assessing remediation.
What a good result looks like
- Each finding has evidence, an owner and a validation method.
- The review avoids treating an archived exam as current product guidance.
- Administrative access recovery is considered before restrictions are applied.
Finish the project
Keep the decision record and note unanswered questions. A written design is not evidence that a technical control has been tested.
Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.